White Papers - Softtek

State-of-the-Art Software Security

Fri, 22 Feb 2013 00:00:00 +0000

Softtek Information Security Practice

Softtek's long tenure of experience has trained people on Information Security,
Application Security, Security Operations and Risk Management, and is responsible
for the security of several small, mid-size and large companies. This white paper
includes a Statistical Report, serving as the result of a large and continuous list of
assessments performed since 2005. The metrics and trends shared in this
document cover the last two annual periods – 2011 and 2012 – in order to maintain
up-to-date data and provide a baseline to predict future behavior in the market
regarding application security.

Understanding and Mitigating the Cloud’s Security Risks through Compliance, Best Practices and Security Testing

Wed, 01 Aug 2012 00:00:00 +0000

Christian Navarrete, Security Researcher

This whitepaper will provide an overview of the risks and threats that companies may face when considering a migration project to a Cloud environment, as well as serve as a guide for the practices that a new Cloud customer should follow in order to preserve the security of their data, infrastructure and applications.

Nearshore Goes Global - 2011 Revised Edition

Tue, 26 Apr 2011 00:00:00 +0000

Softtek

Nearshore 2.0 is the evolution of the Nearshore model to a true global delivery model that can provide networked resources, true risk diversification and transformational change

Mobile Application Security Challenges

Fri, 15 Apr 2011 00:00:00 +0000

Aldo Salas

Technology is not just a luxury in our daily lives; it has become a necessity. From new car models to cutting-edge cell phones, we see that each day we’re able to do more and more. It all started with making and receiving calls—the ability to communicate using your voice without a wire. But today’s cell phones are no longer considered just call-making devices; they are being referred to as smartphones due to their number of capabilities and features. And precisely those features are what have caught the attention of the bad guys. This white paper will discuss the main challenges every company faces when trying to deliver content to mobile users, i.e.: smartphones.

Reducing the Threat Landscape for In-house Applications by Applying Preventive Application Security

Wed, 24 Nov 2010 00:00:00 +0000

By Christian Navarrete, Security Research Analyst

Many software development organizations often let pass the security implications derived from software, and have not yet adopted a SDLC approach in theirdevelopment practices. As a result, they are creating products that contain any kindof vulnerabilities ready to be exploited. At the same time these companies execute a “reactive” approach, failing to address the detection and correction of security issues in an early development stage. We suggest implementing a procedure for optimizing network security by identifying objectives and vulnerabilities called threat modeling.

Measuring Progress in Application Security

Mon, 01 Feb 2010 00:00:00 +0000

By Leonel Navarro, Project Management Professional >> Six key conditions for metrics-driven programs

The most important goal of an application security (appsec) program is to secure the organization’s information assets, and maintain the security infrastructure breach-free. A successful program is hardly a one-time project, but rather an on-going effort that constantly provides education, guidance and tools. This document shares six conditions we have identified as essential for establishing a solid path that enables a metrics-driven application security program: 1) Understand the different types of threats; 2) Identify KPIs and define SMART metrics; 3) Establish a well-defined and measurable process; 4) Rate vulnerabilities within the appropriate context; 5) Create a vulnerability tracking system; 6) Make metrics visible to management.

Preparing a Strategy for Application Vulnerability Detection

Fri, 02 Oct 2009 12:00:00 +0000

By Juan Calderon >> Setting the basis to secure critical information assets

Having the overall picture of the company’s information assets exposure is vital for Information Security Officers, since it allows them to make the right decisions regarding where the fixing efforts should be spent. This white paper will share some key tactics that can help answer questions like: Where should application security testing start?, Which applications are most critical to the company?, What kind of testing method should be used?, What tool is best for the job? And, what verification requirements should be considered for the application security policy?

Conservative-progressive approach to outsourcing delivery models: Four levers to adjust and maximize value

Thu, 01 Oct 2009 12:00:00 +0000

By Alex Camino with Federico Ferreres >> Part 2 of 3 of the white paper series “Proven Strategies for Cost Containment and Risk-balancing in Turbulent Times”

As risk mitigation and cost containment take a new dimension in today’s environment, organizations are rapidly assessing the status of their global outsourcing portfolio, finding creative ways to be as conservative as possible with regards to risk management, and as progressive as they can be in terms of cost containment.

As the second part of the series, this paper’s focus is on identifying the value of the existing delivery model, and to highlight the benefits that different approaches may bring.

We’ll explore how organizations that carefully assess the existing and alternative pricing models, that balance the amount of work that is done on-site vs. offshore, and actively monitor how much of the project portfolio is concentrated in a single vendor or country, have been able to maximize the value of their service outsourcing projects.

Achieving Operational Rhythm in Source-to-Pay Outsourcing

Fri, 01 May 2009 00:00:00 +0000

By Federico Ferreres and Pedro Parra >> Best practices for ‘measuring up’ to business needs

Many companies are considering outsourcing parts of their source-to-pay (S2P) operations as a way to curtail costs, gain operational efficiencies and to enable focus on strategic restructuring of the sourcing function. Although market penetration is still relatively small, the services are poised to grow at a fast pace during the next five years. In this white paper, we highlight several best practices that have helped our clients achieve highly efficient procurement operations within relatively short time periods. Building upon these practices helps in achieving operational rhythm, a seamless and metric-driven integration between the outsourcing organization and its customer.

The Rise of the Conservative-Progressive Approach to Outsourcing: Establishing Solid Foundations for a Global Sourcing Program

Fri, 01 May 2009 00:00:00 +0000

By Alejandro Camino with Federico Ferreres >> Part 1 of 3 of the white paper series “Proven Strategies for Cost Containment and Risk-balancing in Turbulent Times”

As risk mitigation and cost containment take a new dimension in today’s turbulent environment, organizations are pressured to rapidly assess the status of their global outsourcing portfolio, and to find creative ways to balance risk mitigation and cost containment. One way to speed up the learning process, and reach destination safely, is to look at those that have already traveled the road. And as this learning process matures, it marks the definitive rise to the era of the conservative-progressive approach to global outsourcing.

A Guide to Outsourcing the Source-to-Pay Function

Mon, 03 Nov 2008 00:00:00 +0000

By: Mary Ellen Mitchell with Alejandro Camino and Pedro Parra >> Critical Elements for a Successful Transition

Challenging economic times will push companies and their management to find new ways to streamline operations and curtail costs. Initiatives to outsource non-core functions and streamline the supply-chain have been on the rise in recent times. Among these measures is offshore outsourcing of the purchase order (PO) processing function. Although its popularity has been lagging behind other BPO offerings, we foresee companies increasingly embracing source-to-pay (s2p) offshoring. As pressures to rapidly implement these engagements grow, so does the possibility of failure due to unsuccessfully transitioning in-house managed processes to outsourced engagements.

Mind the Offshore Gap

Thu, 01 May 2008 00:00:00 +0000

By Softtek >> Finding a Balance for Outsourcing Strategies

Leading companies are embracing a new generation of global outsourcing, one that involves a multisourced approach with different providers from various locations, as well as a combination of models including offshore, onshore and nearshore. This white paper addresses the emerging shift and outlines why it’s necessary to close the gap left by single-country outsourcing strategies. The gap is characterized by the need to diversify risk, increase interaction among the stakeholders, access multilingual professionals, and lower the total cost of engagement.

Results-driven application services outsourcing - Part one

Mon, 03 Mar 2008 00:00:00 +0000

By Softtek >> Making the case to evolve from timesheets to deliverables

While the option of choice of most hiring managers is still that of time and materials, there is a trend to opt for a more strategic and disciplined approach for application services outsourcing, one that involves paying for deliverables or outcomes rather than man-hours. This document describes and compares different application maintenance and support (AMS) engagement models, identifies what each model has to offer in terms of value to the organization, and highlights the barriers organizations face to evolve beyond staff augmentation. A companion white paper provides a blueprint for overcoming the obstacles and enable change.

Results-driven application services outsourcing - Part two

Mon, 03 Mar 2008 00:00:00 +0000

By Softtek >> A blueprint to evolve beyond staff augmentation

While the option of choice of most hiring managers is still that of time and materials, there is a trend for a more strategic and disciplined approach for application services outsourcing, one that involves paying for deliverables or outcomes rather than man-hours. This white paper highlights different actions that hiring organizations and vendors alike can take to evolve their application outsourcing models beyond staff augmentation. We identify the critical success factors and a viable scenario and a transition roadmap for buyers interested in results-driven application services outsourcing.

Nearshore goes Global

Thu, 01 Mar 2007 00:00:00 +0000

by Softtek

Over the last two decades we have seen the offshore outsourcing market evolving from offering cost savings to serving as an enabler for business competitiveness, transformation and growth. We have also witnessed how sophisticated buyers are looking for a new generation of global outsourcing services that aim for operational effectiveness, high collaboration, risk mitigation and innovation. Our role at Softtek has been to proactively participate with our clients in this progression and transform the nearshore model accordingly. This document delineates our vision for the next wave, which we have codenamed Nearshore 2.0.

Total Cost of Engagement

Tue, 01 Mar 2005 12:00:00 +0000

By Softtek >> The unique value of Nearshore as an enabler for lower cost of offshore outsourcing

The whole concept of Offshore Outsourcing is created around the idea that cost efficiencies can be attained by shifting work from a high cost to lower cost locations.

Although it is a fact that man/hour rates are a fundamental driver to reduce costs, offshore savings should not be determined only by the man/hour rate differentials. A holistic view of expenditure measurement should be considered.

TCE or Total Cost of Engagement is an approach that evaluates the total expenditures of offshore engagements.

Despite the maturity level reached by the offshore outsourcing programs in many Fortune 500 corporations, the model cannot be leveraged at its full potential. There is still an important amount of work that is done at the client's site, thus increasing the TCE. The reason is the fact that time-zone differences and distance with India, and other Asian outsourcing destinations is a barrier.

Although nearshore rates tend to be higher, the overall cost of nearshore engagements is equivalent or less than offshore, because of the efficiency gains that working in close proximity to the US and in the same time zones can bring. The nearshore model is much more efficient in achieving higher percentages of work performed at a lower cost location than offshore.

Mexico as a Nearshore Destination

Tue, 01 Mar 2005 11:00:00 +0000

By Softtek >> Advantages for the IT Global Outsourcing Market for North America

As part of its March 2003 report "Mexican Nearshore Outsourcing: A Promising Global Sourcing Alternative", Forrester Research published "Companies interested in the cost and quality benefits of offshore labor, but which require a closer, less risky solution should strongly consider Mexico as an important nearshore option".

Two years since that report was published, Mexico presents itself with a unique value proposition for US corporations that is based on convenience, lower risk and an unbeatable Total Cost per Engagement. Outsourcing companies based in Mexico, like Softtek, comply with the highest standards in terms of security, quality and dependability.

When talking about Global Outsourcing, Mexico, with its nearshore approach, is positioned in a completely different playing field for global outsourcing. Mexico based companies set aside from the plethora of India based vendors, followed by newcomers from China and Russia.

Mexico's nearshore value proposition is based on world-class services, low risk outsourcing, convenience and cost effectiveness.