4 ms·

I don't see why an IT outsourcing company would not have the greatest incentive to take security and reliability extremely seriously. Is there anything worse f

I don't see why an IT outsourcing company would not have the greatest incentive to take security and reliability extremely seriously. Is there anything worse for an IT service provider than being blamed for a massive IT outage at a global corporation? This is headline news. And I don't see any difficult contractual issues at all. On the contrary. A massive outage, by definition, means that the contractual obligation is not being met.

sgt101 9y ago
Here is the list of things that are worse for an IT outsourcer. 1. Being more expensive than the other guy.
- fauigerzigerk 9y ago
  I doubt that anyone wants to compete solely on price. It's a margins game.
  - raesene9 9y ago
    have you been involved in many IT outsourcing agreements? Cost is always a major factor in procurement, and in IT where there can be a strong market for lemons, it's often the key factor. A company that's more expensive and can't clearly demonstrate in a bid scenario the positive impact of that increase in costs, will lose bids, a lot.
    - fauigerzigerk 9y ago
      Of course cost is a major factor. I never disputed that. I'm saying that competing on price alone is undesirable for IT outsourcing companies.
      - raesene9 9y ago
        But the problem is that factors like security and reliability are often invisible in outsourcing contracts, as it's very hard to specify things like security exactly in a bid contract, and very hard for customers to tell the difference between an organisation with higher security and one with poorer security practices. Everyone will say they take security seriously, but the cost of actually doing a good job on security is much higher than paying lipservice to it, so it doesn't really make commercial sense to do it well. In general in fact I'd say that a lot of IT outsourcing contracts tend to lead to a market for lemons. It's very hard for customer to assess the quality of a companies staff for example, so the company with the cheaper staff can afford a cheaper bid, which looks just as good as a company with more expensive staff...
        fauigerzigerk 9y ago
        Granted, security is difficult to specify. But availabilty isn't. Not on the scale we're seeing right now with BA.
      - sgt101 9y ago
        You are right, but they all do it because outsourcing is a signal that corporate management has lost faith in its ability to manage IT and now has but one method of judging value - price.
ivan_gammel 9y ago
If the possible negative consequences to company's image is the only incentive, they will rather try find an excuse, since they've fulfilled the requirements of the contract. Can be anything, from missing security requirements (under the assumption that their customer will take care about security himself) to incorrect use of provided software etc. And they'll probably be right, especially if they actually tried to sell the security. And they'll probably be able to defend their position in court and sue for defamation.
raesene9 9y ago
Security costs money, reliability costs money. If it's not in your contract, you don't pay for it. if there's any outage that is because the customer didn't ask you do do something that's their fault not yours. For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it? Would you patch all your systems immediately even if it caused availability issues if it wasn't explicitly outlined in the contract? would you explain to your shareholders that your profits were lower this year because you undertook activities not specified in your contracts because they were good for the security and reliability of the services you managed...? When outsourcing contracts are bid for there's a common experience of lower costs win. that inevitably leads to items that aren't strictly required being excluded.
- fauigerzigerk 9y ago
  >For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it? I would assume that the contract calls for particular service levels and that downing the entire fleet of a large carrier for days is in breach of that contract. If the contract says "provide service X with 99.999% availability" the service provider cannot come back and say, oh but you forgot to specify that we should run a redundant data center to guarantee that availability.
  - Clubber 9y ago
    >If the contract says "provide service X with 99.999% availability" If you read those contracts, you have to read what the consequences are for breaking that uptime guarantee. Usually it's something silly like 10% off your next bill.
- iamacynic 9y ago
  this is all correct and will not change until we reach a critical mass of devastating failures/breaches. until then, don't hold your breath. people learn their lessons the hard way.

sgt101 9y ago

Here is the list of things that are worse for an IT outsourcer. 1. Being more expensive than the other guy.

fauigerzigerk 9y ago
I doubt that anyone wants to compete solely on price. It's a margins game.
- raesene9 9y ago
  have you been involved in many IT outsourcing agreements? Cost is always a major factor in procurement, and in IT where there can be a strong market for lemons, it's often the key factor. A company that's more expensive and can't clearly demonstrate in a bid scenario the positive impact of that increase in costs, will lose bids, a lot.
  - fauigerzigerk 9y ago
    Of course cost is a major factor. I never disputed that. I'm saying that competing on price alone is undesirable for IT outsourcing companies.
    - raesene9 9y ago
      But the problem is that factors like security and reliability are often invisible in outsourcing contracts, as it's very hard to specify things like security exactly in a bid contract, and very hard for customers to tell the difference between an organisation with higher security and one with poorer security practices. Everyone will say they take security seriously, but the cost of actually doing a good job on security is much higher than paying lipservice to it, so it doesn't really make commercial sense to do it well. In general in fact I'd say that a lot of IT outsourcing contracts tend to lead to a market for lemons. It's very hard for customer to assess the quality of a companies staff for example, so the company with the cheaper staff can afford a cheaper bid, which looks just as good as a company with more expensive staff...
      - fauigerzigerk 9y ago
        Granted, security is difficult to specify. But availabilty isn't. Not on the scale we're seeing right now with BA.
    - sgt101 9y ago
      You are right, but they all do it because outsourcing is a signal that corporate management has lost faith in its ability to manage IT and now has but one method of judging value - price.

ivan_gammel 9y ago

If the possible negative consequences to company's image is the only incentive, they will rather try find an excuse, since they've fulfilled the requirements of the contract. Can be anything, from missing security requirements (under the assumption that their customer will take care about security himself) to incorrect use of provided software etc. And they'll probably be right, especially if they actually tried to sell the security. And they'll probably be able to defend their position in court and sue for defamation.

raesene9 9y ago

Security costs money, reliability costs money. If it's not in your contract, you don't pay for it. if there's any outage that is because the customer didn't ask you do do something that's their fault not yours. For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it? Would you patch all your systems immediately even if it caused availability issues if it wasn't explicitly outlined in the contract? would you explain to your shareholders that your profits were lower this year because you undertook activities not specified in your contracts because they were good for the security and reliability of the services you managed...? When outsourcing contracts are bid for there's a common experience of lower costs win. that inevitably leads to items that aren't strictly required being excluded.

fauigerzigerk 9y ago
>For example would you as an IT outsourcer pay for a redundant datacentre if your contract didn't call for it? I would assume that the contract calls for particular service levels and that downing the entire fleet of a large carrier for days is in breach of that contract. If the contract says "provide service X with 99.999% availability" the service provider cannot come back and say, oh but you forgot to specify that we should run a redundant data center to guarantee that availability.
- Clubber 9y ago
  >If the contract says "provide service X with 99.999% availability" If you read those contracts, you have to read what the consequences are for breaking that uptime guarantee. Usually it's something silly like 10% off your next bill.
iamacynic 9y ago
this is all correct and will not change until we reach a critical mass of devastating failures/breaches. until then, don't hold your breath. people learn their lessons the hard way.