Offshore dilemma

Sending technical support overseas is attractive, but it could expose production systems to new risks

IT managers have gotten very comfortable moving application development and maintenance to offshore providers. And offshore outsourcing of business processes, such as claims processing, is growing rapidly, too. But one area of outsourcing that hasn't caught on yet is offshore technical support for IT systems and infrastructure.

Simply put, the jobs of technical support personnel and systems administrators who work on real-time IT applications could be done remotely over a network connection to the system.

For example, if a problem arises with a CRM application, the troubleshooting and repair could be performed by workers in India. Server capacity management, network management and database and firewall administration are all functions that could be handled offshore.

But today, offshore support for production IT systems is a niche market, and because it's new, best practices haven't emerged. Users are cautious, given that this type of outsourcing involves access to mission-critical production systems and raises new concerns about issues such as security, privacy and intellectual property protection. Plus, once a company decides to shift its application and systems support to an overseas vendor, it will lose in-house expertise in those skills.

Infrastructure outsourcing is "a long-term decision — it's not easy to take it back," says G.K. Prasanna, who manages infrastructure services at Bangalore, India-based Wipro Ltd., a major overseas outsourcer.

Developing Best Practices

The financial services industry, which has been aggressive about using offshore IT services, recently began an effort through the Financial Services Technology Consortium (FSTC) in New York to develop a set of best practices for moving production and infrastructure support offshore.

Outsourcing application development is "fairly easy — there is no access into production systems," says Jim Salters, director of technology initiatives and project development at the FSTC. Faced with the new challenges of outsourcing technical support, the FSTC is developing an implementation playbook and hopes to have an initial version completed before the new year.

Stan Lepeak, an analyst at Meta Group Inc., says it's always a good idea for end users to band together to develop best practices, though he wonders how much information the competing financial services firms will be willing to share with one another.

Guidelines that make companies more comfortable with outsourcing technical support could help increase the use of offshore IT services. But the complexities uncovered by the FSTC's effort could also have the opposite effect and slow down the market. "It could lead them to the conclusion that this is a three- to five- to seven-year initiative" just to come up with the best practices, Lepeak says.

Standardizing Processes

Financial services firms are supporting the FSTC effort because without some kind of industry standards, "each bank ends up inventing their own processes," says an IT official at a major bank who asked not to be identified.

The FSTC is looking at issues like how to protect confidential data — such as trade secrets and customer information — from being disclosed or stolen by competitors, the outsourcing contractor or the contractor's employees.

Legal experts say the only way users can ensure that their interests are protected is to take nothing for granted. Penetration testing of a vendor's security processes and detailed background checks on employees will be needed.

The Federal Deposit Insurance Corp., for instance, prohibits financial services firms from hiring people with certain types of criminal convictions, and those restrictions also apply to people managing the systems of FDIC-insured banks overseas.

Some offshore providers, in an effort to reassure U.S. firms about their security standards, set strict rules about what their employees can bring into work, prohibiting them from carrying in laptops, handhelds and cell phones — anything that can be used to steal a company's intellectual property.

Advances in another IT arena may help make offshore outsourcing of technical support more feasible. Privacy laws have spurred the development of data-masking technologies that can disguise customers' personal data. These technologies can also protect data handled by offshore contractors. "Once I do that [data masking], I've opened the door to make it easier to go offshore," the bank IT official says.

Outsourcing parties also need to find ways to prevent trade secrets from falling into the hands of competitors. That could mean prohibiting an outsourcer from working with competitors or finding methods to segregate the work, said Marina Gracias, deputy general counsel at Providian Bancorp Services in San Francisco, at a recent conference. Another step is to prohibit an outsourcer's employees from seeking work with a competing company for a period of time, she said.

Infrastructure outsourcing is possible only because of the growing reliability of global networks, which make it possible for systems to be managed remotely over vast distances. While the telecommunications infrastructure is improving in many low-wage countries, it's far from perfect, and outsourcing experts say it could remain a hurdle for some companies in managing real-time systems.

But as long as a financial case can be made for moving relatively routine jobs offshore, the pressure on companies to take that step will be huge.

Mark Mayo, a partner at TPI, an outsourcing consultancy in The Woodlands, Texas, says 40% of the outsourcing deals TPI has been involved in this year have included some offshore component. Mayo says that may increase to 60% next year, adding that the outsourcing of infrastructure support will be one of the reasons for this growth.

What Stays

Support for data center hardware, servers and mainframes will remain in the U.S. for the following reasons:

Hardware and software licensing costs aren't any cheaper overseas.
Real estate and data center construction costs can be just as expensive overseas.
Loss of control of data is possible.
It can be difficult to switch from one offshore vendor to another.

What Goes

Routine administrative and maintenance functions such as the following are offshoring candidates:

Systems administration, including server capacity and firewall management
Database administration
Help desk operations
Network management
Real-time application support

See more coverage of this issue in our Outsourcing Center.


Copyright © 2003 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon