Types of system maintenance in system analysis and design

CHAPTER 12 Managing Systems Support and Security

Chapter 12 describes systems support and security tasks that continue throughout the useful life of the system. In addition to user support, this chapter discusses maintenance, security, backup and disaster recovery, performance measurement, and system obsolescence.

· Explain the systems support and security phase

· Describe user support activities, including user training and service desks

· Define the four types of maintenance

· Explain various techniques for managing systems maintenance and support

· Describe techniques for measuring, managing, and planning system performance

· Explain risk management concepts

· Assess system security at six levels: physical security, network security, application security, file security, user security, and procedural security

· Describe backup and disaster recovery

· List factors indicating that a system has reached the end of its useful life

· Assess future challenges and opportunities for IT professionals

· Develop a strategic plan for career advancement and strong IT credentials

INTRODUCTION

OBJECTIVES

When you finish this chapter, you will be able to:

Managing systems support and security involves three main concerns: user expectations, system performance, and security requirements.

A systems analyst is like an internal consultant who provides guidance, support, and training. Successful systems often need the most support because users want to learn the features, try all the capabilities, and discover how the system can help them perform their tasks. In most organizations, more than half of all IT department effort goes into supporting existing systems.

This chapter begins with a discussion of systems support, including user training and service desks. You will study the four main types of maintenance: corrective, adaptive, perfective, and preventive. You also will learn how the IT group uses maintenance teams, configuration management, and maintenance releases, and you will examine system performance issues and maintenance tools. You will analyze the security system at each of the six security levels: physical security, network security, application security, file security, user security, and procedural security. You will also learn about data backup and recovery issues. Finally, you will learn how to recognize system obsolescence, and about some of the challenges and opportunities you are likely to face as an IT professional.

PREVIEW CASE: Mountain View College Bookstore

Background: Wendy Lee, manager of college services at Mountain View College, wants a new information system that will improve efficiency and customer service at the three college bookstores.

In this part of the case, Tina Allen (systems analyst) and David Conroe (student intern) are talking about operation, support, and security issues for the new system.

Participants:

Tina and David

Location:

Tina’s office, Friday afternoon, March 28, 2014

Project status:

Tina and David successfully implemented the bookstore information system. Now they will discuss strategies for supporting, maintaining, and securing the new system.

Discussion topics:

Support activities, training, maintenance, techniques for managing systems operation, enhancing system performance and security, and detecting system obsolescence

Tina:

Well, we finally made it The system is up and running and the users seem satisfied. Now we focus on supporting the system and ensuring that it delivers its full potential, and is properly secured and protected.

David:

How do we do that?

Tina:

First, we need to set up specific procedures for handling system support and maintenance. We’ll set up a service desk that will offer user training, answer technical questions, and enhance user productivity.

David:

Sounds good. I’ll set up a training package for new users who missed the initial training sessions.

Tina:

That’s fine. You also should learn about the four types of maintenance. Users typically ask for help that requires corrective maintenance to fix problems or adaptive maintenance to add new features. As IT staff, we will be responsible for perfective maintenance, which makes the system more efficient, and preventive maintenance to avoid problems.

David:

Anything else for us to do?

Tina:

Yes, we’ll need a system for managing maintenance requests from users. Also, we’ll need to handle configuration management, maintenance releases, and version control. These tools will help us keep the system current and reduce unnecessary maintenance costs.

David:

What about keeping tabs on system performance issues?

Tina:

That’s important, along with capacity planning to be sure the system can handle future growth.

David:

What about system security?

Tina:

Good question. We’ll look at physical security, network security, application security, file security, user security, and procedural security. We’ll also look at backup and disaster recovery issues.

David:

Sounds like we’ll be busy for quite a while.

Tina:

Well, that depends on the system itself and user expectations. Every system has a useful life, including this one. We’ll try to get a good return on our investment, but we’ll also watch for signs of obsolescence. Here are some tasks we can work on:

FIGURE 12-1 Typical systems support and security task list.

© Cengage Learning 2014

OVERVIEW

The systems support and security phase begins when a system becomes operational and continues until the system reaches the end of its useful life. Throughout the development process, the objective has been to create an information system that is efficient, easy to use, and affordable. After delivering the system, the IT team focuses on support and maintenance tasks.

The first part of this chapter covers four main topics. You will learn how to provide user support, maintain the system, manage the maintenance process, and handle system performance issues.

USER SUPPORT

Companies provide user support in many forms, including user training and a service desk to provide technical support and assistance.

User Training

In Chapter 11 , you learned about initial training that is performed when a new system is introduced. Additionally, new employees must be trained on the company’s information systems. For example, a firm that produces electronic assemblies must train its new employees, as shown in Figure 12-2 .

If significant changes take place in the existing system or if a new version is released, the IT department might develop a user training package . Depending on the nature of the changes, the package could include online support via e-mail, a special Web site, a revision to the user guide, a training manual supplement, or formal training sessions. Training users about system changes is similar to initial training. The main objective is to show users how the system can help them perform their jobs.

Service Desks

As systems and data structures become more complex, users need constant support and guidance. To make data more accessible and to empower users, many IT departments create service desks. A service desk , also called a help desk or information center (IC) , is a centralized resource staffed by IT professionals who provide users with the support they need to do their jobs. A service desk has three main objectives: (1) Show people how to use system resources more effectively, (2) provide answers to technical or operational questions, and (3) make users more productive by teaching them how to meet their own information needs. A service desk is the first place users turn when they need information or assistance.

A service desk does not replace traditional IT maintenance and support activities. Instead, service desks enhance productivity and improve utilization of a company’s information resources.

FIGURE 12-2 Whether a company is training manufacturing technicians, data entry personnel, or customer service representatives, employees need high-quality instruction to perform their jobs efficiently.

© iStockPhoto/fatihhoca

Service desk representatives need strong interpersonal and technical skills plus a solid understanding of the business because they interact with users in many departments. A service desk should document carefully all inquiries, support tasks, and activity levels. The information can identify trends and common problems and can help build a technical support knowledge base.

A service desk can boost its productivity by using remote control software , which allows IT staff to take over a user’s workstation and provide support and troubleshooting. Popular examples of remote control software include GoToMyPC by Citrix, LogMeln Pro by LogMeln, and PC Now by WebEx, among many others.

FIGURE 12-3 A service desk, also called a help desk or an information center, provides support to system users, so that users hopefully will not have the experience shown in the Dilbert© example on page 503.

© Shutterstock/Konstantin Chagin

During a typical day, the service desk staff members shown in Figure 12-3 might have to perform the following tasks:

· Show a user how to create a data query or report that displays specific business information

· Resolve network access or password problems

· Demonstrate an advanced feature of a system or a commercial package

· Help a user recover damaged data

· Offer tips for better operation

· Explain an undocumented software feature

· Show a user how to use Web conferencing

· Explain how to access the company’s intranet or the Internet

· Assist a user in developing a simple database to track time spent on various projects

· Answer questions about software licensing and upgrades

· Provide information about system specifications and the cost of new hardware or software

· Recommend a system solution that integrates data from different locations to solve a business problem

· Provide hardware support by installing or reconfiguring devices such as scanners, printers, network cards, wireless devices, optical drives, backup devices, and multimedia systems

· Show users how to maintain data consistency and integrity among a desktop computer, a notebook computer, and a handheld computer or smartphone

· Trouble shoot software issues via remote control utilities

In addition to functioning as a valuable link between IT staff and users, the service desk is a central contact point for all IT maintenance activities. The service desk is where users report system problems, ask for maintenance, or submit new systems requests. A service desk can utilize many types of automated support, just as outside vendors do, including e-mail responses, on-demand fax capability, an online knowledge base, frequently asked questions (FAQs), discussion groups, bulletin boards, and automated voice mail. Many vendors now provide a live chat feature for online visitors.

Outsourcing Issues

As you learned in Chapter 7 , many firms outsource various aspects of application development. This trend also includes outsourcing IT support and service desks. As with most business decisions, outsourcing has pros and cons. Typically, the main reason for outsourcing is cost reduction. Offshore call centers can trim expenses and free up valuable human resources for product development.

However, firms have learned that if tech support quality goes down, customers are likely to notice and might shop elsewhere. Critical factors might include phone wait times, support staff performance, and online support tools. The real question is whether a company can achieve the desired savings without endangering its reputation and customer base. Risks can be limited, but only if a firm takes an active role in managing and monitoring support quality and consistency.

MAINTENANCE TASKS

The systems support and security phase is an important component of TCO (total cost of ownership) because ongoing maintenance expenses can determine the economic life of a system.

TOOLKIT TIME

The Financial Analysis tools in Part C of the Systems Analyst’s Toolkit can help you analyze and manage maintenance costs, and determine when a system is reaching the end of its useful life. To learn more about these tools, turn to Part C of the four-part Toolkit that follows Chapter 12

Figure 12-4 shows a typical pattern of operational and maintenance expenses during the useful life of a system. Operational costs include items such as supplies, equipment rental, and software leases. Notice that the lower area shown in Figure 12-4 represents fixed operational expenses, while the upper area represents maintenance expenses.

Maintenance expenses vary significantly during the system’s operational life and include spending to support maintenance activities. Maintenance activities include changing programs, procedures, or documentation to ensure correct system performance; adapting the system to changing requirements; and making the system operate more efficiently. Those needs are met by corrective, adaptive, perfective, and preventive maintenance.

FIGURE 12-4 The total cost of operating an information system includes operational and maintenance costs. Operational costs (green) are relatively constant, while maintenance costs (purple) vary over time.

© Cengage Learning 2014

Although some overlap exists, four types of maintenance tasks can be identified, as shown by the examples in Figure 12-5 . Corrective maintenance is performed to fix errors, adaptive maintenance adds new capability and enhancements, perfective maintenance improves efficiency, and preventive maintenance reduces the possibility of future system failure. Some analysts use the term maintenance to describe only corrective maintenance that fixes problems. It is helpful, however, to view the maintenance concept more broadly and identify the different types of tasks.

FIGURE 12-5 Corrective maintenance fixes errors and problems. Adaptive maintenance provides enhancements to a system. Perfective maintenance improves a system’s efficiency, reliability, or maintainability. Preventive maintenance avoids future problems.

© Cengage Learning 2014

Maintenance expenses usually are high when a system is implemented because problems must be detected, investigated, and resolved by corrective maintenance. Once the system becomes stable, costs usually remain low and involve minor adaptive maintenance. Eventually, both adaptive and perfective maintenance activities increase in a dynamic business environment.

Near the end of a system’s useful life, adaptive and corrective maintenance expenses increase rapidly, but perfective maintenance typically decreases when it becomes clear that the company plans to replace the system. Figure 12-6 on the next page shows the typical patterns for each of the four classifications of maintenance activities over a system’s life span.

Corrective Maintenance

Corrective maintenance diagnoses and corrects errors in an operational system. To avoid introducing new problems, all maintenance work requires careful analysis before making changes. The best maintenance approach is a scaled-down version of the SDLC itself, where investigation, analysis, design, and testing are performed before implementing any solution. Recall that in Chapter 11 you learned about the difference between a test environment and an operational environment. Any maintenance work that could affect the system must be performed first in the test environment, and then migrated to the operational system.

FIGURE 12-6 Information systems maintenance depends on the type of maintenance and the age of the system.

© Cengage Learning 2014

IT support staff respond to errors in various ways, depending on the nature and severity of the problem. Most organizations have standard procedures for minor errors, such as an incorrect report title or an improper format for a data element. In a typical procedure, a user submits a systems request that is evaluated, prioritized, and scheduled by the system administrator or the systems review committee. If the request is approved, the maintenance team designs, tests, documents, and implements a solution.

As you learned in Chapter 2 , many organizations use a standard online form for systems requests. In smaller firms, the process might be an informal e-mail message. For more serious situations, such as incorrect report totals or inconsistent data, a user submits a systems request with supporting evidence. Those requests receive a high priority and a maintenance team begins work on the problem immediately.

The worst-case situation is a system failure. If an emergency occurs, the maintenance team bypasses the initial steps and tries to correct the problem immediately. This often requires a patch , which is a specially written software module that provides temporary repairs so operations can resume. Meanwhile, a written systems request is prepared by a user or a member of the IT department and added to the maintenance log. When the system is operational again, the maintenance team determines the cause, analyzes the problem, and designs a permanent solution. The IT response team updates the test data files, thoroughly tests the system, and prepares full documentation. Regardless of how the priorities are set, a standard ranking method can be helpful. For example, Figure 12-7 shows a three-level framework for IT support potential impact.

FIGURE 12-7 This three-level ranking framework for IT support considers potential impact and response urgency.

© Cengage Learning 2014

The process of managing system support is described in more detail starting on page 512, including an overview of maintenance tasks and a procedural flowchart, which is shown in Figure 12-10 on page 515.

Adaptive Maintenance

Adaptive maintenance adds enhancements to an operational system and makes the system easier to use. An enhancement is a new feature or capability. The need for adaptive maintenance usually arises from business environment changes such as new products or services, new manufacturing technology, or support for a new Web-based operation.

The procedure for minor adaptive maintenance is similar to routine corrective maintenance. A user submits a systems request that is evaluated and prioritized by the systems review committee. A maintenance team then analyzes, designs, tests, and implements the enhancement. Although the procedures for the two types of maintenance are alike, adaptive maintenance requires more IT department resources than minor corrective maintenance.

A major adaptive maintenance project is like a small-scale SDLC project because the development procedure is similar. Adaptive maintenance can be more difficult than new systems development because the enhancements must work within the constraints of an existing system.

Perfective Maintenance

Perfective maintenance involves changing an operational system to make it more efficient, reliable, or maintainable. Requests for corrective and adaptive maintenance normally come from users, while the IT department usually initiates perfective maintenance.

During system operation, changes in user activity or data patterns can cause a decline in efficiency, and perfective maintenance might be needed to restore performance. When users are concerned about performance, you should determine if a perfective maintenance project could improve response time and system efficiency.

Perfective maintenance also can improve system reliability. For example, input problems might cause a program to terminate abnormally. By modifying the data entry process, you can highlight errors and notify the users that they must enter proper data. When a system is easier to maintain, support is less costly and less risky. In many cases, you can simplify a complex program to improve maintainability.

In many organizations, perfective maintenance is not performed frequently enough. Companies with limited resources often consider new systems development, adaptive maintenance, and corrective maintenance more important than perfective maintenance. Managers and users constantly request new projects, so few resources are available for perfective maintenance work. As a practical matter, perfective maintenance can be performed as part of another project. For example, if a new function must be added to a program, you can include perfective maintenance in the adaptive maintenance project.

Perfective maintenance usually is cost effective during the middle of the system’s operational life. Early in systems operation, perfective maintenance usually is not needed. Later, perfective maintenance might be necessary, but have a high cost. Perfective maintenance is less important if the company plans to discontinue the system.

When performing perfective maintenance, analysts often use a technique called software reengineering. Software reengineering uses analytical techniques to identify potential quality and performance improvements in an information system. In that sense, software reengineering is similar to business process reengineering, which seeks to simplify operations, reduce costs, and improve quality — as you learned in Chapter 1 .

Programs that need a large number of maintenance changes usually are good candidates for reengineering. The more a program changes, the more likely it is to become inefficient and difficult to maintain. Detailed records of maintenance work can identify systems with a history of frequent corrective, adaptive, or perfective maintenance.

FIGURE 12-8 Regardless of the type of system, high-quality maintenance must be performed by trained professionals.

DoD photo by Airman Charlie Whetstine, U.S. Navy

Preventive Maintenance

To avoid problems, preventive maintenance requires analysis of areas where trouble is likely to occur. Like perfective maintenance, the IT department normally initiates preventive maintenance. Preventive maintenance often results in increased user satisfaction, decreased downtime, and reduced TCO. Preventive maintenance competes for IT resources along with other projects, and sometimes does not receive the high priority that it deserves.

Regardless of the type of maintenance, computer systems must be supported by trained professionals, just as the aircraft shown in Figure 12-8 must be serviced by skilled technicians. In both cases, the quality of the maintenance will directly affect the organization’s success.

CASE IN POINT 12.1: OUTBACK OUTSOURCING, INC.

You are a systems analyst at Outback Outsourcing, a firm that handles payroll processing for many large companies. Outback Outsourcing uses a combination of payroll package programs and in-house developed software to deliver custom-made payroll solutions for its clients. Lately, users have flooded you with requests for more new features and Web-based capability to meet customer expectations. Your boss, the IT manager, comes to you with a question. She wants to know when to stop trying to enhance the old software and develop a totally new version better suited to the new marketplace. How would you answer her?

MAINTENANCE MANAGEMENT

System maintenance requires effective management, quality assurance, and cost control. To achieve these goals, companies use various strategies, such as a maintenance team, a maintenance management program, a configuration management process, and a maintenance release procedure. In addition, firms use version control and baselines to track system releases and analyze the system’s life cycle. These concepts are described in the following sections.

The Maintenance Team

A maintenance team includes a system administrator and one or more systems analysts and programmers. The system administrator should have solid technical expertise, and experience in troubleshooting and configuring operating systems and hardware. Successful analysts need a strong IT background, solid analytical abilities, good communication skills, and an overall understanding of business operations.

SYSTEM ADMINISTRATOR A system administrator manages computer and network systems. À system administrator must work well under pressure, have good organizational and communication skills, and be able to understand and resolve complex issues in a limited time frame. In most organizations, a system administrator has primary responsibility for the operation, configuration, and security of one or more systems. The system administrator is responsible for routine maintenance, and usually is authorized to take preventive action to avoid an immediate emergency, such as a server crash, network outage, security incident, or hardware failure.

Systems administration is a vital function, and various professional associations, such as SAGE, which is shown in Figure 12-9 , offer a wide variety of technical information and support for system administrators. Notice that SAGE members subscribe to a code of ethics that includes professionalism, integrity, privacy, and social responsibility, among other topics.

SYSTEMS ANALYSTS Systems analysts assigned to a maintenance team are like skilled detectives who investigate and rapidly locate the source of a problem by using analysis and synthesis skills. Analysis means examining the whole in order to learn about the individual elements, while synthesis involves studying the parts to understand the overall system. In addition to strong technical skills, an analyst must have a solid grasp of business operations and functions. Analysts also need effective interpersonal and communications skills, and they must be creative, energetic, and eager for new knowledge.

FIGURE 12-9 SAGE seeks to establish standards of professional excellence, improve the technical skills of its members, and promote a comprehensive code of ethics.

© 2012 The USENIX Association

PROGRAMMERS In a small organization, a programmer might be expected to handle a wide variety of tasks, but in larger firms, programming work tends to be more specialized. For example, typical job titles include an applications programmer , who works on new systems development and maintenance; a systems programmer , who concentrates on operating system software and utilities; and a database programmer , who focuses on creating and supporting large-scale database systems. Many IT departments also use a job title of programmer/analyst to designate positions that require a combination of systems analysis and programming skills.

ORGANIZATIONAL ISSUES IT managers often divide systems analysts and programmers into two groups: One group performs new system development, and the other group handles maintenance. Some organizations use a more flexible approach and assign IT staff members to various projects as they occur. By integrating development and support work, the people developing the system assume responsibility for maintaining it. Because the team is familiar with the project, additional training or expense is unnecessary, and members are likely to have a sense of ownership from the onset.

Unfortunately, many analysts feel that maintenance is less interesting and creative than developing new systems. In addition, an analyst might find it challenging to trouble-shoot and support someone else’s work that might have been poorly documented and organized.

Some organizations that have separate maintenance and new systems groups rotate people from one assignment to the other. When analysts learn different skills, the organization is more versatile and people can shift to meet changing business needs. For instance, systems analysts working on maintenance projects learn why it is important to design easily maintainable systems. Similarly, analysts working on new systems get a better appreciation of the development process and the design compromises necessary to meet business objectives.

One disadvantage of rotation is that it increases overhead because time is lost when people move from one job to another. When systems analysts constantly shift between maintenance and new development, they have less opportunity to become highly skilled at any one job.

Newly hired and recently promoted IT staff members often are assigned to maintenance projects because their managers believe that the opportunity to study existing systems and documentation is a valuable experience. In addition, the mini-SDLC used in many adaptive maintenance projects is good training for the full-scale systems development life cycle. For a new systems analyst, however, maintenance work might be more difficult than systems development, and it might make sense to assign a new person to a development team where experienced analysts are available to provide training and guidance.