Top Challenges in Project Management

I was helping plan and implement a Web-based project management system for one of my clients, a global construction company, presented a number of challenges. One of the main challenges was developing a system that would allow the sharing of hundreds of thousands of documents among teams stationed around the world. While the organization considers the new Web-based project management system a success, the project did have its difficulties along the way. As with any other project, there were pitfalls to avoid and a learning curve to follow. Here are some of the challenges we faced, along with advice on how you can avoid some of the same problems. I am just trying to start to build a list here.

Balancing all the elements of a complex assignment - time, money, scope and people - is the project manager's job. Excellent PM training is essential to successfully dealing with the unexpected challenges that come with every plan. Following is an overview of the top 10 PM challenges that PMs may encounter on the job. I know this is well beaten track but I want to start giving current view & scope.

Naturally, there are many more project management challenges than stated here. However, these are the most frequently voiced by teams from a myriad of industries. If you are experiencing one or more of these challenges, then your team may benefit from implementing a project management software system. I will say this is a start & even I would like to collect these data point & prioritize on scenario, situation basis. Suggestion are welcomed to make this better.

Resource utilization : This is a key for success, project teams often complain that they do not have accurate or up to date information about their resources and what they are working on. Many project teams have more demand for projects than they have team members to execute the projects. Many project teams solve this challenge with a combination of meetings and either Excel or Microsoft Project.

For example, some teams meet once a week to determine what each person will work on. This can work, however, it depends on the pace of the work environment. One interactive agency with a very fast pace of work and lots of daily changes to the work schedule lost hours and hours of productivity as team members were only given assignments once a week.

Teams without centralized project management software often talk about using an Excel spreadsheet to manage workloads. Yet many state that it is a cumbersome exercise. Project managers benefit from leveling a single project in Microsoft Project. However, project managers utilizing desktop software may have a challenging time understanding how much work each resource has been allocated to across all projects.

At best, project managers using Microsoft Project’s resource pool can level resources across multiple projects. Yet, many project managers, even PMP certified project managers, find the resource leveling features of Microsoft Project to be dangerous. A commonly stated problem is that the projects’ timelines are extended beyond an acceptable timeframe, so many project managers abandon using the resource leveling functionality.

Time Wastage: For example simple task like looking for project documents and assets can kill critical time required for success. All projects have files, documents and assets that pertain to the project and tasks. Project assets can include project scope documents, risk lists, issues lists, files, emails, and deliverables, to name a few. Most project teams are sharing files on networks. The challenge with even the best file storage systems on the internal network is that team members still complain that they cannot find critical documents. It is simply too easy to forget where those assets and files are, unless they are frequently used.

The other problem with this is that usually third parties or those the project team needs to collaborate with outside one’s four walls (and network) cannot access these files. Many organizations do not permit third parties to VPN into their network for security reasons. This means that the project manager must resort to emailing those assets to these outside team members, which again can result in the version control.

A Web-based project management software solves these issues by posting all project assets in the centralized repository. The solutions that link documents repositories with the project they pertain to make finding the specific assets easy for the team members. An even more robust solution will permit team members to post assets at the task level, not just the project level.

Geographically dispersed project teams : Current new challenge. Many project teams are geographically dispersed. Projects are inherently collaborative efforts. The very nature of projects is such that project teams are usually comprised of multiple team members. Often, project teams incorporate multiple organizations. Team members can not only be employees, but also clients, vendors, sub-contractors and other third parties. Sometimes the entire project team belongs to the same company or organization, yet they often work from different offices either within the U.S. or globally. Even if the project team is in the same office, in today’s fast paced economy, information needs to pass as rapidly as possible, making a centralized project management software solution imperative. As the rise in outsourcing work and offshore development continues, project managers and executive management need to synchronize their work across multiple time zones. So, when the U.S. based team goes to sleep, and the team in Asia goes to work, they may login to the web-based project management solution to view their project, resource and task status. Companies that manage this asynchronous process well are excelling compared to their competitors. Also, clients are demanding more visibility and transparency into their projects’ progress. Client-facing project teams that possess a collaborative software system to interact with their customers are selling this as a competitive advantage and winning business over their competition.

Wrong tool for the job :Many companies attempt to manage projects using desktop software applications like Microsoft Project and Microsoft Excel. The main challenge with using desktop software to manage projects is that these applications were not designed for collaboration among several parties. At worst, the file is shared by emailing the file to all parties on the team. At best, the file may be posted on a network or on an extranet and shared from there.

One typical scenario that arises from using desktop software for project management is file ‘version control.’ For example, a project manager may email a Microsoft Project file to share project information to the team. If the file is updated frequently, then it can often be confusing as to which version of the project is the most recent one. Many times, the project manager will be conversing with an executive about a project and twenty minutes into the conversation find that they are both viewing two different versions of the project. Another issue with using desktop applications is that the minute they are emailed to the project team, the project data is outdated. That is, the information is not available in real-time. Projects are inherently dynamic efforts that change by the hour and sometimes minute.

A project management solution that is 100% web-based solves these issues by allowing project managers and their team members to access project information from any browser in the world, at any time of the day or night. The project information is centralized in one database and posted in real-time, assuring that all project members and executive management can view the most recent information about the project.

Excessive status reporting: Many project team members complain about spending too much time in meetings to update project status. No solution is ever going to replace the need for human communication and meetings. However, many teams talk about wasting too much time in meetings where everyone goes around the room and updates the project manager on his/her tasks. This is a very traditional way to getting status updates.

Another common model for updating project status is the project manager asks each team member individually where their tasks stand. The problem with this model is that the project manager becomes a ‘glorified administrator,’ and spends time updating the Microsoft Project file or Excel file. Instead, project managers could be managing more projects or thinking about higher level project concerns.

A web-based project software solution permits each team member to report back on project tasks and activities throughout their working day instead of relying on status meetings, or asking each individual for an update. The beauty of web-based

solutions is that each team member is empowered to report back on his or her tasks, pushing the responsibility back where it belongs, to the team member. To add to this we have developed a in house web based time sheets system attached to our web portal which can also linked to the bug reporting system to understand the effort wastages etc & build the traceability required.

Unclear Goals: When goals are not clearly identified, it is impossible for the team to meet them. And, since upper management cannot agree to or support undefined goals, the plan in question has little chance of succeeding. The manager must ask the right questions to establish and communicate clear goals from the outset.

Measurement problem: For some team members using the new system, benefits appeared to be marginal. This effect was the result of a measurement problem. How did we measure benefits? The team needed to compare the old process with the new one. We had to devise a mechanism that measured the effectiveness of the new system in terms of resource usage, availability of reliable and timely information, and project controls. Some of the things we looked at included:

• The ability to consolidate multiple project plans.
  
• The average time a major, outstanding issue remained opened.
• The extent to which team members and project managers maintained their own separate schedules.

Many of the parties involved in the project did not have a clear definition of productivity. For example, for team members paid by the hour, reducing the number of hours required to do a job was not an attractive option unless there were balancing considerations, such as competitive pressures. Only the owners of the company were clearly motivated to do more with less. However, the owners were not the main users of the system.

Scope creep: The oldest & quite promising :-(. Too many scope changes & non agility in project execution methodologies, this phenomenon occurs when the plan's scope to extend beyond its original objectives. Certainly, clients and supervisors will ask for changes to a plan - but a good PM will evaluate each request and decide how and if to implement it, while communicating the effects on budget and deadlines to all stakeholders.

Inadequate Skills: A plan sometimes requires skills that the plan's contributors don't possess. Training can help a leader determine the needed competencies, assess the available workers and recommend training, outsourcing or hiring additional staff.

Risk Management short comings : Learning to deal with and plan for risk is an essential piece of PM training. And risk tolerance is a desirable project manager trait - because plans rarely go exactly according to plan. Gathering input, developing trust and knowing which parts are most likely to veer off course are all aspects of the PM's job.

Ambiguous Contingency Plans: It's important for managers to know exactly what direction to take in pre-defined "what-if" scenarios. But if those contingencies are not identified, the entire project can become mired in an unexpected set of problems. Asking others to identify potential problem areas can lead to a much smoother and more successful project.

Lack of Accountability: A PM's leadership qualities really shine when each member of the team takes responsibility for his or her role in achieving success. Conversely, a lack of accountability can bring an activity to a complete halt. Finger-pointing and avoiding blame are unproductive - but all-too-common - features of flawed management. Learning to direct teams toward a common goal is an important aspect of training.

Unhealthy Communication: Managers provide direction at every step, so each team leader knows what's expected. Effective communication to everyone involved is crucial to its successful completion. The major task delegation happens thru this communication channels which can be daunting many times. Communication to clients / stakeholders or reporting can kill the best performers many times.

Resource Deprivation: To be run efficiently and effectively, management must provide sufficient resources - human, time and money. Training shows how to define needs and obtain approval up front, and helps project managers assign and prioritize resources throughout the duration.

Planning is key: Impossible deadlines can add many challenges than we can sort out. A strong leader - and successful project manager - knows that repeatedly asking a team for the impossible will result in declining morale and productivity. The odds of successfully completing a project under unreasonable deadlines are not very good.

Refusal to use the system : We underestimated the high level of commitment and loyalty that some users had to the tools and techniques that were already in place, a factor that was apparent when some legacy tools and techniques conflicted with the new system. It took a considerable amount of time to convince several individuals about the benefits of adopting our new Web-based project management framework.

In spite of all the training efforts and directions from upper management to utilize the system, a few team members refused to use it. There were several causes for this problem. First, the implementation was taking place in the middle of a project, and the team members did not have time to learn new tools. Second, the team could not visualize the benefits from using this new system and were not willing to invest the time and effort to learn it. Third, in the beginning, management mandated the use of tools but failed to follow up with enforcement. In addition, we had to refocus training on how to perform job functions using the system—nobody wanted to take time away from work to learn something that wasn't directly relevant to his or her job. The primary lesson we learned is to introduce the system to the participants before project planning begins, as it is much more difficult to switch to a new system than to begin with a new one.

End user resistance is a fact of life and should not come as a surprise to anybody involved in implementing a new system in an organization. No matter how good the new system is, most people have a built-in inertia that cannot be convinced by arguments alone. For example the existing system can reward people in ways that all users know, but are afraid to admit. They will point out seemingly irrelevant problems in the new system, because it lacks the "hidden" rewards of the current system. Another often overlooked fact is that many people simply cannot understand the value of a new system in abstract terms or concepts. They have to work with the system before they "understand" the added value. The people I have found to be most resilient to change are programmers. It is unbelievable how much energy you have to put into getting a programmer move away from their favorite toys and move on to something that is more in line with current developments. Many programmers are resilient into understanding that a system not only consists of automated processes, but also have manually processes that form the interface between the organization and the automated system. Regardless the fact that this is known for about 40 years most programmers simply ignore it and focus on technology alone ignoring the value of usability and end-user acceptance.

Lack of Stakeholder Engagement: A disinterested team member, client, CEO or vendor can destroy a project quickly. It's like having a distracted paddler in a two-person canoe - you might get to the finish line, but not efficiently or on time. And you'll waste a lot of energy in the process! A skilled PM communicates openly and encourages feedback at every step to create greater engagement among participants.

Critical success factors : I believe that success in the implementation of a Web-based project management system was due to the following factors:

• The appropriate selection of technologies, tools, and techniques to support the analysis, design, development, implementation, and maintenance of the tool
• Senior management support and commitment to the tool
• Extensive training that focused on task completion
• The organization’s readiness, willingness, and ability to work in a Web-based project management environment, including assessing/adapting the organization’s people, technology, work environment and culture, systems, and processes

I believe this is more than required for theory now let’s dwell more on how to implement this.

Web App Security Step by Step :Part II

Web / Application Security how to Step by Step :Part II

As we have discussed in the last Blog about web security identification & importance now we are taking a step further on implantation. First we need to understand the vulnerabilities from the network / networks & build a scanning process to review these vulnerabilities on periodic basis depending upon the criticality of the application , domain, system etc.

Step 1: identify, priorities and categorize web applications

With enterprise applications, you need to itemize all systems and categorize them before conducting security audits. Web application threats are no different – you must identify all web applications for testing and decide on their relative priority of importance for assessing remediation. Tools include automated scanners that do most of the work for you. The undeniable fact is that a machine can do some things efficiently than us humans in repetitive jobs.

Step 2: Scan everything for threats & vulnerabilities Scanning is an automated process that tests items for security as measured by a dynamic database of known vulnerabilities and likely exploits. A web application scanner includes simulated attacks against each web application. The object is to see if it breaks.

Step 3: Verify vulnerabilities against a register which also maintains a scenario log to check the impact factor like risk registers in project management This step helps to reduce false positives and false negatives, which can lead to inefficiencies in the VM process. False positives inhibit some scanning by drowning the scan results with vulnerabilities that don’t match what’s in your inventory of network and IT assets and web applications. Chasing down false positives is a waste of IT staff time and an inefficient way to do the management. Likewise, a false negative may occur when the scanner fails to detect a vulnerability that actually exists or we might miss an impending threat in the device or application. This failure to detect actual vulnerabilities may place your applications at serious risk of exploitation by hackers.

Step 4: Classify and rank risks: Fixing everything at once is practically impossible. In fact, in large organizations, the amount of vulnerability data can be huge & increasing as good proportion so if it’s not properly categorized, segmented, and prioritized in a meaningful fashion. This defines the most critical issues that could impact the most critical applications – all the way to items of lesser importance. In a nutshell, you need to decide what to fix first.

Step 5: Test all bug-fixing , updates and workarounds before integrating to the web site / application. Patches and workarounds are usually meant for insecure networks and systems, but they apply equally to web applications. If an application is vulnerable, it must be fixed. Updates, patches, fixes, and workarounds are usually administered by security and IT team members. Fixing actual code requires the work of programmers as guided by the in-house development team. Once a fix is devised, the team must thoroughly test it before re-deployment.

Step 6: Apply patches, fixes, and workarounds Here’s where the repairs are applied to vulnerable web applications and other assets.

Step 7: Rescan to verify patching After conducting steps for remediation, it’s useful to re-scan the web application to ensure it was fixed. This step verifies that the fix worked and that it doesn’t cause other applications, network devices, services, or other applications to be exposed to additional vulnerabilities.

Step 8: plan a audit cycle to understand the changed scenarios & priorities to be incorporated in these vulnerabilities management cycles. Simply using IT policy compliance products for continuous control monitoring of web applications, for example, doesn’t automatically make audit issues go away. But use the right tools under the right policy framework, stay consistent, and keep your reports, and you can greatly reduce the amount of money you spend every year in audit!

It goes without saying that specifications for a web application security scanner vary depending on the needs of each organization. Traditional considerations include whether you should go for an Open Source (‘free’) solution, or purchase a commercial scanner from an established software company. Another consideration is whether to run a software solution on your own infrastructure, or to rent its functionality with

Software-as-a-Service. Let's have more to say in next Part about the advantages of SaaS. Meanwhile, what else should you look for in a scanner? We answer this question in greater detail in Part III, where we also describe the practical ins and outs of using a web application scanner.

Web application scanners automate the manual techniques that hackers and security researchers alike employ against websites. They range from simple scripts that may simply search HTML content for useful information, to more complex tools that spider (that is, discover and crawl through) a

website and catalog its content for further manual analysis. The scanner acts like a hacker, albeit one less antagonistic towards the web application. As with any technology, it’s useful to consider what to look for in choosing the right web application security scanner.

Let’s ponder more what a web application security scanner should do for us. As per my thought process a minimum standard suggests that a web application security scanner should:

Must have :

1. Identify specified types of vulnerabilities in a web application.
2. Generate a text report indicating an attack for each identified vulnerability.
3. Identify false positive results at an acceptably low rate.

Good to have

1. Produce a report compatible with other tools.
2. Allow particular types of weaknesses to be suppressed by the user.
3. Use standard names for weakness classes.

The top priority for a scanner is helping you keep on top of the constantly changing universe of web application vulnerabilities. In particular, your scanner must be capable of identifying the top vulnerabilities such as cross-site scripting and SQL injection. Our scanner will provide more value if it incorporates standard industry resources for this information.

I am still compiling this day by day also got help from various comments by mail to understand specific pain areas in detail, please share your concerns or any threat I missed in this. You can write to me at ravindrapande@gmail.com