Chapter 15 Managing Information and Technology

Differences in Information Needs

The job is complicated by the fact that information needs vary according to different levels, operational units, and functional areas. Consider, for instance, the information needs of managers at several levels:

• Top managers need information for planning, setting objectives, and making major strategic decisions.
• Middle managers need information that helps them allocate resources and oversee the activities under their control.
• First-line managers require information that helps them supervise employees, oversee daily operations, and coordinate activities.

Figure 15.1 "Information Needs and Flows" illustrates a hypothetical hierarchy of information needs at Caesars. The president, for example, needs information to determine whether profitability is up or down or if the organization is facing any new competitive threats. At the vice-presidential level, executives need information that will help them in controlling and planning for specific areas of operations. The VP of casino operations, for example, might need to know which operations are most profitable—slots, table games, or other gaming activities. The VP of hotel operations might want to know whether room revenues are going up or down.

Figure 15.1 Information Needs and Flows

The information needs of middle-level and lower-level managers are different still. The slot-machine manager might want to know whether the placement of machines on the casino floor affects profitability. The poker manager might want to know whether all table games comply with state regulations. At a lower level, the pit manager (who’s in charge of table games in a particular area) needs to know whether there’s a card-counter at his blackjack table or whether a dealer’s activities are suspicious.

Even at a given level, information needs can vary. A manager on the hotel side of the business, for instance, doesn’t care much about profitability at the poker tables, while a pit manager doesn’t have much use for hotel housekeeping reports. The reports that an accountant needs would hardly be the same as those needed by a human resources manager.

The Need to Share Information

Having stressed the differences in information needs, we should pause to remind ourselves that the managerial levels, operations, and functions of every organization are intertwined, to a greater or lesser degree. If you’ll glance again at Figure 15.1 "Information Needs and Flows", you’ll be reminded that organizations need to share information, that information must flow, and that it must flow in both directions, bottom-up and top-down. At Caesars, for instance, both casino and hotel managers are concerned about security, which is also of interest to managers in different functional areas. Information supplied by the security group is obviously vital to managers in the gaming areas, but HR managers also need it to screen potential employees. Marketing information is clearly important to both casino and hotel operations: to maximize overall profits, the company uses marketing data to fill hotel rooms with customers who spend big in the casinos.Jim Kilby, Jim Fox, and Anthony F. Lucas, Casino Operations and Management, 2nd ed. (Hoboken, NJ: John Wiley & Sons, 2005), 183–84.

Caesars’s information needs entail more than allowing individuals in a given casino to share information; information has to be shared among all of Caesars’s thirty-nine casinos. Thus, Caesars relies on an integrated IT system that allows real-time communication among all its properties. Installing the system (in the mid-1990s) was complicated, and not everyone in the organization liked the idea. Some managers felt that information sharing threatened their independence. Others, including some in the IT group, doubted that a large number of separate IT systems could be adequately integrated. To get everyone on board, John Bushy, then senior VP of information technology, pledged that he wouldn’t cut his hair until the system was up and running. By the time it was operational in 1997, Bushy had hair down to his shoulders, but it was worth it: Caesars’s ability to share real-time information across all its properties has been a major factor in the company’s success. Caesars’s new system cut costs by $20 million a year, increased brand recognition, and increased the number of customers playing at more than one Caesars property by 72 percent.Meridith LeVinson, “Jackpot! Harrah’s Big Payoff Came from Using IT to Manage Customer Information,” CIO Magazine, February 1, 2001, http://www.cio.com/archive/020101/harrah.html (accessed June 2, 2006); “Harrah’s Entertainment Inc.: Real-Time CRM in a Service Supply Chain,” Global Supply Chain Management Forum, Stanford Graduate School of Business, http://www.gsb.stanford.edu/scforum/login/pdfs/Harrah.pdf (accessed November 14, 2011).

Enterprise Systems

Many large and mid-size companies rely on a highly integrated system called an enterprise resource planning (ERP) systemIntegrated computer system used to channel information to multiple users. to channel information to multiple users. To understand what an ERP system does, forget about the P for planning (it really doesn’t have much to do with planning) and the R for resource (it’s an imprecise term). Focus on the E for enterprise.Christopher Koch, “The ABCs of ERP,” CIO.com, http://wikifab.dimf.etsii.upm.es/wikifab/images/d/da/The_ABCs_of_ERP.pdf (accessed November 14, 2011). An ERP system integrates the computer needs of all activities across the enterprise into a single system that serves all users. Such broad integration isn’t a simple task, and you wouldn’t be the first person to wonder whether it wouldn’t be easier to give each department its own computer system. Salespeople, for example, need a system that tracks sales and generates sales reports. Meanwhile, manufacturing personnel don’t need to track sales but do need to track inventory. What’s the problem with stand-alone computer systems? Quite simply, users in various departments can’t share information or communicate with each other.

What If You Don’t Have ERP?

Imagine that you’re a sales manager for a fairly large manufacturing company that produces and sells treadmills. Like every other department in the organization, you have your own computer system. A local sporting-goods store orders one hundred treadmills through a regional sales representative. It’s your job to process the order. It wouldn’t be much of a problem for you to go into your computer and place the order. But how would you know if the treadmills were actually in stock and when they could be delivered? How would you know if the customer’s credit was any good? You could call the warehouse and ask if the treadmills are in stock. If they are, you’d tell the warehouse manager that you’re placing an order and hope that the treadmills are still in stock by the time your order gets there two days later. While you’re at it, you’d better ask for an expected delivery date. As a final precaution, you should probably call the finance department and ask about your customer’s credit rating. So now you’ve done your job, and it can hardly be your fault that because the cost of manufacturing treadmills has gone up, accounting has recommended an immediate price increase that hasn’t shown up in your computer system yet.

What If You Do Have ERP?

Wouldn’t it be easier if you had an ERP system like the one illustrated in Figure 15.2 "ERP System"—one that lets you access the same information as every other department? Then you could find out if there were one hundred treadmills in stock, the expected delivery date, your customer’s credit rating, and the current selling price—without spending most of the day exchanging phone calls, e-mails, text messages, and faxes. You’d be in a better position to decide whether you can give your customer credit, and you could promise delivery (at a correct price) on a specified date. Then, you’d enter the order into the system. The information that you entered would be immediately available to everyone else. The warehouse would know what needs to be shipped, to whom, and when. The accounting department would know that a sale had been made, the dollar amount, and where to send the bill. In short, everyone would have up-to-date information, and no one would have to reinput any data.

Figure 15.2 ERP System

Warehousing and Mining Data

What if Caesars wants to target customers who generate a lot of revenue, by using a program designed to entice return visits? How would it identify and contact these people? Theoretically, it could search through the relevant databases—those that hold customer-contact information (such as name and address) and information about customer activity in the company’s hotels, casinos, and entertainment venues. It would be a start, perhaps, but it wouldn’t be very efficient. First of all, it would be time-consuming. Plus, what if the same data weren’t stored in a similar fashion in each database? In that case, it would be quite hard to combine the data in a meaningful way. To address this problem, Caesars managers will rely on a system like the one illustrated in Figure 15.3 "The Data Mining Process", which calls for moving all the relevant data into a data warehouseCentralized database that stores data from several databases so they can be easily analyzed.—a centralized database in which data from several databases are consolidated and organized so that they can be easily analyzed.

Figure 15.3 The Data Mining Process

Data Mining

With the data in one central location, management can find out everything it needs to about a particular group of customers. It can also use the data to address some pretty interesting questions. Why do people come to our casinos? How can we keep customers coming back? How can we increase the number of visits per customer? How can we increase the amount they spend on each visit? What incentives (such as free dinners, hotel rooms, or show tickets) do our customers like most? To come up with answers to these questions, they’ll perform a technique called data miningTechnique used to search and analyze data to reveal patterns and trends that can be used to predict future behavior.—the process of searching and analyzing large amounts of data to reveal patterns and trends that can be used to predict future behavior.

Data Mining and Customer Behavior

By data-mining its customer-based data warehouse, Caesars’s management can discover previously unknown relationships between the general behavior of its customers and that of a certain group of customers (namely, the most profitable ones). Then, it can design incentives to appeal specifically to those people who will generate the most profit for the company.

To get a better idea of how data mining works, let’s simplify a description of the process at Caesars. First, we need to know how the casino gathered the data to conduct its preliminary analysis. Most customers who play the slots use a Caesars player’s card that offers incentives based on the amount of money that they wager on slot machines, video poker, and table games.Caesars, “Total Rewards,” https://www.totalrewards.com/TotalRewards/RewardsAndBenefits.do?page=overview (accessed November 14, 2011). To get the card, a customer must supply some personal information, such as name, address, and phone number. From Caesars’s standpoint, the card is extremely valuable because it can reveal a lot about the user’s betting behavior: actual wins and losses, length of time played, preferred machines and coin denominations, average amount per bet, and—most important—the speed with which coins are deposited and buttons pushed.Robert L. Shook, Jackpot! Harrah’s Winning Secrets for Customer Loyalty (Hoboken, NJ: John Wiley & Sons, 2003), 228–29. As you can see from Figure 15.3 "The Data Mining Process", Caesars’s primary data source was internal—generated by the company itself rather than provided by an outside source—and drew on a marketing database developed for customer relationship management (CRM).

Figure 15.4

Caesars collects data on its customers by using players’ cards to gather information and to track betting behavior.

© 2010 Jupiterimages Corporation

What does the casino do with the data that it’s mined? Caesars was most interested in “first trippers”—first-time casino customers. In particular, it wanted to know which of these customers should be enticed to return. By analyzing the data collected from player’s-card applications and from customer’s actual play at the casino (even if for no more than an hour), Caesars could develop a profile of a profitable customer. Now, when a first-timer comes into any of its casinos and plays for a while, Caesars can instantly tell whether he or she fits the profitable-customer profile. To lure these people back for return visits, it makes generous offers of free or reduced-rate rooms, meals, entertainment, or free chips (the incentive of choice for Caesars’s preferred customers). These customers make up 26 percent of all Caesars’s customers and generate 82 percent of its revenues. Surprisingly, they’re not the wealthy high rollers to whom Caesars had been catering for years. Most of them are regular working people or retirees with available time and income and a fondness for slots. They generally stop at the casino on the way home from work or on a weekend night and don’t stay overnight. They enjoy the thrill of gambling, and you can recognize them because they’re the ones who can’t push the button or pump tokens in fast enough.Gary Loveman, “Diamonds in the Data Mine,” Harvard Business Review, May 2003, 3.

Transaction Processing Systems

Most of an organization’s daily activities are recorded and processed by its transaction processing systemInformation system used to record and process an organization’s daily activities or transactions., which receives input data and converts them into output—information—intended for various users. Input data are called transactionsFinancial and nonfinancial events that affect a business.—events that affect a business. A financial transaction is an economic event: it affects the firm’s assets, is reflected in its accounting statements, and is measured in monetary terms. Sales of goods to customers, purchases of inventory from suppliers, and salaries paid to employees are all financial transactions. Everything else is a nonfinancial transaction. The marketing department, for example, might add some demographic data to its customer database. The information would be processed by the firm’s transaction processing system, but it wouldn’t be a financial transaction.

Figure 15.5 "Transaction Processing System" illustrates a transaction processing system in which the transaction is a customer’s electronic payment of a bill. As you can see, transaction processing system output can consist not only of documents sent to outside parties (in this case, notification of payment received), but also of information circulated internally (in the form of reports), as well as of information entered into the database for updating.

Figure 15.5 Transaction Processing System

Process Control Systems

Process controlApplication of technology to monitor and control physical processes. refers to the application of technology to monitor and control physical processes. It’s useful, for example, in testing the temperature of food as it’s being prepared or gauging the moisture content of paper as it’s being manufactured. Typically, it depends on sensors to collect data periodically. The data are then analyzed by a computer programmed either to make adjustments or to signal an operator.

Caesars uses process-control technology to keep customers happy. At any given point, some slot machines are down, whether because a machine broke or ran out of money or somebody hit the jackpot. All these contingencies require immediate attention by a service attendant. In the past, service personnel strolled around looking for machines in need of fixing. Now, however, a downed slot machine sends out an “I need attention” signal, which is instantly picked up by a monitoring and paging system called MessengerPlus and sent to a service attendant.

Design and Production Systems

As we saw in Chapter 11 "Operations Management in Manufacturing and Service Industries", modern companies rely heavily on technology to design and make products. Computer-aided design (CAD)System using computer technology to create models representing the design of a product. software, for instance, enables designers to test computer models digitally before moving new products into the prototype stage. Many companies link CAD systems to the manufacturing process through computer-aided manufacturing (CAM)System using computer technology to control production processes and equipment. systems that not only determine the steps needed to produce components but also instruct machines to do the necessary work. A CAD/CAM system can be expanded by means of computer-integrated manufacturing (CIM)System in which the capabilities of a CAD/CAM system are integrated with other computer-based functions., which integrates various operations (from design through manufacturing) with functional activities ranging from order taking to final shipment. The CIM system may also control industrial robots—computer-run machines that can perform repetitive or dangerous tasks. A CIM system is a common element in a flexible manufacturing systemSystem in which computer-controlled equipment is programmed to handle materials used in manufacturing., which makes it possible to change equipment setups by reprogramming computer-controlled machines that can be adapted to produce a variety of goods. Such flexibility is particularly valuable to makers of customized products.

Management Information Systems

A management information systemSystem used to extract data from a database and compile reports that help managers make routine decisions. extracts data from a database to compile reports, such as sales analyses, inventory-level reports, and financial statements, to help managers make routine decisions. The type and form of the report depend on the information needs of a particular manager. At Caesars, for example, several reports are available each day to a games manager (who’s responsible for table-game operations and personnel): a customer-analysis report, a profitability report, and a labor-analysis report.Robert L. Shook, Jackpot! Harrah’s Winning Secrets for Customer Loyalty (Hoboken, NJ: John Wiley & Sons, 2003), 248–52.

Decision Support Systems

A decision support systemInteractive system that extracts, integrates, and displays data from multiple sources to help managers make nonroutine decisions. is an interactive system that collects, displays, and integrates data from multiple sources to help managers make nonroutine decisions. For example, suppose that a gaming company is considering a new casino in Pennsylvania (which has recently legalized slot machines). To decide whether it would be a wise business move, management could use a decision support system like the one illustrated in Figure 15.6 "Decision Support System". The first step is to extract data from internal sources to decide whether the company has the financial strength to expand its operations. From external sources (such as industry data and Pennsylvania demographics), managers might find the data needed to determine whether there’s sufficient demand for a casino in the state. The decision support system will apply both types of data as variables in a quantitative model that managers can analyze and interpret. People must make the final decision, but in making sense of the relevant data, the decision support system makes the decision-making process easier—and more reliable.“Decision Support System,” Webopedia, http://www.webopedia.com/TERM/D/decision_support_system.html (accessed November 14, 2011).

Figure 15.6 Decision Support System

Executive Information Systems

As we observed in Chapter 6 "Managing for Business Success", senior managers spend a good deal of their time planning and making major decisions. They set performance targets, determine whether they’re being met, and routinely scan the external environment for opportunities and threats. To accomplish these tasks, they need relevant, timely, easily understood information. Often, they can get it through an executive information systemSystem that provides senior managers with strategic information customized to meet their needs and presented in a convenient format., which provides ready access to strategic information that’s customized to their needs and presented in a convenient format. Using an executive information system, for example, a gaming-company executive might simply touch a screen to view key summary information that highlights in graphical form a critical area of corporate performance, such as revenue trends. After scanning this summary, our executive can “drill down” to retrieve more detailed information—for example, revenue trends by resort or revenue trends from various types of activities, such as gaming, hotel, retail, restaurant, or entertainment operations.

Artificial Intelligence

Artificial intelligenceScience of developing computer systems that can mimic human behavior. is the science of developing computer systems that can mimic human behavior. Ever since the term was coined in 1956, artificial intelligence has always seemed on the verge of being “the next big thing.” Unfortunately, optimistic predictions eventually collided with underwhelming results, and many experts began to doubt that it would ever have profitable applications.“Artificial Intelligence,” Webopedia, http://www.webopedia.com/TERM/A/artificial_intelligence.html (accessed November 14, 2011). In the last decade, however, some significant advances have been made in artificial intelligence—albeit in the area of game playing, where activities are generally governed by small sets of well-defined rules. But even the game-playing environment is sometimes complex enough to promote interesting developments. In 1997, for example, IBM’s Deep Blue—a specialized computer with an advanced chess-playing program—defeated the world’s highest-ranked player.“Artificial Intelligence,” Webopedia, http://www.webopedia.com/TERM/A/artificial_intelligence.html (accessed November 14, 2011).

More recently, several artificial intelligence applications have been successfully put to commercial use. Let’s take a brief look at two of these: expert systems and face-recognition technology.

Expert Systems

Expert systemsProgram that mimics the judgment of experts. are programs that mimic the judgment of experts by following sets of rules that experts would follow. They’re useful in such diverse areas as medical diagnosis, portfolio management, and credit assessment. For example, you’ve called the customer-service department of your credit-card company because you want to increase your credit line. Don’t expect to talk to some financial expert who’s authorized to say yes or no. You’ll be talking to a service representative with no financial expertise whatsoever. He or she will, however, have access to an expert system, which will give you an answer in a few seconds. How does it work? The expert system will prompt the representative to ask you certain questions about your salary and living expenses. It will also check internal corporate data to analyze your purchases and payment behavior, and, based on the results, it will determine whether you get an increase and, if so, how much.

At Caesars, an expert system called the Revenue Management System helps to optimize the overall profitability of both hotel and casino operations. When a customer requests a room, the program accesses his or her profile in the database and consults certain “rules” for assessing the application.John Goff, “Head Games: Businesses Deploying Analytical Software to Get a Better Fix on Customer Behavior,” CFO Magazine for Senior Financial Executives 20:9, July 1, 2004, http://www.cfo.com/article.cfm/3014815 (accessed November 14, 2011). One rule, for example, might be, “If the customer has wagered more than $100,000 in the past year, add 10 points.” Eventually, the system decides whether your application will be accepted (and at what rate) by adding up points determined by the rules. While a tightwad may not get a room even when there are vacancies, a high roller may get a good rate on a luxury suite even if the hotel is nearly full.

Face-Recognition Technology

Caesars uses another particularly interesting, and sophisticated, application of artificial intelligence. In the hotel-casino business, it’s crucial to identify and turn away undesirable visitors. One tool for this task is a digital camera-surveillance system that uses face-recognition technology. Using this technology, a program classifies a person’s face according to the presence/absence or extent of certain unique features, such as dimpled chins, receding jaws, overbites, and long or short noses. If there’s a match on, for example, fifteen features between a person being scanned and someone in the company database, a staff member decides whether the two people are the same. If a security manager then concludes that the face belongs to a skilled card-counter, the customer will be discouraged from playing blackjack; if it belongs to a known cheater, the individual will be escorted out of the casino. The system, however, does more than spot undesirables. It can also identify high rollers and send information about customers to managers on the floor. That’s why a Caesars manager can greet a preferred customer at the door with his favorite drink and a personalized greeting, such as “Hi, Bill! How’s Karen? Did you ever get that vintage Corvette? Here, have a gin rickey on the house.”See Daintry Duffy, “Technology’s Winning Hand,” CSO.online, October 1, 2003, http://www.csoonline.com/article/218574/catching-casino-cheats-technology-s-winning-hand (accessed November 14, 2011); Larry Barrett Gallagher and Sean Gallagher, “NORA and ANNA: Non-Obvious Relationship Awareness,” Baseline, April 4, 2004, http://www.baselinemag.com/c/a/Past-News/NORA-and-ANNA/ (accessed November 14, 2011).

Business Applications

Think about the functional areas of business you’ve explored in this text: accounting, finance, human resources, management, marketing, operations, and product design. Now imagine you’re Katrina Lane, senior vice president and chief technology officer for Caesars Entertainment, who is responsible for the information technology needed to handle multiple tasks in all these functional areas. You’re sitting at your desk when Gary Loveman, chief executive officer of Caesars, walks in and gives you the news. Caesars just purchased the Planet Hollywood Casino and Resort in Las Vegas and will open up two new casinos in Ohio in 2012. This is good news for the company, but it means a lot of work for you and your staff.

You wonder whether this might be the time to outsource some of your computing tasks to a technology firm specializing in cloud computing. You remember an example that really makes sense:Paul Gil, “What Is Cloud Computing?,” About.com, http://netforbeginners.about.com/od/c/f/cloudcomputing.htm (accessed November 15, 2011). Right now, whenever Microsoft comes out with a new version of Word, Caesars has to pay $350 per PC for the latest version. Wouldn’t it make more sense to rent the use of the Microsoft Word program from a cloud vendor for say $5 a month (or $60 a year)? Given that the average time between new releases of Word is two years, your total cost per PC would be $120 (2 × $60)—a savings of about $230 per PC ($350 − $120). Your employees wouldn’t mind; instead of working offline, they would just login to the Internet and work with their online version using the files that were saved for them. And the members of your IT staff would be pleased that they wouldn’t need to install the new version of Word on all your PCs.

The As-A-Service Group

Companies can contract for various cloud computing services. The Microsoft Word example discussed previously is classified as software as a service (SaaS)The software as a service category of cloud computing gives companies access to a large assortment of software packages without having to invest in hardware or install and maintain software on its own computers.. This type of service gives companies access to a large assortment of software packages without having to invest in hardware or install and maintain software on its own computers. The available software, which includes e-mail and collaboration systems and customer relationship management programs, can be customized and used by an individual client or shared among several clients. A second type of service is called infrastructure as a service (IaaS)A technology firm offering infrastructure as a service provides users with hardware, including servers, central processing units, network equipment, and disk space.. Instead of providing users with software, a technology firm offering infrastructure as a service provides hardware, including servers, central processing units, network equipment, and disk space.“Software as a Service/ Infrastructure as a Service,” Thrive Networks, March 2009, http://www.thrivenetworks.com/resources/march-2009-software-as-a-service.html (accessed November 15, 2001). The most successful IaaS provider is Amazon Web Services.“Infrastructure as a Service,” Best Price Computers, http://www.bestpricecomputers.co.uk/glossary/infrastructure-as-a-service.htm (accessed November 15, 2011). The company rents computer power and storage to users who access their data via the Internet. The last as-a-service model is called platform as a service (PaaS)Those offering the platform as a service category of cloud computing provide services that enable users to develop customized web applications.. Those offering platform as a service provide services that enable users to develop customized web applications. Because they don’t have to start from scratch but rather build on existing platforms made available by the service provider, the web applications can be developed quickly.

Advantages and Disadvantages of Cloud Computing

In making your final decision (as the pretend chief technology officer for Caesars) you should consider these advantages and disadvantages of cloud computing:

Go or No Go?

So, pretend chief technology officer for Caesars, what’s your decision: will you get on the cloud or stay on the ground? If you are curious about what the real chief technology officer did, she took the high road and transferred a number of applications to Salesforce.com’s Web-based Force.com’s cloud applications service.“Caesars Entertainment Hits the Efficiency Jackpot with Force.com,” Salesforce.com, http://www.salesforce.com/showcase/stories/caesars.jsp (accessed November 16, 2011).

The Technology of the Web

Figure 15.8 Google

Let’s look a little more closely at some of the technologies that enable us to transmit and receive data over the Web. Documents on the Web are called Web pages, and they’re stored on Web sites. Each site is maintained by a Webmaster and opens with a home page. Each Web page is accessed through a unique address called a uniform resource locator (URL). For example, if you want to find statistics on basketball star LeBron James, you could type in the URL address http://www.nba.com/home/playerfile/lebron_james. The prefix http:// is the protocol name, http://www.nba.com the domain name, playerfile the subdirectory name, and lebron_james the document name (or Web page). A computer that retrieves Web pages is called a Web serverComputer that retrieves Web pages.. A search engineSoftware program that scans Web pages for specified kewords and provides a list of documents containing them. is a software program that scans Web pages containing specified keywords and provides a list of documents containing them. The most popular search engine is Google; others include Bing, Yahoo!, Ask, and AOL.

Why Business Uses the Internet

Businesses use the Internet for four purposes: presenting information, selling products, distributing digital products, and acquiring goods and services.

Acquiring Goods and Services

E-purchasing (which was introduced in Chapter 11 "Operations Management in Manufacturing and Service Industries") saves time, speeds up delivery, reduces administrative costs, and fosters better communications between a firm and its suppliers. Most importantly, it cuts the costs of purchased products because it’s now feasible for buyers to request competitive bids and do comparative shopping. Many companies now use a technology called electronic data interchangeComputerized exchange of business transaction documents. to process transactions and transmit purchasing documents directly from one IS to another. Figure 15.10 "Electronic Data Interchange System and Value-Added Networks" shows an electronic data interchange system at a company that subscribes to a value-added network—a private system supplied by a third-party firm—over which it conducts a variety of transactions.

Figure 15.10 Electronic Data Interchange System and Value-Added Networks

The Virtual Company

Imagine a company that retails products for schoolteachers over the Internet—for example, books, software, and teaching supplies purchased from various manufacturers and distributors. It would need facilities to store inventories and personnel to handle inventories and fill customer orders. But what if this company decided to get out of the traditional retail business? What if it decided instead to team up with three trading partners—a book publisher, a software developer, and a manufacturer of office supplies? Our original company could re-create itself as a Web site for marketing the books, software, and supplies provided by its partners, without taking physical possession of them. It would become a virtual companyCompany without a significant physical presence that relies on third parties to produce, warehouse, price, and deliver the products it sells over the Internet.. Its partners would warehouse their own products and furnish product descriptions, prices, and delivery times. Meanwhile, the virtual company, besides promoting all three lines of products, would verify customer orders and forward them to its partners, who would ship their own products directly to customers. All four partners would be better off, because they’d be competing in a business in which none of them could compete by itself. This business approach has allowed Spun.com, a CD, DVD, and game Internet retailer, to avoid carrying the $8 million inventory that it would have needed to support its sales. Rather than hold its own inventory, Spun.com merely passes the orders on to Alliance Entertainment (a home entertainment products wholesale distributor), which ships them directly to customers.“Can E-Tailers Find Fulfillment with Drop Shipping?” Research at Penn, http://www.upenn.edu/researchatpenn/article.php?21&bus (accessed November 14, 2011).

Malicious Programs

Some people get a kick out of wreaking havoc with computer systems by spreading a variety of destructive programs. Once they’re discovered, they can be combated with antivirus programs that are installed on most computers and that can be updated daily. In the meantime, unfortunately, they can do a lot of damage, bringing down computers or entire networks by corrupting operating systems or databases.

Spoofing

It’s also possible for unauthorized parties to gain access to restricted company Web sites—usually for the purpose of doing something illegal. Using a technique called “spoofing,” culprits disguise their identities by modifying the address of the computer from which the scheme has been launched. Typically, the point is to make it look as if an incoming message has originated from an authorized source. Then, once the site’s been accessed, the perpetrator can commit fraud, spy, or destroy data. You could, for example, spoof a manufacturing firm with a false sales order that seems to have come from a legitimate customer. If the spoof goes undetected, the manufacturer will incur the costs of producing and delivering products that were never ordered (and will certainly never be paid for).

Every day, technically savvy thieves (and dishonest employees) steal large sums of money from companies by means of spoofing or some other computer scheme. It’s difficult to estimate the dollar amount because many companies don’t even know how much they’ve lost.

Denial of Service

A denial-of-service attack does exactly what the term suggests: it prevents a Web server from servicing authorized users. Consider the following scenario. Dozens of computers are whirring away at an online bookmaker in the offshore gambling haven of Costa Rica. Suddenly a mass of blank incoming messages floods the company’s computers, slowing operations to a trickle. No legitimate customers can get through to place their bets. A few hours later, the owner gets an e-mail that reads, “If you want your computers to stay up and running through the football season, wire $40,000 to each of 10 numbered bank accounts in Eastern Europe.”

You’re probably thinking that our choice of online gambling as an example of this scheme is a little odd, but we chose it because it’s real: many companies in the online-gambling industry suffer hundreds of such attacks each year.Stephen Baker and Brian Grow, “Gambling Sites, This Is a Holdup,” BusinessWeek Online, August 9, 2004, http://www.businessweek.com/magazine/content/04_32/b3895106_mz063.htm (accessed November 14, 2011). Because most gambling operations opt to pay the ransom and get back to business as usual, denial of service to businesses in the industry has become a very lucrative enterprise.

Online gambling operations are good targets because they’re illegal in the United States, where they can’t get any help from law-enforcement authorities. But extortionists have been known to hit other targets, including Microsoft and the Recording Industry Association of America. The problem could become much more serious if they start going after e-commerce companies and others that depend on incoming orders to stay afloat.

Piracy

Technology makes it easier to create and sell intellectual property, but it also makes it easier to steal it. Because digital products can be downloaded and copied almost instantly over the Internet, it’s a simple task to make perfect replicas of your favorite copyright-protected songs, movies, TV shows, and computer software, whether for personal use or further distribution. When you steal such materials, you’re cheating the countless musicians, technicians, actors, programmers, and others involved in creating and selling them. Theft cuts into sales and shrinks corporate profits, often by staggering amounts. Entertainment-industry analysts estimate that $30 billion worth of songs were illegally downloaded in the five year period ending in 2009.“For Students Doing Reports,” Recording Industry Association of America, http://www.riaa.com/faq.php (accessed November 14, 2011). The software industry estimates that the global market for pirated software reached $59 billion in 2010.Zach Epstein, “Global Market for Pirated Software Reaches $59 billion,” BGR Innovation, http://www.bgr.com/2011/05/12/global-market-for-pirated-software-reaches-59-billion/ (accessed November 14, 2011).

So, what’s being done to protect the victimized companies? Actually, quite a lot, even though it’s a daunting task, both in the United States and abroad.“Can’t Stop Piracy,” AudioMicro, May 20, 2010, http://www.audiomicro.com/royalty-free-music-blog/2010/05/can%E2%80%99t-stop-piracy/ (accessed November 14, 2011). In 1998, Congress passed the Digital Millennium Copyright Act, which outlaws the copying of copyright-protected music (unless you’re copying legally acquired music for your own use). The penalties are fairly stiff: up to three years in prison and $250,000 in fines.“The Law,” Recording Industry Association of America, http://www.riaa.com/physicalpiracy.php?content_selector=piracy_online_the_law (accessed November 14, 2011); “Is Downloading Music Illegal?,” World Law Direct, http://www.worldlawdirect.com/article/1395/downloading-music-legal.html (accessed November 14, 2011). To show that it means business, the music industry is also hauling offenders into court, but legal action is costly and prosecuting teenage music lovers doesn’t accomplish much. Some observers believe that the best solution is for the industry to accelerate its own efforts to offer its products online.Heather Green, “Digital Media: Don’t Clamp Down Too Hard,” BusinessWeek Online, October 14, 2002, http://www.businessweek.com/magazine/content/02_41/b3803121.htm (accessed November 14, 2011). Initial attempts seem to be working: people who are willing to obey copyright laws have downloaded more than ten billion songs from the iTunes site alone.“Apple’s App Store Downloads Top 10 Billion,” Apple, http://www.apple.com/pr/library/2011/01/22Apples-App-Store-Downloads-Top-10-Billion.html (accessed November 14, 2011).

Credit-Card Theft

One of the more serious barriers to the growth of e-commerce is the perception of many people that credit-card numbers can be stolen when they’re given out over the Internet. Though virtually every company takes considerable precautions, they’re not entirely wrong. Cyber criminals, unfortunately, seem to be tirelessly creative. One popular scheme involves setting up a fraudulent Internet business operation to collect credit-card information. The bogus company will take orders to deliver goods—say, Mother’s Day flowers—but when the day arrives, it will have disappeared from cyberspace. No flowers will get delivered, but even worse, the perpetrator can sell or use all the collected credit-card information.

Password Theft

Many people also fear that Internet passwords—which can be valuable information to cyber criminals—are vulnerable to theft. Again, they’re not altogether wrong. There are schemes dedicated entirely to stealing passwords. In one, the cyber thief sets up a Web site that you can access only if you register, provide an e-mail address, and select a password. The cyber criminal is betting that the site will attract a certain percentage of people who use the same password for just about everything—ATM accounts, e-mail, employer networks. Having finagled a password, the thief can try accessing other accounts belonging to the victim. So, one day you have a nice cushion in your checking account, and the next you’re dead broke.

Invasion of Privacy

If you apply for a life-insurance policy online, you may be asked to supply information about your health. If you apply for a mortgage online, you may be asked questions about your personal finances. Some people shy away from Internet transactions because they’re afraid that such personal information can be stolen or shared with unauthorized parties. Once again, they’re right: it does happen.

How Do “Cookies” Work?

In addition to data that you supply willingly, information about you can be gathered online without your knowledge or consent.“Are Cookies Jeopardizing Your Online Privacy?,” Reputation.com, http://www.reputation.com/how_to/are-cookies-jeopardizing-your-online-privacy/ (accessed November 14, 2011). Your online activities, for example, can be captured by something called a cookie. The process is illustrated in Figure 15.11 "How Cookies Work". When you access a certain Web site, it sends back a unique piece of information to your browser, which proceeds to save it on your hard drive. When you go back to the same site, your browser returns the information, telling the site who you are and confirming that you’ve been there before. The problem is not that the cookie can identify you in the same way as a name or an address. It is, however, linked to other information about you—such as the goods you’ve bought or the services you’ve ordered online. Before long, someone will have compiled a profile of your buying habits. The result? You’ll soon be bombarded with advertisements targeted to your interests. For example, let’s suppose you check out the Web site for an online diet program. You furnish some information but decide that the program is not for you. The next time you log on, you may be greeted by a pop-up pushing the latest miracle diet.

Figure 15.11 How Cookies Work

Cookies aren’t the only form of online espionage. Your own computer, for example, monitors your Internet activities and keeps track of the URLs that you access.

Encryption

The most effective method of ensuring that sensitive computer-stored information can’t be accessed or altered by unauthorized parties is encryptionProcess of encoding data so that only individuals or computers armed with a secret code (or key) can decode it.—the process of encoding data so that only individuals (or computers) armed with a secret code (or key) can decode it. Here’s a simplified example: You want to send a note to a friend on the other side of the classroom, but you don’t want anyone else to know what it says. You and your friend could devise a code in which you substitute each letter in the message with the letter that’s two places before it in the alphabet. So you write A as C and B as D and so on. Your friend can decode the message, but it’ll look like nonsense to anyone else. This is an oversimplification of the process. In the real world, it’s much more complicated: data are scrambled using a complex code, the key for unlocking it is an algorithm, and you need certain computer hardware to perform the encryption/decryption process.