I’ve had the privilege to work for many different organisations in my career. Some of these organisations had one common challenge of maintaining their core application on a legacy system and upgrading it to the latest to make it more reliable, highly available, scalable, secure and cost-effective. This is for obvious reasons – reduce the business impact, improve productivity, improve work efficiency and eventually improve staff/customer satisfaction. In this article, I’ll be sharing my strategy and approach to mitigate the risk of running core applications on the legacy system and finding the right solution for the business.
Before we delve into a mitigation plan and long-term strategy, let’s understand some of the challenges.
Challenges
- Support and maintenance – OS patching, unsupported software version, systems ordevice dependency and people dependency (lack of in-house knowledge), e.g.whoever wrote the application is no longer with the company, so the knowledgehas gone with the person. Another issue could be that the business cannotafford application downtime for maintenance due to the criticality of thesystem, e.g. A trading application for financial services can cost in millionsif down for few mins, A patient record system for a healthcare service can be life-threateningif down for some time.
- Security Risk – System vulnerabilities due to missing patches orunsupported hardware and software. Unauthorised access to the system as itmight not have appropriate controls in place due to system limitations whichcan lead to data loss. Unplanned service outages can damage the businessreputation and unexpected financial loss to the organisation.
- Lack of integration with other applications/ devices to improve the overall user/ customer experience.
- Compliance issues – the system doesn’t meet compliance requirements of the organisations.
- Not aligned with the organisation’s vision
- Performance issue
- Staff training and usability issue
- and the list goes on…..
Now let’s discuss the mitigation plan or short-termstrategy to overcome the situation temporarily so we can plan for a better solution.
Short-term strategy
- Engage vendor or 3rd party in supporting the system
- Conduct risk assessment to understand the risks, business impact and dependencies.
- Virtualise the system if the application is running on aphysical server. This will give a bit of flexibility in adding more resourcesto the system to improve the performance and remove the hardware dependency.
- Segregate network and move the system to a separate network if it’s not already.
- Document all processes around the legacy system including service owners, emergency contacts, support contract, know issues, troubleshooting guide, workarounds, how to guide, BCP etc.
- Awareness and usability training for staff – It will enable staff to be more familiar with the system and processes around it.
Long-term strategy or finding the right solution
- Establish the organisational context – organisation’s vision, objectives, workforce, culture and customer
- Share your vision with the vendors or trusted suppliers to find the right and cost-effective solution in line with the organisational goal.
- Consider high availability, scalability, reliability and security of the solution.
- Do a cost-benefit analysis and create a solid business case to get top-level buy-in.
- Engage key people e.g business managers, process owners, project managers, IT, Security in design and implementation phase (review security in every phase of the project)
- Conduct risk assessment after the implementation phase to understand the risks, so they can be treated before the solution go live.
- If the solution is hosted or a cloud solution, review the contract thoroughly and ensure the provider implies with your security standards and you have the right to audit them periodically.
- Train staff and make it a part of new employee onboarding process.
- Decommission legacy system
- Lastly, embrace the new change….
‘The Only Thing That Is Constant Is Change – Embrace it.’