EA @ UoB

Lecture to CompSci students on how we do Enterprise Architecture at the University of Birmingham

Transcript

1. 04 June 2015 Enterprise Architecture David Deighton Chief Enterprise Architect IT Services
2. 2 IT Services: Architecture, Security & Innovation What is Enterprise Architecture? Many different definitions from a variety of sources:  Enterprise Architecture (EA) is a holistic approach to managing the complexity of IT from a business perspective.  MIT: the organizing logic for business process and IT capabilities reflecting the integration and standardization requirements of the firm’s operating model.  Often compared to town planning or urban design.  EA documents the structural and behavioural building blocks, and their relationships, that make up the overall information system of the enterprise.  A management tool, not a silver bullet, EA provides a blueprint for effective IT strategy and guides the controlled evolution of IT in a way that delivers business benefit in a cost effective way.  EA is at the nexus of business and IT
3. 3 IT Services: Architecture, Security & Innovation Overview  Holistic approach to using technology and information for greatest benefit  Enterprise-wide focus – defends the interests of University as a whole  Combines business, application, technology, information, security views  Management tool not a silver bullet - a blueprint for effective IT strategy  Governance – ensures strategic fit, fitness for purpose, security
4. 4 IT Services: Architecture, Security & Innovation Origins of EA • Concept first referred to by John Zachman 1987 • ‘Enterprise Architecture’ term first used in NIST document 1989 • Zachman framework developed in 1990s • IEEE 1471 standard released in 2000 ISO15288 Ontology Ethnography
5. 5 IT Services: Architecture, Security & Innovation Basic Concepts Identify stakeholders and create architecture views to address their concerns Build architecture framework from first principles EA ontology Architecture framework may vary for different types of organisation?
6. 6 IT Services: Architecture, Security & Innovation Methodology  At the University we have adopted a working framework and architecture process based on:  TOGAF – the Open Group Architecture Framework  Archimate – diagrammatic architecture description language (ADL)  Many other frameworks, methods exist:  Zachmann – one of the earliest efforts to formalise EA  DoDAF – US Dept. of Defense Architecture Framework  4+1 – framework (RUP)  But does a ‘one size fits all’ framework work in practice?  Compared with a targeted approach  Different types of enterprise, different industries have different stakeholders and objectives  Criticisms of TOGAF  Overly bureaucratic and document centric o No-one implements TOGAF in its entirety  More suited to solution architecture than EA?
7. 7 IT Services: Architecture, Security & Innovation EA @ UoB EA practice is part of IT Services (this usual, although it could also have been part of Strategic Planning) Combined with Information Security and IT Innovation – exploit synergies Architecture Define and realise enterprise architecture vision that realises strategic goals and maximises business benefit from technology and information. Security Maximise the value of information through availability subject to protecting confidentiality and integrity, while maintaining dependability and accountability. Innovation Facilitate innovation – identify, capture, evaluate and implement ideas.
8. 8 IT Services: Architecture, Security & Innovation What do we do? Architecture Derived from IT Strategy, market trends, innovation, industry road maps etc. + Governance Security Based on enterprise architecture information principles, external threats and innovation. + Governance Innovation Observatory function takes input from architecture, market trends and ideas from network of innovators.
9. 9 IT Services: Architecture, Security & Innovation UoB Architecture Process Based on TOGAF 9.1 Verify against Architecture Vision, Design Review. Sign off Preliminary design review and agreement
10. 10 IT Services: Architecture, Security & Innovation UoB Architecture Framework
11. 11 IT Services: Architecture, Security & Innovation Process Comparison Information Management Life Cycle Processes in use at UoB
12. 12 IT Services: Architecture, Security & Innovation Architecture Value Proposition  Standardisation and economies of scale  Business agility and adaptability  Operational efficiency and higher productivity  Benefit from emerging technology sooner  Empower staff to work more efficiently  Manage risk  Technology risk (e.g. impact of technical entropy)  Information risk (e.g. confidentiality)  Optimise investment in technology and information  Invest for competitive advantage  Portfolio management / application streamlining  Maximise value of information assets o Deliver information where and when needed o Improve quality of information (integrity, consistency, accuracy…)
13. 13 IT Services: Architecture, Security & Innovation Architecture as Strategy
14. 14 IT Services: Architecture, Security & Innovation Architecture Principles Help Realise Strategy  Architecture Principles  Based on strategy + market and technology trends  Used to drive Architecture & Security governance  Ensure strategic alignment of projects  Architecture Vision  Business principles – Business Vision  Application principles – Application Vision  Technology principles – Technology Vision  Information principles – Information Vision
15. 15 IT Services: Architecture, Security & Innovation 25 Architecture Principles Business • Innovation • Agility • Value • Priority Information • Confidentiality • Integrity • Availability • Accountability • Dependability • Information Life Cycle Application • Reuse • Interoperability • Coherence • Plug and Play • System Life Cycle • Hiding Technology • Simplify • Standardise • Rationalise • Tiering • Monitor • Green IT • Virtualise • Capacity Planning • Technology Life Cycle
16. 16 IT Services: Architecture, Security & Innovation Flow from Strategy to Implementation
17. 17 IT Services: Architecture, Security & Innovation  Principles  Prioritise business needs  Promote agility / adaptability  Maximise value of information assets  Innovate for competitive advantage  Main techniques used  Business Capability Models  Road Maps – change over time  Information models  Heat maps Business Architecture
18. 18 IT Services: Architecture, Security & Innovation Application Architecture: Applications Application Architecture realises business architecture
19. 19 IT Services: Architecture, Security & Innovation Application Architecture: Data
20. 20 IT Services: Architecture, Security & Innovation Technology Architecture Technology Architecture realises application architecture
21. 21 IT Services: Architecture, Security & Innovation Information Security People • Targets for social engineering, shoulder surfing, blackmail etc. • Vulnerabilities include lack of knowledge / training and lack of employment vetting Processes • Can be disrupted by attacks on assets or people Assets • Tangible or intangible • Have quantifiable value • Have vulnerabilities that can be attacked • Can suffer quantifiable impact • Tangible Assets can be attacked directly • Intangible Assets may be harmed as a consequence of impact on Tangible Assets Controls are security mechanisms that protect assets, people and processes: • Procedural, technical, human • Prevent, detect or repair harm Business Capabilities provide a convenient framework for Information Security
22. 22 IT Services: Architecture, Security & Innovation Information Risk Management  Risk Management Process  Identify risks (risk = threat + vulnerability * likelihood of success)  Define appropriate response o Accept – do nothing and simply accept the risk o Transfer – assign the risk to someone else (insurance, sub-contractor) o Avoid – the risk by stopping the activity that caused it o Mitigate – reduce the risk by implementing controls • Verify – effectiveness of controls and ensure cost / benefit Controls should not cost more than the impact to the assets concerned  Repeat o At least annually  Controls  Preventative – help stop attacks, or stop them succeeding  Detective – discover attacks that have already happened  Reactive – repair harm caused by attacks
23. 23 IT Services: Architecture, Security & Innovation 6 Information Principles INF1 Accountability Ensure that all information assets have an identified business owner who is accountable to the University and track and record all actions and events that lead to access or changes in information. INF2 Availability Deliver information where and when needed, via multiple channels, to maximise its value as an asset, within the constraints imposed by the other information principles. INF3 Confidentiality Prevent unwanted access to information. Use a risk based approach to identify confidential data then label and manage it accordingly. INF4 Dependability Ensure consistency and predictability by implementing appropriate constraints and controls. INF5 Information Life Cycle Take full account of the time dimension of information based on the standard Information Management Life Cycle. INF6 Integrity Prevent or detect and repair unwanted changes to information.
24. 24 IT Services: Architecture, Security & Innovation Information Management Life Cycle Identify Find or identify information Capture Acquire or create information Organize Organise and add to information stores Publish Distribute to intended audience Utilise Use and manage Retain Keep for reference, even though no longer current Dispose Destroy or archive • Classification may change over life cycle • Review at start of each phase
25. 25 IT Services: Architecture, Security & Innovation Implications  Accountability  Ensure asset owners take responsibility for their information  Track all access and changes by individual electronic identities o Improve verification of user identities (e.g. using strong authentication)  Availability  Maximise availability subject to stringent access controls  Progress information centric computing  Deliver information where and when needed (but not before?)  Dependability  Ensure consistency and reliability across all delivery channels  Implement Master Data Management o Identify and manage master data o Synchronise copies with master data  Integrity  Take action to maintain and improve data quality (Business and IT) o Combat information entropy  Identify and block or repair unauthorised changes
26. 26 IT Services: Architecture, Security & Innovation Innovation – Extension of EA • Ideation – capture and evaluate ideas • Build a ‘network of innovators’ • Collect and document ideas in ‘ideas bank’ • Stimulate and facilitate ideation • Incubation – nurture and develop ideas, conduct experiments • Continuing programme of experiments • Document and communicate results • Revisit and re-evaluate • Execution – facilitate implementation and reap benefits • Facilitate and support take-up of ideas • Help realise the benefits Managing the Innovation Process
27. 27 IT Services: Architecture, Security & Innovation Investing in Innovation Baseline / BAU Innovation 20% 14% New business opportunities Disruptive change Competitive advantage Must have! Business as usual Reliable delivery of services Incremental progress Typical Spend: 66% Differentiation
28. 28 IT Services: Architecture, Security & Innovation How do we do it?  Observatory  Horizon scanning, analyst reports, industry, research directions  Ideator – innovation management application  Ideas management, challenges, electronic suggestion box  Ideas bank – knowledge base of ideas, experiments, evaluation reports, follow-up  Community – social network of innovators  Events – discover ideas / build network of innovators  Student Mobile App Competition (SMAC)  Mobile Apps in Research Summit (MARS)  Workshops / drop-in sessions / training  Community  Engagement with students, academics, corporate services, external  Experiments  An on-going programme of experiments and evaluations
29. 29 IT Services: Architecture, Security & Innovation Want to be an Enterprise Architect?  Experience  Usually >5 years experience before becoming architect  Most architects in their 40s – but this may be changing as the field matures and targeted qualifications emerge  Competent across architecture domains  Business, Application/Data, Technology, Security…  Background in IT or Business Analysis  Generalist not a specialist  But able to drill-down to detail where needed!  Qualifications  PhD + MBA?  More usually MSc or equivalent experience  Emerging certifications – TOGAF / Open Group / BCS
30. 30 IT Services: Architecture, Security & Innovation Discussion  Pain points  Enterprise view versus project view o Projects focussed on delivery – date is (all) important o Architecture focussed on quality and delivered business benefit o Sub-optimal choice for project may yield greater benefit for University  Some may feel Architecture or Innovation trespass on their area o But we are all in this together – working for the benefit of the University o There can be no ‘no go areas’ o We are held back by ‘silo thinking’ – detracts from agility, slows progress  Resolution  Open discussion and ‘creative tension’ is beneficial  Change is inevitable o Important thing is how we meet it