Let's Chennai!

India is diverse - from snowy Himalayas to serene coasts of Indian Ocean, and Chennai, name it the shore of majestic Marina or the vibrant window of Southern India, is one of the shinning gems that glitters on India's tip.

Looking at pictures of havoc caused by floods in Chennai had my memories of the city come alive, so this Sunday, over a shot of espresso, am putting my thoughts for you, Chennai. I have been seeing a lot of feeds on my social networking connections about people in Chennai and across the country lending hands and love for the charmingly chilly Chennai. This is India's strength. We stand together holding hands, when the need of hour be. 

I always see these moments to remind cities like Chennai of its strength and to look back and within to remind them of what they hold beneath them.  I have had the charm of living in various cities, and they happen to not let me see them as just mere cities but a living soul with a distinct culture and a story to inspire many souls. These cities are like those humans, who inspire us. Whether it's the never dying spirit of Mumbai which keeps growing strong, or the vibrant and cultured charm of Ahmedabad, that focuses on strategic evolution. Let's be honest, we fall in love with a city we tend to know more-and-more about, and as-and-when we happen to know them. 

My memories of Chennai are pleasant, may be of course I visited Chennai in winters and not sunny summers. In both my interaction with this majestic city, I realized it holds a warm, and a set of always helpful people beneath it. They are happy and jolly in living life the way they do. It's like straight being out of a 700 MM screen, where everything about it is normal, but a dream in our eyes to be larger than life. In fact, within my Tech Mahindra's tenure as well, and otherwise around Hinjewadi IT Park, I happen to meet people from Chennai and elsewhere, holding promises in eyes to be long lasting friends, and they just want you to know more about their culture and always eager to see do what your culture holds for them. That breaks the very stereo-type that Chennai souls hardly get interactively closer to the way others live. All you need to do with Chennai and its people is, shake a hand, give them a warm greeting and they open a box of happiness for you; this has been my experience.

Chennai has a glorious and uniquely inspirational history, just like any other majestic Indian city going as deep as 7th and 8th centuries. It has the distinct flavor from the ancient Indian culture ( Mahabalipuram temple or the morning sh​lokas that are very Sanskrit) , blend of Mughal and English savor (Triumph of Labour).

It gives a feeling of discomfort to see our cities being uprooted by calamities. So Chennai, you hold a lot within you, let's get back on the track of unlimited entertainment, beating the drum of sneering equatorial heat, thriving roads and pumping the life of many. You've made the look the wrath of 2004 tsunami and its aftermath look pity in front of your majestic charisma! One long Whsitle podu, and stand tall larger, bigger. Lets Chennai!​ 

Information Security - More about Implanting Practices Than Just Awareness & Training

With more and more data getting electronic, and with more and more data going on line, information security is becoming a vital discussion and area of concern for organizations, federal agencies, governments, even individuals.

Because of this, many organizations have been spending a certain amount of effort and time in conducting awareness training, and, coming up with ways to make people more aware with hoardings, sign boards and what not. This is done to take the best short-cut approach in making their most vulnerable asset for information security, their people, educate and realize the pros & cons, and to preach awareness about how responsible they should be.

But lets be honest to ourselves? Have we been successful? There are still cases I hear knowing organizations, colleagues, friends, acquaintances compromising their vital information and getting hooked, whether be their own personal credit cards, documents and what not!

I believe that a well presented training and awareness program does invoke thoughts about aspects of information security and realization of being secured, but it CANNOT ensure how the attendees may take that very invoked thought ahead and if they can really implement the thoughts in their lives, unless and until they happen to witness an incidence themselves!

Through this article, I am trying to open a thought process, where we think beyond just training and awareness campaigns, but infact implant the very practices in their people.

Everybody is aware about wearing a seat-belt while driving and helmet while riding, everybody is aware about the fact that smoking tobacco is injurious to health, everybody is aware about the benefits of having good food habits, exercising daily and waking up early. Awareness exist, but practices does not.

As health is important for people to think about, similarly, information security is equally important for organizations to maintain their competitive edge, confidentiality of their data, integrity of their organizational practices, and availability of resources and data as and when required.

By and large, following are the gaps with training and awareness programs:

• Training programs are not aligned with the risk assessment that has identified the potential risk areas to the business and organization;
• Success of majority of training programs are immeasurable;
• Majority of training programs are unrealistic and based on generic aspects i.e. they're not tailor-made;
• Focus is more on presentation, or as a periodic practice of just having a training program but not on what people want.

So what next?

Simple. Just three aspects:

1. Conduct risk assessment to identify risks;
2. Target behavior change;
3. Prepare a yearly timeline and set realistic targets;
4. Engage people personally.

Lets get realistic. Lets start putting efforts in the right direction, because you anyways are or you anyways will have to. Remember, precautions are always easier than corrections! The awareness has to be embedded in the most important and most vulnerable asset of the organization - human resource i.e. people, and at certain stages in some organizations, this has been.

For example, when was the last time, you changed the password of your LinkedIn, Facebook or Twitter account? That's because LinkedIn or Facebook doesn't prompt you to change passwords every 60 days! But, if you work in an organization, where the password is set to be changed in every 60 days, you will do it, and there's no other way out to avoid it. But again, every organization doesn't has this practice implemented or is been restricted to certain users; but they will always talk about securing their data and pass-coding their machines / workstations through passwords!

Tail-gating, phishing emails, malware attacks, you've been talking about it in your training, but no one takes it seriously. Implement practices to curb or catch hold of people to train them that they are doing it wrong.

For ex: create a dummy account, send an email which looks like a phishing mail, see how many open it. Call those people and then train them, that it is not the correct practice and they shouldn't be opening emails, make them aware about the real time incidents of how the accounts of even many CEOs, CTOs were compromised because of phishing emails and the consequences, ask them to report such emails to the network monitoring team (or whosoever can take care of these aspects in the organization). 

You see an unlocked workstation, click it and then tell the custodian that you were abut to send his resignation letter to his boss with a pinch of humor. 

I believe Information Security is one of the most discussed and challenging subjects for organizations, federal agencies, and governments, but at the same time it is one of the most easiest practice to secure the information, only if you follow the basics and the under-lying processes efficiently. The most basic fundamental about information security is the fact that it all depends on the custodian themselves to realize how vulnerable they're and it is them who must follow and embed culture around them to become immune to any InfoSec attacks! It is like snow and rains, which is targeting everything around you, but if you have the right gear, you will walk without feeling a pinch of it.

Let Project Portfolio start working for project, and project for you!

Lets start with project...meaning of the project, in simple words, is a planned set of interrelated tasks to be executed over a fixed period and within certain cost and other limitations.

Moreover, projects add value to the organizations, as they not only mean business, but executing projects effectively helps organizations gain recognition and reputation. Organizations also endow effort, time, finances and different types of resources for execution of their projects.

That is the reason why many organizations believe in delivering projects through their well-planned, self-defined and structured project management, where they identify the different phases of the projects, list of activities to be carried out within each phase, limitations. Organizations also weave project life-cycles depending on their classification of projects, major or minor.

The simple definition to realize importance of project is that projects are executed to achieve a specific goal. This goal may be for its clientele or for the organization itself. If project is executed loosely, you may not achieve goal in the desirable way. To achieve efficient execution of projects, organizations have project management or as they may realize it through their dedicated group or department commonly named project management office.
But can project management translate an organization's business strategy? Answer is No! Then who? Answer is Project Portfolio Management!

I have worked on developing various programme management framework for clients across various domains, and I realize clients, even internal resources are usually confused between what project, portfolio or programme (some call it 'program' as well) is or for them, or if they are all the same!

But that’s not true! These are three different verticals and they have different functions to perform. You may have a well-defined project management in place, but it is always going to assist you in delivering a single project. Project management will define the best practices to assist you develop a plan and timeline to deliver specific set of deliverable defined for a project.

But is project management all what organizations need? Rather, let me ask is your organization doing just one project a year? You have multiple projects, and what about handling them, who is going to handle them? Project management will help you deliver each of those multiple projects, but what about managing those multiple projects? For this aspect you have Progamme Management.

Programme Management helps managing several related projects, often with the intention of improving an organization's performance. In practice multiple projects, span functions within an organisation, includes business elements (set of projects makes a programme).

But again, what if an undertaken project is not aligned with the organization’s strategies or does not make use of its core competencies, ultimately resulting in poor returns. What if the projects are overlapping and organization finds itself in a pool of resource crunch, despite having adequate resources?

Take a simple example of tubes, metros or commuter trains. Consider train as a project, which is well - executed, follows signals from starting point to its destination and has an efficient driver (project manager). But your train is not the only train in the system. There are multiple trains (projects) operating at a quick pace as they have to meet their defined timeline. They require the railway track, platforms for commuters to get in and out (resources), and all these trains share the same amount of resources!

If these trains are not managed efficiently and effectively, trains may end up being at the wrong terminal at the same time. Not just that, this may cause major accidents with trains being on the same track (projects to be delivered on the same date), and exhausting of resources (SME required for 2 projects at the same time)! It will be a chaos!

Therefore, as it is important to manage projects for the organizations, they also need to manage the portfolio of projects. Portfolio of projects will ensure a central repository or database consisting of projects in pipeline, current and projects that were executed in the past.

This will assist in strategizing delivery of projects based on the business strategy, assessing and managing the projects in a collective manner with the following:

• Determining whether (and how) a set of projects can be executed by the organization with finite set of resources in a specified time. Business Benefit is estimating and selecting capital investment projects with strategic plan;
• Efficient and effective utilization of organization’s resources including financials, inventory of project assets (servers, workstations etc), human resources etc. Business benefit also extends to realizing annual resource allocation, resource utilization during adverse impact minimal or nil exhaustion of resources;
• Planning and prioritization of any new all-of-a-sudden project requirements, new and amending regulatory demands, or requirement of enhancements;
• Proactive risk assessment of project related risks. But caution – this depends on how you develop your risk assessment methodology, your focuses. Do they include quality or information security or both or what?

Project Portfolio Management will create a balanced platform of projects by categorizing, sorting and prioritizing based on identified criteria. Organizations may identify these criterions from business context, to utilization of resources, expenditures, financial profit cost centers, etc.

Look at this below picture, Project Portfolio always sits up in the hierarchy when it comes to effective handling of projects, as it is responsible to provide input for annual business strategy to organizations and also ensures that the organization’s strategy is not compromised by the execution of projects.

If organizations are conforming to certain ISO certifications, Project portfolio also turns vital now, as it advocates top management leadership and business alignment.

But key to a successful Project Portfolio Management is to define and set priorities through an intent of:

• Achieving appropriate business value optimization for the organization;
• Considering risk recognition and mitigation is equal to reward;
• Conducting periodic reviews of the portfolio with top management understanding the concerns or issues through a bottom’s up approach

Remember - A project is complete when Project portfolio starts working for project, and project starts working for you!