MGT230 v6Amazon.com Case Study AnalysisMGT230 v6Page 2 of .docx

MGT/230 v6
Amazon.com Case Study Analysis
MGT/230 v6
Page 2 of 2
Amazon.com Case Study AnalysisAmazon.com—Keeping the
Fire Hot
Amazon.com has gained the No. 1 spot as the world’s largest
Internet retailer. But, never content to rest on past laurels, CEO
Jeff Bezos keeps introducing and upgrading Amazon products
and services.
It’s hard to keep pace with new versions of the Amazon Kindle
Fire, Prime Instant Video TV, and movie content streamed on
demand. There’s a variety of cloud computer services. And,
Bezos keeps increasing investments in new distribution centers
staffed increasingly by robots. It’s all part of a push to make
Amazon the go-to choice for fast—even same-day—deliveries
of as many of the products we consume as possible.
Decision Making and Innovation
From its modest beginning in Jeff Bezos’s garage in 1995,
Amazon.com has grown into the megalithic online retailer.
Bezos continues to diversify Amazon’s product offerings and
broaden its brand. Beyond simply finding more and more
products and services to offer, he knows that he has to innovate
in order to prevent his brand from becoming stagnant. No one is
ever sure what will come next under Bezos’s guidance. His
guiding question is: “What kind of innovation can we layer on
top of this that will be meaningful for our customers?”
Amazon’s Kindle almost single handedly launched the ebook
revolution. Also, Amazon Prime could be seen as a revolution.
Prime members get free two-day shipping and discounted one-
day shipping as well as access to Amazon Instant Video, movie,
TV and music streaming, and free content. It’s all designed to

keep customers plugged into Amazon. Bezos calls Amazon
Prime “the best bargain in the history of shopping, and it’s
going to keep getting better.”
There’s no shortage of competition. Amazon has squared off
against Netflix, Apple, and Google in realms of both hardware
and digital entertainment. It bought top-shelf audio book vendor
Audible.com and later added shoe and clothing merchant
Zappos.com. Then came acquisition of Boston-based Kiva
Systems. Kiva’s automated guided robots deliver product to
workers at pick stations, allowing Amazon increased efficiency
(and reduced labor costs) in its worldwide distribution centers.
Bezos as a Decision Maker
Rather than sticking to just the analytical step-by-step process,
Bezos isn’t afraid of informed intuition. He uses creativity,
flexibility, and spontaneity when making key decisions. He
seems comfortable with abstraction and lack of structure when
making decisions and isn’t afraid to fail.
Seeming not to worry about current earnings per share, Bezos
keeps investing to make his company stronger and harder to
catch. Its millions of square feet of distribution fulfillment
space keep growing domestically and around the globe. The
firm’s products and services are continuously upgraded and
expanded. Drones are ready to fly Amazon deliveries to
customers. But will these investments pay off? Is Bezos making
the right long-term choices?
Even as Amazon’s stock values fluctuate, Bezos still believes
that customer service, not the stock ticker, defines the Amazon
experience. “I think one of the things people don’t understand is
we can build more shareholder value by lowering product prices
than we can by trying to raise margins,” he says. “It’s a more
patient approach, but we think it leads to a stronger, healthier
company. It also serves customers much, much better.”
What’s Next?
Amazon.com has quickly—not quietly—grown from a home

operation into a global ecommerce giant. By forging alliances to
ensure that he has what customers want and making astute
purchases, Bezos has made Amazon the go-to brand for online
shopping. After its significant investments in new media,
services, and distribution, does the company risk losing its
original appeal? Will customers continue to flock to Amazon,
making it the go-to company for their each and every need?
Source: Schermerhorn Jr., J.R., Bachrach, D.G. (2016)
Amazon.com—Keeping the Fire Hot”. In Exploring
Management (Cases for Critical Thinking).Case Analysis
Questions
Answer the following in up to 350 words each.
1. Bezos once said, “Amazon may break even or even lose
money on the sale of its devices.” The company expects to
recoup the money later through the sale of products, with a
further boost from its annual Prime membership fee.
Explain how this strategy shows Bezos as a systematic and
intuitive thinker.
Click here to enter text.
2. It seems like everyone is streaming these days and there are a
growing number of providers. Amazon is a player in the digital
entertainment market, but hasn’t taken a clear lead.
Determine, based on the strengths of the company, what
decisions should be made to ensure that Amazon jumps ahead
and becomes the “No. 1” source for digital content streams.
3. Compare the latest initiatives coming out of Amazon with
those of the actual or potential competition.
4. Conclude whether or not Bezos is making the right decisions
as he guides the firm through today’s many business and
management challenges.
Copyright 2019 by University of Phoenix. All rights reserved.
Copyright 2019 by University of Phoenix. All rights reserved.

Malware Forensics Field
Guide for Windows Systems
Digital Forensics Field Guides
Cameron H. Malin
Eoghan Casey
James M. Aquilina
Curtis W. Rose
Technical Editor
Acquiring Editor: Cris Katsaropoulos
Project Manager: Paul Gottehrer
Designer: Alisa Andreola
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
© 2012 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in
any form or by
any means, electronic or mechanical, including photocopying,
recording, or any
information storage and retrieval system, without permission in

writing from the
publisher. Details on how to seek permission, further
information about the
Publisher’s permissions policies and our arrangements with
organizations such as
the Copyright Clearance Center and the Copyright Licensing
Agency, can be
found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are
protected under
copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly
changing. As new
research and experience broaden our understanding, changes in
research methods
or professional practices, may become necessary. Practitioners
and researchers
must always rely on their own experience and knowledge in
evaluating and using
any information or methods described herein. In using such
information or
methods they should be mindful of their own safety and the
safety of others,
including parties for whom they have a professional
responsibility.
To the fullest extent of the law, neither the Publisher nor the
authors,
contributors, or editors, assume any liability for any injury
and/or damage to

contributors, or editors, assume any liability for any injury
and/or damage to
persons or property as a matter of products liability, negligence
or otherwise, or
from any use or operation of any methods, products,
instructions, or ideas
contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British
Library.
ISBN: 978-1-59749-472-4
For information on all Syngress publications visit our website at
http://store.elsevier.com
Printed in the United States of America
12 13 14 15 16 10 9 8 7 6 5 4 3 2 1
Typeset by: diacriTech, Chennai, India
For our moms, who taught us determination, patience,
creativity, and to live passionately.

Acknowledgments
Cameron would like to thank a number of people for their
guidance, support, and ideas on this book—without them it
would not have happened. James and Eoghan I appreciate your
willingness to keep an open mind and embrace the format and
structure of this book; it was a rewarding challenge. I’m proud
to
work with you both.
Thanks to the Syngress crew for your patience and
understanding of our vision: Steve Elliot, Angelina Ward, Laura
Colantoni, Matthew Cater, Paul Gottehrer, Chris
Katsaropoulos, and David Bevans.
Not to be forgotten are the some terrific researchers,
developers, and forensic practitioners who assisted and
supported this book: Mila Parkour
(contagiodump.blogspot.com), Ero Carera and Christian
Blichmann (Zynamics), Matthew Shannon (F-Response), Maria
Lucas (HBGary), Thorsten Holz (Assistant Professor at Ruhr-
University Bochum; http://honeyblog.org/), Tark (ccso.com),
and
Danny Quist (offensivecomputing.net).
For your friendship, camaraderie, and day-to-day hi-jinks,
For your friendship, camaraderie, and day-to-day hi-jinks,
“Team Cyber” of the Los Angeles Cyber Division—you are a
fantastic crew and I miss you. Jason, Ramyar, and Bryan—my
friends and confidants—thank you for everything, we had a
good
run.

My sister Alecia—your determination and focus are an
inspiration to me. “No lying on the couch!”
Finally, to my lovely wife Adrienne, I am so lucky to have
you in my life—thanks for being a “team” with me—I love you.
Bentley and Barkley—thanks for being Daddy’s little “writing
buddies.”
Special Thanks to the Technical
Editor
Malware Forensics Field Guide for Windows Systems was
reviewed by a digital forensic expert who is a fantastic author in
his own right. My sincerest thanks to Curtis W. Rose for your
tenacity and attention to detail—we’re lucky to work with you.
About the Authors
Cameron H. Malin is a Supervisory Special Agent with the
Federal Bureau of Investigation assigned to a Cyber Crime
squad in Los Angeles, California, where he is responsible for
the
investigation of computer intrusion and malicious code matters.
In 2010, Mr. Malin was a recipient of the Attorney General’s
Award for Distinguished Service for his role as a Case Agent in
Operation Phish Phry.
Mr. Malin is the Chapter Lead for the Southern California
Chapter of the Honeynet Project, an international non-profit

organization dedicated to improving the security of the Internet
through research, analysis, and information regarding computer
and network security threats. Mr. Malin currently sits on the
Editorial Board of the International Journal of Digital
Evidence (IJDE) and is a Subject Matter Expert for the
Information Assurance Technology Analysis Center (IATAC)
and Weapon Systems Technology and Information Analysis
Center (WSTIAC).
Mr. Malin is a Certified Ethical Hacker (C|EH) and
Certified Network Defense Architect (C|NDA) as designated by
Certified Network Defense Architect (C|NDA) as designated by
the International Council of Electronic Commerce Consultants
(EC-Council) and a Certified Information Systems Security
Professional (CISSP), as designated by the International
Information Systems Security Certification Consortium
((ISC)2®).
Prior to working for the FBI, Mr. Malin was an Assistant
State Attorney (ASA) and Special Assistant United States
Attorney (SAUSA) in Miami, Florida, where he specialized in
computer crime prosecutions. During his tenure as an ASA, Mr.
Malin was also an Assistant Professorial Lecturer in the
Computer Fraud Investigations Masters Program at George
Washington University.
The techniques, tools, methods, views, and opinions
explained by Cameron Malin are personal to him, and do not
represent those of the United States Department of Justice, the
Federal Bureau of Investigation, or the government of the
United
States of America. Neither the Federal government nor any
Federal agency endorses this book or its contents in any way.

Eoghan Casey is founding partner of cmdLabs, author of
the foundational book Digital Evidence and Computer Crime,
and coauthor of Malware Forensics: Investigating and
Analyzing Malicious Code. For over a decade he has
dedicated himself to advancing the practice of incident handling
and digital forensics. He helps client organizations handle
security
breaches and analyzes digital evidence in a wide range of
investigations, including network intrusions with international
scope. He works at the Department of Defense Cyber Crime
scope. He works at the Department of Defense Cyber Crime
Center (DC3) on research and tool development. He has
testified in civil and criminal cases, and has submitted expert
reports and prepared trial exhibits for computer forensic and
cyber-crime cases.
As a Director of Digital Forensics and Investigations at
Stroz Friedberg, he maintained an active docket of cases and
co-managed the firm’s technical operations in the areas of
computer forensics, cyber-crime response, incident handling,
and
electronic discovery. He also spearheaded Stroz Friedberg’s
external and in-house forensic training programs as Director of
Training. Mr. Casey has performed thousands of forensic
acquisitions and examinations, including Windows and UNIX
systems, Enterprise servers, smart phones, cell phones, network
logs, backup tapes, and database systems. He also has extensive
information security experience, as an Information Security
Officer at Yale University and in subsequent consulting work.
He
has performed vulnerability assessments; deployed and
maintained intrusion detection systems, firewalls, and public

key
infrastructures; and developed policies, procedures, and
educational programs for a variety of organizations.
Mr. Casey holds a B.S. in Mechanical Engineering from the
University of California at Berkeley, and an M.A. in
Educational
Communication and Technology from New York University. He
conducts research and teaches graduate students at Johns
Hopkins University Information Security Institute, and is
Editor-
in-Chief of Digital Investigation: The International Journal of
in-Chief of Digital Investigation: The International Journal of
Digital Forensics and Incident Response.
James M. Aquilina, Executive Managing Director and
Deputy General Counsel, contributes to the management of
Stroz Friedberg and the handling of its legal affairs, in addition
to
having overall responsibility for the Los Angeles, San
Francisco,
and Seattle offices. He supervises numerous digital forensic,
Internet investigative, and electronic discovery assignments for
government agencies, major law firms, and corporate
management and information systems departments in criminal,
civil, regulatory, and internal corporate matters, including
matters
involving data breach, e-forgery, wiping, mass deletion and
other
forms of spoliation, leaks of confidential information,
computer-
enabled theft of trade secrets, and illegal electronic
surveillance.

He has served as a neutral expert and has supervised the court-
appointed forensic examination of digital evidence. Mr.
Aquilina
also has led the development of the firm’s online fraud and
abuse
practice, regularly consulting on the technical and strategic
aspects of initiatives to protect computer networks from
spyware
and other invasive software, malware and malicious code,
online
fraud, and other forms of illicit Internet activity. His deep
knowledge of botnets, distributed denial of service attacks, and
other automated cyber-intrusions enables him to provide
companies with advice and solutions to tackle incidents of
computer fraud and abuse and bolster their infrastructure
protection.
Prior to joining Stroz Friedberg, Mr. Aquilina was an
Assistant U.S. Attorney (AUSA) in the Criminal Division of the
Assistant U.S. Attorney (AUSA) in the Criminal Division of the
U.S. Attorney’s Office for the Central District of California,
where he most recently served in the Cyber and Intellectual
Property Crimes Section. He also served as a member of the
Los Angeles Electronic Crimes Task Force, and as chair of the
Computer Intrusion Working Group, an inter-agency cyber-
crime response organization. As an AUSA, Mr. Aquilina
conducted and supervised investigations and prosecutions of
computer intrusions, extortionate denial of service attacks,
computer and Internet fraud, criminal copyright infringement,
theft of trade secrets, and other abuses involving the theft and
use of personal identity. Among his notable cyber cases, Mr.
Aquilina brought the first U.S. prosecution of malicious botnet
activity against a prolific member of the “botmaster

underground”
who sold his armies of infected computers for the purpose of
launching attacks and spamming and used his botnets to
generate
income from the surreptitious installation of adware; tried to
jury
conviction the first criminal copyright infringement case
involving
the use of digital camcording equipment; supervised the
government’s continuing prosecution of Operation Cyberslam,
an international intrusion investigation involving the use of
hired
hackers to launch computer attacks against online business
competitors; and oversaw the collection and analysis of
electronic evidence relating to the prosecution of a local
terrorist
cell operating in Los Angeles.
During his tenure at the U.S. Attorney’s Office, Mr.
Aquilina also served in the Major Frauds and
Terrorism/Organized Crime Sections, where he investigated and
Terrorism/Organized Crime Sections, where he investigated and
tried numerous complex cases, including a major corruption
trial
against an IRS Revenue Officer and public accountants, a fraud
prosecution against the French bank Credit Lyonnais in
connection with the rehabilitation and liquidation of the now
defunct insurer Executive Life, and an extortion and kidnapping
trial against an Armenian organized crime ring. In the wake of
the
September 11, 2001, attacks Mr. Aquilina helped establish and
run the Legal Section of the FBI’s Emergency Operations
Center.

Before public service, Mr. Aquilina was an associate at the
law firm Richards, Spears, Kibbe & Orbe in New York, where
he focused on white collar defense work in federal and state
criminal and regulatory matters.
He served as a law clerk to the Honorable Irma E.
Gonzalez, U.S. District Judge, Southern District of California.
He
received his B.A. magna cum laude from Georgetown
University, and his J.D. from the University of California,
Berkeley School of Law, where he was a Richard Erskine
Academic Fellow and served as an Articles Editor and
Executive
Committee Member of the California Law Review.
He currently serves as an Honorary Council Member on
cyber-law issues for the EC-Council, the organization that
provides the C|EH and CHFI (Certified Hacking Forensic
Investigator) certifications to leading security industry
professionals worldwide. Mr. Aquilina is a member of Working
Group 1 of the Sedona Conference, the International
Association of Privacy Professionals, the Southern California
Honeynet Project, the Los Angeles Criminal Justice Inn of
Court, and the Los Angeles County Bar Association. He also
serves on the Board of Directors of the Constitutional Rights
Foundation, a non-profit educational organization dedicated to
providing young people with access to and understanding of law
and the legal process.
Mr. Aquilina is co-author of Malware Forensics:
Investigating and Analyzing Malicious Code.

About the Technical Editor
Curtis W. Rose is the President and founder of Curtis W. Rose
& Associates LLC, a specialized services company in Columbia,
Maryland, which provides computer forensics, expert testimony,
litigation support, and computer intrusion response and training
to commercial and government clients. Mr. Rose is an industry-
recognized expert with over 20 years of experience in
investigations, computer forensics, and technical and
information
security.
Mr. Rose was a co-author of Real Digital Forensics:
Computer Security and Incident Response, and was a
contributing author or technical editor for many popular
information security books including Handbook of Digital
Forensics and Investigation; Malware Forensics:
Investigating and Analyzing Malicious Code; SQL Server
Forensic Analysis; Anti-Hacker Toolkit, 1st Edition; Network
Security: The Complete Reference; and Incident Response
and Computer Forensics, 2nd Edition. He has also published
whitepapers on advanced forensic methods and techniques
including “Windows Live Response Volatile Data Collection:
including “Windows Live Response Volatile Data Collection:
Non-Disruptive User and System Memory Forensic Acquisition”
and “Forensic Data Acquisition and Processing Utilizing the
Linux Operating System.”

Introduction to Malware
Forensics
Since the publication of Malware Forensics: Investigating and
Analyzing Malicious Code in 2008,1 the number and
complexity of programs developed for malicious and illegal
purposes has grown substantially. The 2011 Symantec Internet
Security Threat Report announced that over 286 million new
threats emerged in the past year.2 Other anti-virus vendors,
including F-Secure, forecast an increase in attacks against
mobile
devices and SCADA systems in 2011.3
In the past, malicious code has been categorized neatly
(e.g., viruses, worms, or Trojan horses) based upon
functionality
and attack vector. Today, malware is often modular and
multifaceted, more of a “blended-threat,” with diverse
functionality and means of propagation. Much of this malware
has been developed to support increasingly organized,
professional computer criminals. Indeed, criminals are making
extensive use of malware to control computers and steal
personal, confidential, or otherwise proprietary information for
personal, confidential, or otherwise proprietary information for
profit. In Operation Trident Breach,4 hundreds of individuals
were arrested for their involvement in digital theft using
malware
such as ZeuS. A thriving gray market ensures that today’s
malware is professionally developed to avoid detection by
current AntiVirus programs, thereby remaining valuable and

available to any cyber-savvy criminal group.
Of growing concern is the development of malware to
disrupt power plants and other critical infrastructure through
computers, referred to by some as Cyber Warfare. The StuxNet
malware that emerged in 2010 is a powerful demonstration of
the potential for such attacks.5 Stuxnet was a sophisticated
program that enabled the attackers to alter the operation of
industrial systems, like those in a nuclear reactor, by accessing
programmable logic controllers connected to the target
computers. This type of attack could shut down a power plant or
other components of a society’s critical infrastructure,
potentially
causing significant harm to people in a targeted region.
Foreign governments are funding teams of highly skilled
hackers to develop customized malware to support industrial
and
military espionage.6 The intrusion into Google’s systems
demonstrates the advanced and persistent capabilities of such
attackers.7 These types of well-organized attacks, known as the
“Advanced Persistent Threat (APT),” are designed to maintain
long-term access to an organization’s network in order to steal
information/gather intelligence and are most commonly
associated with espionage. The increasing use of malware to
associated with espionage. The increasing use of malware to
commit espionage and crimes and launch cyber attacks is
compelling more digital investigators to make use of malware
analysis techniques and tools that were previously the domain
of
anti-virus vendors and security researchers.
This Field Guide was developed to provide practitioners

with the core knowledge, skills, and tools needed to combat this
growing onslaught against computer systems.
How to Use this Book
This book is intended to be used as a tactical reference
while in the field.
This Field Guide is designed to help digital investigators
identify malware on a computer system, examine malware to
uncover its functionality and purpose, and determine malware’s
impact on a subject system. To further advance malware
analysis
as a forensic discipline, specific methodologies are provided
and
legal considerations are discussed so that digital investigators
can
perform this work in a reliable, repeatable, defensible, and
thoroughly documented manner.
Unlike Malware Forensics: Investigating and
Analyzing Malicious Code, which uses practical case scenarios
throughout the text to demonstrate techniques and associated
tools, this Field Guide strives to be both tactical and practical,
structured in a succinct outline format for use in the field, but
with
cross-references signaled by distinct graphical icons to
supplemental components and online resources for the field and
lab alike.
Supplemental Components

The supplementary components used in this Field Guide
include:
• Field Interview Questions: An organized and detailed
interview question and answer form that can be used
while responding to a malicious code incident.
• Field Notes: A structured and detailed note-taking
solution, serving as both guidance and a reminder
checklist while responding in the field or in the lab.
• Pitfalls to Avoid: A succinct list of commonly
encountered mistakes and discussion of how to avoid
these mistakes.
• Tool Box : A resource for the digital investigator to learn
about additional tools that are relevant to the subject
matter discussed in the corresponding substantive
chapter section. The Tool Box icon ( —a wrench and
hammer) is used to notify the reader that additional tool
information is available in the Tool Box appendix at the
end of each chapter, and on the book’s companion Web
site, www.malwarefieldguide.com.
• Selected Readings: A list of relevant supplemental
reading materials relating to topics covered in the
chapter.

Investigative Approach
When malware is discovered on a system, the
importance of organized methodology, sound analysis,
steady documentation, and attention to evidence dynamics
all outweigh the severity of any time pressure to
investigate.
Organized Methodology
The Field Guide’s overall methodology for dealing with
malware incidents breaks the investigation into five phases:
Phase 1: Forensic preservation and examination of volatile
data (Chapter 1)
Phase 2: Examination of memory (Chapter 2)
Phase 3: Forensic analysis: examination of hard drives
(Chapter 3)
Phase 4: File profiling of an unknown file (Chapters 5)
Phase 5: Dynamic and static analysis of a malware
specimen (Chapter 6)

Within each of these phases, formalized methodologies
and goals are emphasized to help digital investigators
reconstruct
a vivid picture of events surrounding a malware infection and
gain
a detailed understanding of the malware itself. The
methodologies outlined in this book are not intended as a
checklist to be followed blindly; digital investigators always
must
apply critical thinking to what they are observing and adjust
accordingly.
Whenever feasible, investigations involving malware
should extend beyond a single compromised computer, as
malicious code is often placed on the computer via the network,
and most modern malware has network-related functionality.
Discovering other sources of evidence, such as servers the
malware contacts to download components or instructions, can
provide useful information about how malware got on the
computer and what it did once installed.
In addition to systems containing artifacts of compromise,
other network and data sources may prove valuable to your
investigation. Comparing available backup tapes of the
compromised system to the current state of the system, for
example, may uncover additional behavioral attributes of the
malware, tools the attacker left behind, or recoverable files
containing exfiltrated data. Also consider checking centralized
logs from anti-virus agents, reports from system integrity
checking tools like Tripwire, and network level logs.
Network forensics can play a key role in malware
incidents, but this extensive topic is beyond the scope of our

incidents, but this extensive topic is beyond the scope of our
Field Guide. One of the author’s earlier works8 covers tools and
techniques for collecting and utilizing various sources of
evidence
on a network that can be useful when investigating a malware
incident, including Intrusion Detection Systems, NetFlow logs,
and network traffic. These logs can show use of specific
exploits,
malware connecting to external IP addresses, and the names of
files being stolen. Although potentially not available prior to
discovery of a problem, logs from network resources
implemented during the investigation may capture meaningful
evidence of ongoing activities.
Remember that well-interviewed network administrators,
system owners, and computer users often help develop the best
picture of what actually occurred.
Finally, as digital investigators are more frequently asked
to conduct malware analysis for investigative purposes that may
lead to the victim’s pursuit of a civil or criminal remedy,
ensuring
the reliability and validity of findings means compliance with
an
oft complicated legal and regulatory landscape. Chapter 4,
although no substitute for obtaining counsel and sound legal
advice, explores some of these concerns and discusses certain
legal requirements or limitations that may govern the
preservation, collection, movement and analysis of data and
digital artifacts uncovered during malware forensic
investigations.
Forensic Soundness

The act of collecting data from a live system may cause
changes that a digital investigator will need to justify, given its
impact on other digital evidence.
• For instance, running tools like Helix3 Pro9 from a
removable media device will alter volatile data when
loaded into main memory and create or modify files and
Registry entries on the evidentiary system.
• Similarly, using remote forensic tools necessarily
establishes a network connection, executes instructions
in memory, and makes other alterations on the
evidentiary system.
Purists argue that forensic acquisitions should not alter
the original evidence source in any way. However, traditional
forensic disciplines like DNA analysis suggest that the measure
of forensic soundness does not require that an original be left
unaltered. When samples of biological material are collected,
the
process generally scrapes or smears the original evidence.
Forensic analysis of the evidentiary sample further alters the
original evidence, as DNA tests are destructive. Despite
changes
that occur during both preservation and processing, these
methods are nonetheless considered forensically sound and the
evidence is regularly admitted in legal proceedings.
Some courts consider volatile computer data
discoverable, thereby requiring digital investigators to preserve

discoverable, thereby requiring digital investigators to preserve
data on live systems. For example, in Columbia Pictures
Industries v. Bunnell,10 the court held that RAM on a Web
server could contain relevant log data and was therefore within
the scope of discoverable information in the case.
Documentation
One of the keys to forensic soundness is documentation.
• A solid case is built on supporting documentation that
reports on where the evidence originated and how it was
handled.
• From a forensic standpoint, the acquisition process should
change the original evidence as little as possible, and any
changes should be documented and assessed in the
context of the final analytical results.
• Provided both that the acquisition process preserves a
complete and accurate representation of the original
data, and the authenticity and integrity of that
representation can be validated, the acquisition is
generally considered forensically sound.
Documenting the steps taken during an investigation, as
well as the results, will enable others to evaluate or repeat the
analysis.

analysis.
• Keep in mind that contemporaneous notes are often
referred to years later to help digital investigators recall
what occurred, what work was conducted, and who
was interviewed, among other things.
• Common forms of documentation include screenshots,
captured network traffic, output from analysis tools, and
notes.
• When preserving volatile data, document the date and
time that data was preserved and which tools were used,
and calculate the MD5 of all output.
• Whenever dealing with computers, it is critical to note the
date and time of the computer, and compare it with a
reliable time source to assess the accuracy of date-time
stamp information associated with the acquired data.
Evidence Dynamics
Unfortunately, digital investigators rarely are presented with
the perfect digital crime scene. Many times the malware or
attacker purposefully has destroyed evidence by deleting logs,
overwriting files, or encrypting incriminating data. Often the
digital investigator is called to an incident only after the victim
has
taken initial steps to remediate—and in the process, has either

destroyed critical evidence, or worse, compounded the damage
to the system by invoking additional hostile programs.
This phenomenon is not unique to digital forensics.
Violent crime investigators regularly find that offenders
attempted
to destroy evidence or EMT first responders disturbed the crime
scene while attempting to resuscitate the victim. These types of
situations are sufficiently common to have earned a name
—evidence dynamics.
Evidence dynamics is any influence that changes,
relocates, obscures, or obliterates evidence—regardless of
intent
—between the time evidence is transferred and the time the case
is adjudicated.11
• Evidence dynamics is a particular concern in malware
incidents because there is often critical evidence in
memory that will be lost if not preserved quickly and
properly.
• Digital investigators must live with the reality that they will
rarely have an opportunity to examine a digital crime
scene in its original state and should therefore expect
some anomalies.
• Evidence dynamics creates investigative and legal
challenges, making it more difficult to determine what
occurred, and making it more difficult to prove that the
evidence is authentic and reliable.
• Any conclusions the digital investigator reaches without
knowledge of how evidence was changed may be

knowledge of how evidence was changed may be
incorrect, open to criticism in court, or misdirect the
investigation.
• The methodologies and legal discussion provided in this
Field Guide are designed to minimize evidence dynamics
while collecting volatile data from a live system using
tools that can be differentiated from …
Global
editionGlo
b
a
l
ed
it
io
n
this is a special edition of an established
title widely used by colleges and universities
throughout the world. Pearson published this
exclusive edition for the benefit of students
outside the United States and Canada. if you
purchased this book within the United States
or Canada you should be aware that it has
been imported without the approval of the
Publisher or author.

Pearson Global Edition
Global
edition
For these Global editions, the editorial team at Pearson has
collaborated with educators across the world to address a
wide range of subjects and requirements, equipping students
with the best possible learning tools. this Global edition
preserves the cutting-edge approach and pedagogy of the
original, but also features alterations, customization, and
adaptation from the north american version.
it
Strategy:
Issues and Practices
M
cK
een
Sm
ith
it Strategy
Issues and Practices
tHiRd edition
James D. McKeen • Heather A. Smith
t
H
iR

d
e
d
it
io
n
McKeen_1292080264_mech.indd 1 28/11/14 12:56 PM
IT STraTegy:
ISSueS and PracTIceS
A01_MCKE0260_03_GE_FM.indd 1 26/11/14 9:32 PM
IT STraTegy:
ISSueS and PracTIceS
T h i r d E d i t i o n
G l o b a l E d i t i o n
James D. McKeen
Queen’s University

Heather A. Smith
Queen’s University
Boston Columbus Indianapolis New York San Francisco
Hoboken
Amsterdam Cape Town Dubai London Madrid Milan Munich
Paris Montréal Toronto
Delhi Mexico City São Paulo Sydney Hong Kong Seoul
Singapore Taipei Tokyo
Editor in Chief: Stephanie Wall
Head of Learning Asset Acquisition, Global Edition: Laura Dent
Acquisitions Editor: Nicole Sam
Program Manager Team Lead: Ashley Santora
Program Manager: Denise Vaughn
Editorial Assistant: Kaylee Rotella
Assistant Acquisitions Editor, Global Edition: Debapriya
Mukherjee
Associate Project Editor, Global Edition: Binita Roy
Executive Marketing Manager: Anne K. Fahlgren
Project Manager Team Lead: Judy Leale
Project Manager: Thomas Benfatti
Procurement Specialist: Diane Peirano
Senior Manufacturing Controller, Production, Global Edition:
Trudy Kimber
Cover Image: © Toria/Shutterstock
Cover Designer: Lumina Datamantics
Full Service Project Management: Abinaya Rajendran at Integra
Software Services, Pvt. Ltd.
Credits and acknowledgments borrowed from other sources and

reproduced, with permission, in this
textbook appear on appropriate page within text.
Pearson Education Limited
Edinburgh Gate
Harlow
Essex CM20 2JE
England
and Associated Companies throughout the world
Visit us on the World Wide Web at:
www.pearsonglobaleditions.com
© Pearson Education Limited 2015
The rights of James D. McKeen and Heather A. Smith to be
identified as the authors of this work have been
asserted by them in accordance with the Copyright, Designs and
Patents Act 1988.
Authorized adaptation from the United States edition, entitled
IT Strategy: Issues and Practices, 3rd edition, ISBN
978-0-13-354424-4, by James D. McKeen and Heather A.
Smith, published by Pearson Education © 2015.
All rights reserved. No part of this publication may be
reproduced, stored in a retrieval system, or transmitted
in any form or by any means, electronic, mechanical,
photocopying, recording or otherwise, without either
the prior written permission of the publisher or a license
permitting restricted copying in the United Kingdom
issued by the Copyright Licensing Agency Ltd, Saffron House,
6–10 Kirby Street, London EC1N 8TS.
All trademarks used herein are the property of their respective

owners. The use of any trademark in this text
does not vest in the author or publisher any trademark
ownership rights in such trademarks, nor does the
use of such trademarks imply any affiliation with or
endorsement of this book by such owners.
ISBN 10: 1-292-08026-4
ISBN 13: 978-1-292-08026-0
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British
Library
10 9 8 7 6 5 4 3 2 1
Typeset in 10/12 Palatino LT Std by Integra Software Services,
Pvt. Ltd.
Printed and bound in Great Britain by Clays Ltd, Bungay,
Suffolk.
ConTEnTS
Preface 13
About the Authors 21
Acknowledgments 22
Section I Delivering Value with IT 23
Chapter 1 The IT Value ProPoSITIon 24

Peeling the Onion: Understanding IT Value 25
What Is IT Value? 25
Where Is IT Value? 26
Who Delivers IT Value? 27
When Is IT Value Realized? 27
The Three Components of the IT Value Proposition 28
Identification of Potential Value 29
Effective Conversion 30
Realizing Value 31
Five Principles for Delivering Value 32
Principle 1. Have a Clearly Defined Portfolio Value
Management
Process 33
Principle 2. Aim for Chunks of Value 33
Principle 3. Adopt a Holistic Orientation to Technology Value
33
Principle 4. Aim for Joint Ownership of Technology Initiatives
34
Principle 5. Experiment More Often 34
Conclusion 34 • References 35
Chapter 2 DelIVerIng BuSIneSS Value Through
IT STraTegy 37
Business and IT Strategies: Past, Present, and Future 38

Four Critical Success Factors 40
The Many Dimensions of IT Strategy 42
Toward an IT Strategy-Development Process 44
Challenges for CIOs 45
Chapter 3 MakIng IT CounT 49
Business Measurement: An Overview 50
Key Business Metrics for IT 52
5
6 Contents
Designing Business Metrics for IT 53
Advice to Managers 57
Chapter 4 effeCTIVe BuSIneSS–IT relaTIonShIPS 60
The Nature of the Business–IT Relationship 61
The Foundation of a Strong Business–IT
Relationship 63
Building Block #1: Competence 64
Building Block #2: Credibility 65

Building Block #3: Interpersonal Interaction 66
Building Block #4: Trust 68
Appendix A The Five IT Value Profiles 72
Appendix B Guidelines for Building a Strong Business–IT
Relationship 73
Chapter 5 BuSIneSS–IT CoMMunICaTIon 74
Communication in the Business–IT Relationship 75
What Is “Good” Communication? 76
Obstacles to Effective Communication 78
“T-Level” Communication Skills for IT Staff 80
Improving Business–IT Communication 82
Appendix A IT Communication Competencies 85
Chapter 6 effeCTIVe IT leaDerShIP 86
The Changing Role of the IT Leader 87
What Makes a Good IT Leader? 89
How to Build Better IT Leaders 92
Investing in Leadership Development: Articulating the Value
Proposition 95

MInI CaSeS
Delivering Business Value with IT at Hefty Hardware 98
Investing in TUFS 102
IT Planning at ModMeters 104
Contents 7
Section II IT governance 109
Chapter 7 effeCTIVe IT ShareD SerVICeS 110
IT Shared Services: An Overview 111
IT Shared Services: Pros and Cons 114
IT Shared Services: Key Organizational Success Factors 115
Identifying Candidate Services 116
An Integrated Model of IT Shared Services 117
Recommmendations for Creating Effective IT
Shared Services 118
Chapter 8 SuCCeSSful IT SourCIng: MaTurITy MoDel,
SourCIng oPTIonS, anD DeCISIon CrITerIa 122
A Maturity Model for IT Functions 123

IT Sourcing Options: Theory Versus Practice 127
The “Real” Decision Criteria 131
Decision Criterion #1: Flexibility 131
Decision Criterion #2: Control 131
Decision Criterion #3: Knowledge Enhancement 132
Decision Criterion #4: Business Exigency 132
A Decision Framework for Sourcing IT Functions 133
Identify Your Core IT Functions 133
Create a “Function Sourcing” Profile 133
Evolve Full-Time IT Personnel 135
Encourage Exploration of the Whole Range
of Sourcing Options 136
Combine Sourcing Options Strategically 136
A Management Framework for Successful
Sourcing 137
Develop a Sourcing Strategy 137
Develop a Risk Mitigation Strategy 137
Develop a Governance Strategy 138
Understand the Cost Structures 138

Chapter 9 BuDgeTIng: PlannIng’S eVIl TwIn 140
Key Concepts in IT Budgeting 141
The Importance of Budgets 143
The IT Planning and Budget Process 145
8 Contents
Corporate Processes 145
IT Processes 147
Assess Actual IT Spending 148
IT Budgeting Practices That Deliver Value 149
Chapter 10 rISk ManageMenT In IT 152
A Holistic View of IT-Based Risk 153
Holistic Risk Management: A Portrait 156
Developing a Risk Management Framework 157
Improving Risk Management Capabilities 160
Appendix A A Selection of Risk Classification
Schemes 163

Chapter 11 InforMaTIon ManageMenT:
STageS anD ISSueS 164
Information Management: How Does IT Fit? 165
A Framework For IM 167
Stage One: Develop an IM Policy 167
Stage Two: Articulate the Operational
Components 167
Stage Three: Establish Information Stewardship 168
Stage Four: Build Information Standards 169
Issues In IM 170
Culture and Behavior 170
Information Risk Management 171
Information Value 172
Privacy 172
Knowledge Management 173
The Knowing–Doing Gap 173
Getting Started in IM 173
Appendix A Elements of IM Operations 177
MInI CaSeS

Building Shared Services at RR Communications 178
Enterprise Architecture at Nationstate Insurance 182
IT Investment at North American Financial 187
Contents 9
Section III IT-enabled Innovation 191
Chapter 12 TeChnology-DrIVen InnoVaTIon 192
The Need for Innovation: An Historical
Perspective 193
The Need for Innovation Now 193
Understanding Innovation 194
The Value of Innovation 196
Innovation Essentials: Motivation, Support,
and Direction 197
Challenges for IT leaders 199
Facilitating Innovation 201
Chapter 13 when BIg DaTa anD SoCIal CoMPuTIng MeeT 204
The Social Media/Big Data Opportunity 205

Delivering Business Value with Big Data 207
Innovating with Big Data 211
Pulling in Two Different Directions: The Challenge
for IT Managers 212
First Steps for IT Leaders 214
Chapter 14 effeCTIVe CuSToMer exPerIenCe 217
Customer Experience and Business value 218
Many Dimensions of Customer Experience 219
The Role of Technology in Customer Experience 221
Customer Experience Essentials for IT 222
First Steps to Improving Customer Experience 225
Chapter 15 BuSIneSS InTellIgenCe: an oVerVIew 228
Understanding Business Intelligence 229
The Need for Business Intelligence 230
The Challenge of Business Intelligence 231
The Role of IT in Business Intelligence 233
Improving Business Intelligence 235

10 Contents
Chapter 16 TeChnology-enaBleD CollaBoraTIon 240
Why Collaborate? 241
Characteristics of Collaboration 244
Components of Successful Collaboration 247
The Role of IT in Collaboration 249
First Steps for Facilitating Effective Collaboration 251
MInI CaSeS
Innovation at International Foods 256
Consumerization of Technology at IFG 261
CRM at Minitrex 265
Customer Service at Datatronics 268
Section IV IT Portfolio Development and Management 273
Chapter 17 ManagIng The aPPlICaTIon PorTfolIo 274
The Applications Quagmire 275
The Benefits of a Portfolio Perspective 276
Making APM Happen 278
Capability 1: Strategy and Governance 280

Capability 2: Inventory Management 284
Capability 3: Reporting and Rationalization 285
Key Lessons Learned 286
Appendix A Application Information 288
Chapter 18 IT DeManD ManageMenT: SuPPly ManageMenT
IS noT enough 292
Understanding IT Demand 293
The Economics of Demand Management 295
Three Tools for Demand management 295
Key Organizational Enablers for Effective Demand
Management 296
Strategic Initiative Management 297
Application Portfolio Management 298
Enterprise Architecture 298
Business–IT Partnership 299
Governance and Transparency 301
Contents 11

Chapter 19 TeChnology roaDMaP: BenefITS, eleMenTS, anD
PraCTICal STePS 305
What is a Technology Roadmap? 306
The Benefits of a Technology Roadmap 307
External Benefits (Effectiveness) 307
Internal Benefits (Efficiency) 308
Elements of the Technology Roadmap 308
Activity #1: Guiding Principles 309
Activity #2: Assess Current Technology 310
Activity #3: Analyze Gaps 311
Activity #4: Evaluate Technology
Landscape 312
Activity #5: Describe Future Technology 313
Activity #6: Outline Migration Strategy 314
Activity #7: Establish Governance 314
Practical Steps for Developing a Technology
Roadmap 316
Appendix A Principles to Guide a Migration
Strategy 318

Chapter 20 eMergIng DeVeloPMenT PraCTICeS 319
The Problem with System Development 320
Trends in System Development 321
Obstacles to Improving System Development
Productivity 324
Improving System Development Productivity: What we
know that Works 326
Next Steps to Improving System Development
Productivity 328
Chapter 21 InforMaTIon DelIVery: PaST, PreSenT, anD
fuTure 332
Information and IT: Why Now? 333
Delivering Value Through Information 334
Effective Information Delivery 338
New Information Skills 338
New Information Roles 339
New Information Practices 339
12 Contents
New Information Strategies 340

The Future of Information Delivery 341
MInI CaSeS
Project Management at MM 346
Working Smarter at Continental Furniture International 350
Managing Technology at Genex Fuels 355
Index 358
PrEFACE
Today, with information technology (IT) driving constant
business transformation,
overwhelming organizations with information, enabling 24/7
global operations, and
undermining traditional business models, the challenge for
business leaders is not
simply to manage IT, it is to use IT to deliver business value.
Whereas until fairly recently,
decisions about IT could be safely delegated to technology
specialists after a business
strategy had been developed, IT is now so closely integrated
with business that, as one
CIO explained to us, “We can no longer deliver business
solutions in our company
without using technology so IT and business strategy must
constantly interact with
each other.”

What’s New in This Third Edition?
• Six new chapters focusing on current critical
issues in IT management, including
IT shared services; big data and social computing; business
intelligence; manag-
ing IT demand; improving the customer experience; and
enhancing development
productivity.
• Two significantly revised chapters: on delivering
IT functions through different
resourcing options; and innovating with IT.
• Twonew mini cases based on real companies
and real IT management situations:
Working Smarter at Continental Furniture and Enterprise
Architecture at Nationstate
Insurance.
• A revised structure based on reader
feedback with six chapters and two mini cases
from the second edition being moved to the Web site.
All too often, in our efforts to prepare future executives to deal
effectively with
the issues of IT strategy and management, we lead them into a
foreign country where
they encounter a different language, different culture, and
different customs. Acronyms
(e.g., SOA, FTP/IP, SDLC, ITIL, ERP), buzzwords (e.g.,
asymmetric encryption, proxy
servers, agile, enterprise service bus), and the widely adopted
practice of abstraction
(e.g., Is a software monitor a person, place, or thing?) present
formidable “barriers to

entry” to the technologically uninitiated, but more important,
they obscure the impor-
tance of teaching students how to make business decisions about
a key organizational
resource. By taking a critical issues perspective, IT Strategy:
Issues and Practices treats IT
as a tool to be leveraged to save and/or make money or
transform an organization—not
as a study by itself.
As in the first two editions of this book, this third edition
combines the experi-
ences and insights of many senior IT managers from leading-
edge organizations with
thorough academic research to bring important issues in IT
management to life and
demonstrate how IT strategy is put into action in contemporary
businesses. This new
edition has been designed around an enhanced set of critical
real-world issues in IT
management today, such as innovating with IT, working with
big data and social media,
13
14 Preface
enhancing customer experience, and designing for business
intelligence and introduces
students to the challenges of making IT decisions that will have
significant impacts on
how businesses function and deliver value to stakeholders.

IT Strategy: Issues and Practices focuses on how IT is changing
and will continue to
change organizations as we now know them. However, rather
than learning concepts
“free of context,” students are introduced to the complex
decisions facing real organi-
zations by means of a number of mini cases. These provide an
opportunity to apply
the models/theories/frameworks presented and help students
integrate and assimilate
this material. By the end of the book, students will have the
confidence and ability to
tackle the tough issues regarding IT management and strategy
and a clear understand-
ing of their importance in delivering business value.
Key Features of This Book
• A focus on IT management issues as opposed to
technology issues
• Critical IT issues explored within their
organizational contexts
• Readily applicablemodels and frameworks for
implementing IT strategies
• Mini cases to animate issues and focus
classroom discussions on real-world deci-
sions, enabling problem-based learning
• Proven strategies and best practices from leading-edge
organizations
• Useful and practical advice and guidelinesfor
delivering value with IT
• Extensive teaching notes for all mini cases
A Different ApproAch to teAching it StrAtegy

The real world of IT is one of issues—critical issues—such as
the following:
• How do we know if we are getting
value from our IT investment?
• How can we innovate with IT?
• What specific IT functions should we seek
from external providers?
• How do we buildan IT leadershipteam that is
a trusted partner with the business?
• How do we enhance IT capabilities?
• What is IT’s role in creating an intelligent
business?
• How can we best take advantage of new
technologies, such as big data and social
media, in our business?
• How can we manage IT risk?
However, the majority of management information systems
(MIS) textbooks are orga-
nized by system category (e.g., supply chain, customer
relationship management, enterprise
resource planning), by system component (e.g., hardware,
software, networks), by system
function (e.g., marketing, financial, human resources), by
system type (e.g., transactional,
decisional, strategic), or by a combination of these.
Unfortunately, such an organization
does not promote an understanding of IT management in
practice.
IT Strategy: Issues and Practices tackles the real-world
challenges of IT manage-
ment. First, it explores a set of the most important issues facing

IT managers today, and
second, it provides a series of mini cases that present these
critical IT issues within the
context of real organizations. By focusing the text as
well as the mini cases on today’s
critical issues, the book naturally reinforces problem-based
learning.
Preface 15
IT Strategy: Issues and Practices includes thirteen mini cases—
each based on a real
company presented anonymously.1 Mini cases are not simply
abbreviated versions of
standard, full-length business cases. They differ in two
significant ways:
1. A horizontal perspective. Unlike standard cases that develop
a single issue within
an organizational setting (i.e., a “vertical” slice of
organizational life), mini cases
take a “horizontal” slice through a number of coexistent issues.
Rather than looking
for a solution to a specific problem, as in a standard case,
students analyzing a mini
case must first identify and prioritize the issues embedded
within the case. This mim-
ics real life in organizations where the challenge lies in
“knowing where to start” as
opposed to “solving a predefined problem.”
2. Highly relevant information. Mini cases are densely written.

Unlike standard
cases, which intermix irrelevant information, in a mini case,
each sentence exists for
a reason and reflects relevant information. As a result, students
must analyze each
case very carefully so as not to miss critical aspects of the
situation.
Teaching with mini cases is, thus, very different than teaching
with standard cases.
With mini cases, students must determine what is really going
on within the organiza-
tion. What first appears as a straightforward “technology”
problem may in fact be a
political problem or one of five other “technology” problems.
Detective work is, there-
fore, required. The problem identification and prioritization
skills needed are essential
skills for future managers to learn for the simple reason that it
is not possible for organi-
zations to tackle all of their problems concurrently. Mini cases
help teach these skills to
students and can balance the problem-solving skills learned in
other classes. Best of all,
detective work is fun and promotes lively classroom discussion.
To assist instructors, extensive teaching notes are available for
all mini cases. Developed
by the authors and based on “tried and true” in-class experience,
these notes include case
summaries, identify the key issues within each case, present
ancillary information about the
company/industry represented in the case, and offer guidelines
for organizing the class-
room discussion. Because of the structure of these mini cases
and their embedded issues, it

is common for teaching notes to exceed the length of the actual
mini case!
This book is most appropriate for MIS courses where the goal is
to understand how
IT delivers organizational value. These courses are frequently
labeled “IT Strategy” or
“IT Management” and are offered within undergraduate as well
as MBA programs. For
undergraduate juniors and seniors in business and commerce
programs, this is usually
the “capstone” MIS course. For MBA students, this course may
be the compulsory core
course in MIS, or it may be an elective course.
Each chapter and mini case in this book has been thoroughly
tested in a variety
of undergraduate, graduate, and executive programs at
Queen’s School of Business.2
1 We are unable to identify these leading-edge companies by
agreements established as part of our overall
research program (described later).
2 Queen’s School of Business is one of the world’s
premier business schools, with a faculty team
renowned
for its business experience and academic credentials. The
School has earned international recognition for
its innovative approaches to team-based and experiential
learning. In addition to its highly acclaimed MBA
programs, Queen’s School of Business is also home
to Canada’s most prestigious undergraduate
business
program and several outstanding graduate programs. As
well, the School is one of the world’s largest
and

most respected providers of executive education.
16 Preface
These materials have proven highly successful within all
programs because we adapt
how the material is presented according to the level of the
students. Whereas under-
graduate students “learn” about critical business issues from the
book and mini cases
for the first time, graduate students are able to “relate” to these
same critical issues
based on their previous business experience. As a result,
graduate students are able to
introduce personal experiences into the discussion of these
critical IT issues.
orgAnizAtion of thiS Book
One of the advantages of an issues-focused structure is that
chapters can be approached
in any order because they do not build on one another. Chapter
order is immaterial; that
is, one does not need to read the first three chapters to
understand the fourth. This pro-
vides an instructor with maximum flexibility to organize a
course as he or she sees fit.
Thus, within different courses/programs, the order of topics can
be changed to focus on
different IT concepts.
Furthermore, because each mini case includes multiple issues,

they, too, can be
used to serve different purposes. For example, the mini case
“Building Shared Services
at RR Communications” can be used to focus on issues of
governance, organizational
structure, and/or change management just as easily as shared
services. The result is a
rich set of instructional materials that lends itself well to a
variety of pedagogical appli-
cations, particularly problem-based learning, and that clearly
illustrates the reality of IT
strategy in action.
The book is organized into four sections, each emphasizing a
key component of
developing and delivering effective IT strategy:
• Section I: Delivering Value with IT is designed to
examine the complex ways that
IT and business value are related. Over the past twenty years,
researchers and prac-
titioners have come to understand that “business value” can
mean many different
things when applied to IT. Chapter 1 (The IT Value Proposition)
explores these con-
cepts in depth. Unlike the simplistic value propositions often
used when imple-
menting IT in organizations, this chapter presents “value” as a
multilayered busi-
ness construct that must be effectively managed at several
levels if technology is
to achieve the benefits expected. Chapter 2 (Delivering
Business Value through IT
Strategy) examines the dynamic interrelationship between
business and IT strat-
egy and looks at the processes and critical success factors used

by organizations to
ensure that both are well aligned. Chapter 3 (Making IT Count)
discusses new ways
of measuringIT’s effectiveness that promote closer
business–IT alignment and help
drive greater business value. Chapter 4 (Effective Business–IT
Relationships) exam-
ines the nature of the business–IT relationship and the
characteristics of an effec-
tive relationship that delivers real value to the enterprise.
Chapter 5 (Business–IT
Communication) explores the business and interpersonal
competencies that IT staff
will need in order to do their jobs effectively over the next five
to seven years and
what companies should be doing to develop them. Finally,
Chapter 6 (Effective IT
Leadership) tackles the increasing need for improved leadership
skills in all IT staff
and examines the expectations of the business for strategic and
innovative guid-
ance from IT.
Preface 17
In the mini cases associated with this section, the concepts of
delivering
value with IT are explored in a number of different ways. We
see business and
IT executives at Hefty Hardware grappling with conflicting
priorities and per-
spectives and how best to work together to

achieve the company’s strategy. In
“Investing in TUFS,” CIO Martin Drysdale watches as all of the
work his IT depart-
ment has put into a major new system fails to deliver value. And
the “IT Planning
at ModMeters” mini case follows CIO Brian Smith’s
efforts to create a strategic
IT plan that will align with business strategy, keep IT running,
and not increase
IT’s budget.
• Section II: IT Governance explores key concepts in how
the IT organization is
structured and managed to effectively deliver IT products and
services to the orga-
nization. Chapter 7 (Effective IT Shared Services) discusses
how IT shared services
should be selected, organized, managed, and governed to
achieve improved organi-
zational performance. Chapter 8 (Successful IT Sourcing:
Maturity Model, Sourcing
Options, and Decision Criteria) examines how organizations are
choosing to source
and deliver different types of IT functions and presents a …

MGT230 v6Amazon.com Case Study AnalysisMGT230 v6Page 2 of .docx

Recommended

Recommended

More Related Content

Similar to MGT230 v6Amazon.com Case Study AnalysisMGT230 v6Page 2 of .docx

Similar to MGT230 v6Amazon.com Case Study AnalysisMGT230 v6Page 2 of .docx (20)

More from jessiehampson

More from jessiehampson (20)

Recently uploaded

Recently uploaded (20)

MGT230 v6Amazon.com Case Study AnalysisMGT230 v6Page 2 of .docx