# Infosys Whitepaper
Title: Need of a Test Maturity Model
Author: Infosys Limited
Format: PDF 1.7

---

  Page: 1 / 8

---

 PERSPECTIVE NEED FOR A COMPREHENSIVE TEST  MATURITY MODEL - Reghunath Balaraman, Harish Krishnankutty Abstract Constant change and ever growing complexity of business  has necessitated that IT organizations and specifically Test/QA  organizations make thorough and periodic introspection of their  processes and delivery capabilities. This is necessary to ensure that  at all possible times the Test/QA organization, and its systems and  processes, are relevant and available to support business needs.  While there are multiple maturity models in the marketplace to help  this process, there are yet not comprehensive enough and fail to  provide today’s dynamic businesses the much needed flexibility and  power of customization. The need of the hour is a comprehensive  Test/QA maturity assessment model, which not only answers the  requirements of customization and flexibility, but also ensures  relevance in today’s complex delivery structures of multi-vendor  scenarios, multi-location engagements, global delivery models, etc.<|endoftext|>

---

  Page: 2 / 8

---

 and revolutionary technology trends  have changed the role of IT organizations  in supporting business growth. Though  the recession created a scarcity of capital  for IT investments, the demands and  expectations on the ability of IT to quickly  adapt and support business, has only  increased multifold. In addition, rapid/ revolutionary changes in technologies are  forcing companies to recast their entire IT  landscape. All these factors together have  created a complex environment where the  demand for change from the business is  high, the capital for investment is scarce  and time-to-market is critical to success.  The constant change and ever growing  complexity of the business environment,  and the risks associated, have necessitated  that organizations make thorough and  periodic introspection of their processes  and delivery capabilities to ensure  operation in an efficient, effective and  agile manner. A key requirement, amongst  all, is the ability to ensure that there are  adequate controls in place to ensure  quality in the processes and the outcomes,  no matter the extent of change being  introduced in business or technology  landscape of the organization.  This is where the Test/QA organization’s  capability comes under the scanner. An  organization’s ability to assure and control  quality of its IT systems and processes  largely determines the success or failure  of the business in capturing, servicing and  expanding its client base. When Quality  and reliability play a very significant role  in determining the current and future  course of business outcomes delivered, it  is imperative that the Quality Assurance  function itself is evaluated periodically  for the relevance, effectiveness and  efficiency of the processes, practices and  systems. An objective self-introspection  is the ideal first step. However, most often  than not, QA organizations fall short of  using this process to unearth gaps in their  current systems and practices. Also, many  organizations may have lost touch with the  ever-evolving world of QA to be aware of  the leading practices and systems available  today. This necessitates an independent  assessment of the organization’s QA  practices to benchmark it against the  practices prevalent in the industry and  to get that all-important question “where  do we stand in comparison with Industry  standards?” answered. Also, the assessment  of maturity in testing processes becomes  critical in laying out the blue-print for a QA/ testing transformation program that would  establish the function as a fit-for-purpose  one, and often world-leading.  The global  economic crisis External Document © 2018 Infosys Limited

---

  Page: 3 / 8

---

 Limitations of traditional approaches to Test/QA Maturity Assessment There are several models, proprietary  and others, available for assessing the  maturity of the IT processes and systems,  including quality assurance. Most of  these are developed and promoted as  models helping an organization to certify  capabilities in one or more areas of the  software development lifecycle. Like all  other models and frameworks that lead to  certification, these maturity models too  have a fixed framework for an organization  to operate within, and provide very little  flexibility to address specific assessment  needs. Further, these models fail to help  organizations assess overall process  maturity due to the following limitations: Inability to accommodate and  account for heterogeneous  delivery structures Over the last decade or so, most  organizations have evolved into a  heterogeneous composition of internal  staff and service providers, delivering  services through global delivery models  with diverse talent, disparate processes,  etc. All this has made assessing an  organization’s process maturity increasingly  difficult. The existing maturity models in  the marketplace are not flexible enough  to accommodate for these complex  delivery structures created through  multi-vendor scenarios, multi-location  engagements focusing on selective parts  of the software development lifecycle,  etc. This significantly reduces the overall  effectiveness of the output provided  by the existing maturity model and its  applicability to the client situation.<|endoftext|>Focused on comprehensive  certification rather than required  capabilities Most conventional models are “certification  focused” and can help organizations in  assessing their IT process capabilities and  getting certified. They are exhaustive in  the coverage of process areas and answer  the question, “how comprehensive are  the processes and practices to service a  diverse sets of users of the QA services?”.  Such a certification is often a much  needed qualification for IT service provider  organizations to highlight their process  capability and maturity to diverse clients  and prospects. However, most non-IT  businesses maintain IT divisions to support  their business and are more interested  in selectively developing the required  capabilities of their respective IT groups,  leading to efficient business processes and  better business outcomes. Hence  1 External Document © 2018 Infosys Limited

---

  Page: 4 / 8

---

 the focus of maturity assessments in  these organizations is not certification,  but the ability to deliver specific business  outcomes. Since the traditional assessment  models are often certification-focused,  most non-IT businesses find it an  overhead to go through an exhaustive  assessment process that does not help  them answer the question, “how effective  are my organization’s QA processes and  practices to ensure quality of my business  outcomes? Staged Vs Continuous model for  growth in maturity Majority of certification models follow  a staged approach, which means that  the organization has to satisfy all the  requirements of a particular level and get  certified in the same, before becoming  eligible for progress to the next level.  But, most organizations are selective in  their focus and want to develop those  areas that are relevant and necessary to  their business, rather than meeting all  the requirements just to get certified at  a particular level. Because of the staged  approach to certification, such maturity  models do not present organizations  with a good view of where their current  capabilities stand with respect to what is  needed by the organization.<|endoftext|>Lack of focus on QA The existing maturity models primarily  focus on software development, and  treat testing as a phase in the Software  Development Lifecycle. However, today,  testing has evolved as a mature and  specialized discipline in the software  industry and hence the ability of the  traditional models to assess the QA/testing  processes and practices to the required  level of detail is very limited. They fall  short of organizations that have realized  the need/ importance for an independent  testing team and want to manage the  QA maturity mapping process as an  independent entity. Hence, the various  dimensions of the test organization should  be given adequate focus in the maturity  assessment approach covering the Process,  People and Technology aspects of testing.<|endoftext|>External Document © 2018 Infosys Limited

---

  Page: 5 / 8

---

 A comprehensive model to assessing an organization’s test capabilities and the ability to handle transformational  programs Now that we have looked at the  shortcomings of the traditional models of  QA assessment, it is time to answer that  all-important question, “what should a  comprehensive model for assessing QA/ Test maturity be like?”. The key attributes  of a comprehensive QA/Test assessment  framework/model can be summed up as  follows: Provide business-comprehensible  decision-aiding results The model should allow for selective  assessment of the relevant parameters for  maturity, in the context of business. The  results of the assessment should help the  business identify and plot the possibility of  immaturity in their systems and processes,  using lead indicators that have a negative  impact on the business. These indicators  should help the senior management  to decide whether to go for a detailed  assessment of maturity, before any adverse  effect on business is felt.  Choice of business-relevant factors  and focus areas The model should be flexible enough to  provide the right level of focus on the  various factors, business deems relevant,  that contribute to the overall maturity  index. For example, an organization  which depends on one or a set of service  providers for their key


Continue # Infosys Whitepaper
 IT services may  want strong governance and gating  mechanisms. While, another organization  that does testing in-house, and leverages  vendors for development, will have a much  wider focus on maturity in processes and  practices. Basically, the model should  be flexible enough to account for the  intent of assessment, as outlined by the  organization.<|endoftext|>Detailed and comprehensive view  of areas of improvement and  strengths The model should also be one that helps  determine the maturity of the testing  organization in a detailed manner. The  methods and the systems of the model  should provide a robust mechanism of  objectively calculating the maturity level  of the testing organization, based on the  behaviors exhibited by the organization.  It should provide the members of the  QA organization with a detailed view of  the areas of strength (and hence to be  retained) and the areas of improvement.  The model should enable the testing  organization to understand the measures  that should be implemented at the  granular level, rather than at a high-level  and thereby help the organization to focus  on their key QA dimensions,  2 External Document © 2018 Infosys Limited

---

  Page: 6 / 8

---

 and strengthen the maturity of these  dimensions.<|endoftext|>A frame of reference for  improvement initiatives The comprehensive maturity model should  provide the organization with a roadmap  to move its QA/Testing processes and  practices to a higher level of maturity and  effectiveness. It should provide a reference  framework for selective improvement of  capabilities, keeping in mind the business  context and organizational objectives.  This will help the organization design a  roadmap for improvement and devise ways  to implement the same effectively.<|endoftext|>Conclusion So, in order to meet the needs of a  dynamic business environment and  rapidly evolving technology space, IT  organizations need to respond quickly  and efficiently with high-quality, high- reliability and cost-effective processes  and systems. This calls for a robust and  scalable QA organization that can guard  and ensure the quality of solutions that  are put into operation, and assess itself on  its capabilities and maturity, periodically  to ensure business-relevance and  effectiveness.<|endoftext|>Hence a comprehensive QA maturity  model, which assists organizations in  this assessment, should move away from  certification-based models with “generic”  and “hard-to-customize” stages, to a  model that is adaptable to the context in  which business operates. It needs to be a  model that evaluates factors that influence  maturity and quality of processes at a  detailed level and helps the organization to  embed quality and maturity in processes,  governance and development of key  competencies. This would help ensure  the maturity of operations and promote  continuous improvement and innovation  throughout the organization.<|endoftext|>3 External Document © 2018 Infosys Limited

---

  Page: 7 / 8

---

 About the
Authors Reghunath Balaraman  (Reghunath_Balaraman@infosys.com)  Reghunath Balaraman is a Principal Consultant, and has over 16 years of experience. A post graduate in Engineering and Management, he  has been working closely with several large organizations to assess the maturity of their test and QA organizations and to help them build  mature and scalable QA organizations. Raghunath is also well versed with several industry models for assessing maturity of software testing.<|endoftext|>Harish Krishnankutty (Harish_T@infosys.com) Harish Krishnankutty is a Industry Principal in Infosys’ Independent Validation Solutions unit and has over 14 years of experience in the IT  industry. His area of specialization is QA consulting and program management and has extensive expertise in the design and implementation  of Testing Centers of Excellence/ Managed QA services. Currently, he focuses on the development of tools, IP and services in different areas of  specialized testing, including Test Automation, SOA Testing, Security Testing, User Experience Testing, Data Warehouse Testing and Test Data  Management.<|endoftext|>External Document © 2018 Infosys Limited

---

  Page: 8 / 8

---

 © 2018 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com Infosys.com | NYSE: INFY Stay Connected

***


# Infosys Whitepaper
Title: DAST Automation for Secure, Swift DevSecOps Cloud Releases
Author: Infosys Limited
Format: PDF 1.7

---

  Page: 1 / 8

---

 Abstract DevSecOps adoption in the cloud goes well beyond merely managing continuous  integration and continuous deployment (CI/CD) cycles. Its primary focus is security  automation. This white paper examines the barriers organizations face when  they begin their DevSecOps journey, and beyond. It highlights one of the crucial  stages of security testing known as Dynamic Application Security Testing (DAST). It  explores the challenges and advantages of effectively integrating DAST into the CI/ CD pipeline, on-premises and in the cloud. The paper delineates the best practices  for DAST tool selection and chain set-up, which assist in shift-left testing and cloud  security workflows that offer efficient security validation of deployments with risk- based prompt responses.<|endoftext|>DAST AUTOMATION FOR SECURE,  SWIFT DEVSECOPS CLOUD RELEASES WHITE PAPER

---

  Page: 2 / 8

---

  Traditional security practices involve security personnel running  tests, reviewing findings, and providing developers with  recommendations for modifications. This process, including  threat modeling, conducting compliance checks, and carrying out  architectural risk analysis and management, is time-consuming and  incongruous with the speed of DevOps. Some of these practices  are challenging to automate, leading to a security and DevOps  imbalance. To overcome these challenges, many organizations have  shifted to an agile DevOps delivery model. However, this exerts  significant pressure on DevOps to achieve speed with security as  part of the CI/CD pipeline. As a result, release timelines and quality  have been impacted due to the absence of important security  checks or the deployment of vulnerable code under time pressure.<|endoftext|>Even as DevOps was evolving, the industry concurrently fast- tracked its cloud transformation roadmap. Most organizations  shifted their focus to delivering highly scalable applications built  on customized modern architectures with 24/7 digital services.  These applications include a wide-ranging stack of advanced tiers,  technologies, and microservices, backed by leading cloud platforms  such as AWS, GCP, and Azure.  Despite the accelerated digital transformations, a large number of  organizations continue to harbor concerns about security. The year- end cybercrime statistics provide good reason to do so: 1. The global average cost of a data breach is an estimated US  $4.35 million, as per IBM’s 2022 data breach report1 2. Cybercrime cost the world US $7 trillion in 2022 and is set to  reach US $10.5 trillion by 2025, according to Cybersecurity  Ventures2 Evidently, security is an important consideration in cloud migration  planning. Speed and agility are imperatives while introducing  security to DevOps processes. Integrating automated security  checks directly into the CI/CD pipeline enables DevOps to evolve  into DevSecOps.  DevSecOps is a flexible collaboration between development,  security, and IT operations. It integrates security principles and  practices into the DevOps life cycle to accelerate application  releases securely and confidently. Moreover, it adds value to  business by reducing cost, improving the scope for innovation,  speeding recovery, and implementing security by design. Studies  project DevSecOps to reach a market size of between US $20 billion  to US $40 billion by the end of 2030.<|endoftext|>Background

---

  Page: 3 / 8

---

  As enterprises race to get on the DevSecOps bandwagon, IT teams  continue to experience issues:  • 60% find DevSecOps technically challenging 3 • 38% report a lack of education and adequate skills around  DevSecOps 3 • 94% of security and 93% of development teams report an impact  from talent shortage 1 Some of the typical challenges that IT teams face when integrating  security into DevOps on-premise or in the cloud are:  People/culture challenges:  • Lack of awareness among developers on secure coding practices  and processes  • Want of collaboration and cohesive skillful teams with  development, operations, and security experts Process challenges: • Security and compliance remain postscript • Inability to fully automate traditional manual security practices to  integrate into DevSecOps • Continuous security assessments without manual intervention Tools/technology challenges: • Tool selection, complexity, and integration problems • Configuration management issues • Prolonged code scanning and consumption of resources                                                           DevSecOps implementation challenges Focusing on each phase of the modern software development life cycle (SDLC) can help strategically resolve DevSecOps implementation  challenges arising from people, processes, and technology. Integrating different types of security testing for each stage can help overcome  the issues more effectively (Figure 1).  Figure 1: Modern SDLC with DevSecOps and Types of Security Testing Solution PLAN Requirements CODE Code Repository BUILD CI Server TEST Integration  Testing RELEASE Artifact  Repository DEPLOY CD Orchestration OPERATE Monitor Threat  Modelling Software  Composition  Analysis and Secret  Management Secure Code  Analysis and Docker  Linting Dynamic  Application  Security Testing Network  Vulnerability  Assessments System/Cloud  Hardening Cloud  Configuration  Reviews

---

  Page: 4 / 8

---

  What is DAST? DAST is the technique of identifying the vulnerabilities and touchpoints of an application while it is running. DAST is easy even for beginners  to get started on without in-depth coding experience. However, DAST requires a subject matter expert (SME) in the area of security to  configure and set up the tool. An SME with good spidering techniques can build rules and configure the correct filters to ensure better  coverage, improve the effectiveness of the DAST scan, and reduce false positives.<|endoftext|>Best practices to integrate DAST with CI/CD The last few years have shown that next-generation CX requires heavy doses of perseverance and attitudinal focus. At Infosys, we have  extended this to the way we deliver projects by relying on a few key cultural principles: Besides adopting best practices, the CI/CD environment needs to be test-ready. A basic test set-up includes: There can be several alternatives to the set-up based on the toolset selection. The following diagram depicts a sample (see Figure 2).<|endoftext|>Figure 2: DevSecOps Lab Set-up • Integrate DAST scan in the CI/CD production pipeline after  provisioning the essential compute resources, knowing that  the scan will take under 15 minutes to complete. If not, create a  separate pipeline in a non-production environment • Create separate jobs for each test in the case of large  applications. E.g., SQL injection and XSS, among others  • Consider onboarding an SME with expertise in spidering  techniques, as the value created through scans is directly  proportional to the skills exhibited • Roll out security tools in phases based on usage, from elementary  to advanced • Fail builds that report critical or high-severity issues • Save time building test scripts from scratch by leveraging existing  scripts from the functional automation team • Provide links to knowledge pages in the scan outputs for  additional assistance • Pick tools that provide APIs • Keep the framework simple and modular • Control the scope and false positives locally instead of  maintaining a central database • Adopt the everything-as-a-code strategy as it is easy to maintain Developer machine for  testing locally Code repository  for version  controlling CI/CD server  for integrations  and running tests with the  help of slave/runner Staging  environment

---

  Page: 5 / 8

---

   Right tool selection With its heavy reliance on tools, DevSecOps enables the  automation of engineering processes, such as making security  testing repeatable, increasing testing speed, and providing early  qualitative feedback on application security. Therefore, selecting  the appropriate security testing tools for specific types of security  testing and applying the correct configuration in the CI/CD pipeline  is critical.<|endoftext|>Challenges in tool selection and best practices  Common pitfalls • Lack of standards in tool selection • Security issues from tool complexity and integration • Inadequate training, skills, and documentation • Configuration challenges Best practices in tool selection • Expert coverage of tool standards • Essential documentation and security support  • Potential for optimal tool performance, including language  coverage, open source or commercial options, the ability to  ignore issues, incident severity categories, failure on issues, and  results reporting feature • Cloud technology support • Availability of customization and integration capabilities with       other tools in the toolchain • Continuous vulnerability assessment capability Best practices in tool implementation •  Create an enhanced set of customized rules for tools to ensure  optimum scans, and reliable outcomes •  Plan incremental scans to reduce the overall time taken •  Use artificial intelligence (AI) capabilities to optimize the analysis  of vulnerabilities reported by tools •  Aim for zero-touch automation •  Consider built-in quality through automated gating of the build  against the desired security standards After selecting the CI/CD and DAST tools, the next step is to


Continue # Infosys Whitepaper
 set  up a pre-production or staging environment and deploy the web  application. The set-up enables DAST to run in the CI/CD pipeline as  a part of integration testing. Let us consider an example using the  widely available open-source DAST tool, Zed Attack Proxy (ZAP).  Some of the key considerations for integrating DAST in the CI/CD  pipeline using ZAP (see Figure 3) are listed below: •  Test on the developer machine before moving the code to the  CI/CD server and the Gitlab CI/CD •  Set up the CI/CD server and Gitlab. Ensure ZAP container  readiness with Selenium on Firefox, along with custom scripts  •  Reuse the functional automation scripts, only modifying them  for security testing use cases and data requirements •  Push all the custom scripts to the Git server and pull the latest  code. Run the pipeline after meeting all prerequisites

---

  Page: 6 / 8

---

  Some of the key considerations for integrating DAST in the CI/CD pipeline using ZAP (see Figure 3) are listed below: •  Test on the developer machine before moving the code to the CI/CD server and the Gitlab CI/CD •  Set up the CI/CD server and Gitlab. Ensure ZAP container readiness with Selenium on Firefox, along with custom scripts  •  Reuse the functional automation scripts, only modifying them for security testing use cases and data requirements •  Push all the custom scripts to the Git server and pull the latest code. Run the pipeline after meeting all prerequisites

---

  Page: 7 / 8

---

  DevSecOps with DAST in the cloud Integrating DAST with cloud CI/CD requires a different approach.  Approach: •  Identify, leverage, and integrate cloud-native CI/CD services, continuous logging and monitoring services, auditing, and governance     services, as well as operation services with regular CI/CD tools – mainly DAST •  Control all CI/CD jobs with server and slave architecture by using containers, such as Docker, to build and deploy applications as cloud     orchestration tools.<|endoftext|>An effective DAST DevSecOps in cloud architecture appears as shown in Figure 4: Best practices •  Control access to pipeline resources     using identity and access management     (IAM) roles and security policies  •  Encrypt data at transit and rest always •  Store sensitive information, such as     API tokens and passwords, in the      Secrets Manager  Key steps 1. The user commits the code to a code repository 2. The tool builds artifacts and uploads them to the artifact library 3. Integrated tools help perform the SCA and SAST tests 4. Reports of critical/high-failure vulnerabilities from the SCA and  SAST scans go to the security dashboard for fixing 5. Code deployment to the staging environment takes place if  reports indicate “no or ignore vulnerabilities” 6. Successful deployment triggers a DAST tool, such as the OWASP  ZAP, for scanning  7. User repeats steps 4 to 6 in the event of a vulnerability  detection  8. If no vulnerabilities are reported, the workflow triggers an  approval email.<|endoftext|>9. Receipt of approval schedules automatic deployment to  production Figure 4: DAST DevSecOps in Cloud Workflow

---

  Page: 8 / 8

---

 © 2023 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com  Infosys.com | NYSE: INFY Stay Connected About the authors Kedar J Mankar Kedar J Mankar is an Infosys global delivery  lead for Cyber Security testing with Infosys.  He has extensive experience across  different software testing types. He has  led large size delivery and transformation  programs for global Fortune 500 customers  and delivered value through different COEs  with innovation at core. He has experience  working and handling teams in functional,  data, automation, DevOps, performance  and security testing across multiple  geographies and verticals.<|endoftext|>Amlan Sahoo  Amlan Sahoo has an overall 27+ years in IT  industry in application development and  testing. He is currently the head of Cyber  Security testing division. He has a proven  track record in managing and leading  transformation programs with large  teams for Fortune 50 clients, managing  deliveries across multiple geographies and  verticals. He also has 4 IEEE and 1 IASTED  publications to his credit on bringing  efficiencies in heterogeneous software  architectures.<|endoftext|>Vamsi Kishore  Vamsi Kishore Sukla is a Security  consultant with over 8 years of professional  experience in the security field, specializing  in application security testing, cloud  security testing, network vulnerability  assessments following OWASP standards  and CIS benchmarks. With a deep  understanding of the latest security trends  and tools, he provides comprehensive  security solutions to ensure the safety and  integrity of organization and clients.<|endoftext|>Conclusion DevOps is becoming a reality much faster than we anticipate. However, there should  be no compromise on security testing to avoid delayed deployments and the risk  of releasing software with security vulnerabilities. Successful DevSecOps requires  integrating security at every stage of DevOps, enabling DevOps teams on security  characteristics, enhancing the partnership between DevOps teams and security  SMEs, automating security testing to the extent possible, and shift-left security  for early feedback. By leveraging the best practices recommended in this paper,  organizations can achieve a more secure and faster release by as much as 15%, both  on-premises and in the cloud.<|endoftext|>References 1. https://www.cobalt.io/blog/cybersecurity-statistics-2023 2. https://cybersecurityventures.com/boardroom-cybersecurity-report/ 3. https://strongdm.com/blog/devsecops-statistics

***


# Infosys Whitepaper
Title: Data Archival Testing
Author: Infosys Limited
Format: PDF 1.7

---

  Page: 1 / 4

---

 WHITE PAPER DATA ARCHIVAL TESTING Abstract Today, there is an exponential rise in the amount of data being  generated by organizations. This explosion of data increases IT  infrastructure needs and has an immense impact on some important  business decisions that are dependent on proficient data analytics.  These challenges have made data archival extremely important from  a data management perspective. Data archival testing is becoming  increasingly important for businesses as it helps address these  challenges, validate the accuracy and quality of archived data and  improve the performance of related applications.  The paper is aimed at helping readers better understand the space  of data archival testing, its implementation and the associated  benefits.<|endoftext|>

---

  Page: 2 / 4

---

 Introduction One of the most important aspects of managing a business today is managing its data growth. On a daily basis, the  cost of data management outpaces the data storage costs for most organizations. Operational analytics and business  intelligence reporting usually require active operational data.  Data that does not have any current requirement or usage,  known as inactive data, can be archived to a safe and secure storage. Data archiving becomes important for companies  who want to manage their data growth, without compromising on the quality of data that resides in their production  systems.<|endoftext|>Many CIOs and CTOs are reworking on their data retention policies and their data archival and data retrieval strategies  because of an increased demand for data storage, reduced application performance and the need to be compliant with  the ever changing legislations and regulations.1 Data Archival Testing – Test Planning  Data Archival is the process of moving  data that is not required for operational,  analytical or reporting purposes to offline  storage. A data retrieval mechanism is  developed to restore data from the offline  storage.<|endoftext|>The common challenges faced during  data archival are:  • Inaccurate or irrelevant data in data  archives • Difficulty in the data retrieval  process from the data archives Data archival testing helps address these  challenges. While devising the data  archival test plan, the following factors  need to be taken into consideration: Data Dependencies There are many intricate data  dependencies in an enterprise’s  architecture. The data which is archived  should include the complete business  objects along with metadata, that  helps retain the referential integrity  of data across related tables and  applications. Data archival testing  needs to validate that all related  data is archived together for easy  interpretation, during storage and  retrieval.  Data Encoding The encoding of data in the archival  database depends on the underlying  hardware for certain types of data. To  illustrate, data archival testing needs to  ensure that the encoding of numerical  fields such as integers also archives  the related hardware information, for  easier future data retrieval and display  of data with a different set of hardware.<|endoftext|>Data Retrieval Data needs to be retrieved from  archives for regulatory, legal and  business needs. The validation of the  data retrieval process ensures that  the archived data is easily accessed,  retrieved and displayed in a format  which can be clearly interpreted  without any time consuming manual  intervention.<|endoftext|>Data Archival Testing – Implementation  The data archival testing process includes  validating processes which encompass  data archival, data deletion and data  retrieval.  Figure 1 below describes the different  stages of a data archival testing process,  the business drivers, the different types of  data that can be archived and the various  offline storage modes.  Figure 1: The Data Archival Testing Process External Document © 2018 Infosys Limited

---

  Page: 3 / 4

---

 Test the Data Archival  process  1 • Testing the Data Archival process  ensures that business entities that  are archived includes master data,  transaction data, meta data and  reference data • Validates the storage mechanism  and that the archived data is stored  in the correct format. The data  also has to be tested for hardware  independence Test the Data Deletion  process 2 • Inactive data needs to be archived  and moved to a secure storage for  retrieval at a later point and then  deleted from all active applications  using it. This validation process  would verify that that the test data  deletion process has not caused any  error to any existing applications  and dashboards • When archived data is deleted from  systems, verify that the applications  and reports are conforming to their  performance requirements Test the Data Retrieval  process 3 • Data that has been archived needs  to be easily identified and accessible  in case of any legal or business  needs • For scenarios that involve urgent  data retrievals, processes for the  same need to be validated within a  defined time period Benefits of Data Archival Testing The benefits of data archival testing are often interrelated and have a significant impact on the IT infrastructure costs for a business. Some of  the benefits are: Accomplishing all these benefits determine the success of a data archival test strategy.<|endoftext|>Reduced storage costs Improved application  performance Minimize business   outages Data Compliance Only the data that is relevant gets archived and for a defined time period which reduces  hardware costs and its maintenance costs significantly.<|endoftext|>Data is retrieved faster; the network performs better as only relevant data is present in  the production environment. All these factors enhance application performance.<|endoftext|>Archived data that is deleted from production systems does not have an impact on  the related applications’ performance and functionality, leading to smooth business  operations.<|endoftext|>Easy retrieval and availability of archived data ensures higher data compliance with the  legal and regulatory requirements.<|endoftext|>Conclusion Due to the critical business needs for data retention, regulatory and compliance requirements and a cost effective way to access  archived data, many businesses have started realizing and adopting data archival testing. Therefore an organization’s comprehensive  test strategy needs to include a data archival test strategy which facilitates smooth business operations, ensures fulfillment of all data  requirements, maintains data quality and reduces infrastructure costs.<|endoftext|>External Document © 2018 Infosys Limited

---

  Page: 4 / 4

---

 About the
Author Naju D. Mohan  Naju is a Group Project Manager with Infosys with about 15 years of IT experience. She is currently managing specialized testing services like  SOA testing, Data Warehouse testing and Test Data Management for many leading clients in the retail sector.<|endoftext|>REFERENCES  1. ‘Data overload puts UK retail sector under pressure’, Continuity Central, February 2009  2. ‘ Data Archiving, Purging and Retrieval Methods for Enterprises’, Database Journal, January 2011 © 2018 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com Infosys.com | NYSE: INFY Stay Connected

***


# Infosys POV
Title: Data Imperatives in IT MA&D in Life Sciences Industry
Author: Infosys Consulting
Format: PDF 1.7

---

  Page: 1 / 10

---

 An Infosys Consulting Perspective Consulting@Infosys.com | InfosysConsultingInsights.com DATA IMPERATIVES  IN IT MA&D IN LIFE  SCIENCES INDUSTRY

---

  Page: 2 / 10

---

 2 FOREWORD Larger macroeconomic headwinds (first the pandemic, then rising interest rates and now recessionary fears) are pushing organizations to resort to mergers, acquisitions, and divestitures (MA&D) as a strategic lever to achieve higher market share, acquire new capabilities, or/and refocus strategy on core business to improve financial performance. The average annual global MA&D value was approximately $3.6 trillion in 2011-20 cycle and increased to $5.9 trillion in 2021, highlighting the growing importance of MA&D in meeting future business needs. The life sciences industry is increasingly looking at MA&Ds to acquire new specialty / generic drug line (and related market pipeline) in pharmaceuticals, specialized capabilities in diagnostics and digital health sector, niche research and development capabilities for effective drug discovery around “specialty drugs” and patented IP data around experimental drugs.<|endoftext|>There is growing emphasis on antitrust regulations, regulatory reporting, disclosure requirements, and overall deal approval processes. Compliance with these directly relates to the way entity data is managed (before and after MA&D transaction). Multiple data types including financial, operational, people, supplier, and customer data come into remit. This requires organizations to carefully design and execute their data strategy. There are multiple examples from the industry which showcase that despite growing importance of data strategy in MA&D transactions, just 24% of organizations included CIOs in pre-merger planning4. Abbott Laboratories’ acquisition of Alere got delayed due to regulatory concerns on market concentration1 and anti-competition2. Pfizer and Allergan terminated their planned merger due to the change in treasury rules that made tax benefits less attractive3 and many more.<|endoftext|>Data strategy design and execution start with definition of business metrics and alignment on value measurement approach. After metrics are defined and accepted, linkage to source systems, standardization of data element definitions and management of meta-data along with master data ownerships are key to accurately measuring and interpreting these metrics. Data qualification, especially in regulated industries, is critical to understand and managing qualified data (GxP) and related platforms & applications involved. Finally, a performance oriented and scalable data integration methodology followed by an overarching process and governance mechanism is necessary for ensuring ongoing quality and compliance.<|endoftext|>A poorly designed data strategy and execution often leads to ambiguous understanding of key metrics and underlying data elements, incongruent data standards and unclear ownerships - resulting in faulty data integration, inaccurate transaction records, and ultimately unreliable insights and legal complications. An effective way to overcome these pitfalls is to define a robust data design and execution strategy covering key elements addressing distinctive needs of the life sciences industry.<|endoftext|>Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 3 / 10

---

 Mergers, acquisitions, and divestitures (MA&D) are strategic channels for growth. Multiple benefits can be achieved through an effective MA&D transaction, including exponential growth, entry to newmarkets, optimized cost savings, and improved competitiveness.<|endoftext|>The life sciences industry has been experiencing rapid growth and transformation in recent years, fueled by innovations in R&D, regulatory changes, and technological advancements in provider and payer domains. MA&D transactions have become a vital strategic tool for organizations to expand their portfolios, access new markets and improve their competitive positions. Given the complex nature of MA&D transactions, it requires comprehensive due diligence and planning before, during, and after the transaction. Data, being the fundamental building block of any organization, is a critical factor in this due diligence and planning. It is also one of the commonly overlooked factors. In this article, we highlight key elements of data strategy and design within a MA&D transaction and typical pitfalls along with ways to overcome them.<|endoftext|>MA&D transactions in the life sciences industry are increasingly subject to higher scrutiny from regulatory bodies to ensure greater transparencies and better shareholder and consumer protection. There are three key regulation types which are in place: 1. Greater financial and operationaltransparencies: A. India - Foreign Exchange Management Act (FEMA), SEBI Laws B. USA – Securities Act, Securities Exchange Act C. Europe – European Union Merger Law 2. Better intellectual property protection: Patents, trademarks, copyrights, trade secrets, designs, data protection.<|endoftext|>3. Higher fair play and consumer protection: A. India – Competition Act B. USA – Federal Antitrust Laws C. Europe – Competition Law According to an analyst report, the average MA&D failure rate is ~70%4. A key reason for this high failure rate is difficulty in integrating the two entities,5 especially w.r.t culture, operational ways of working, revenue recognition and performance incentives. All these aspects are directly impacted by the way data is designed and managed. Despite the importance, just 24% of organizations included CIOs in pre-merger planning3. Effective data management is key to adhering to these regulatory requirements and ensuring that data is properly collected, analyzed, and reported throughout the transaction process.<|endoftext|>Introduction 3 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 4 / 10

---

 MA&Ds are fundamentally complex transactions that impact business entities, systems, processes, and data of the organizations involved. There are eight elements which underpin data strategy and execution.<|endoftext|>Fig 1 – Key elements of data strategy within a MA&D transaction.  1. Business metrics and measurement: Defining metrics to evaluate the performance of the target entity is critical. It is important that all entities involved in the transaction clearly define and agree upon the metrics which define success; noteworthy metrics in the life sciences industry include clinical trial outcomes, regulatory approval timelines, molecule discovery rates, drug pipeline progress and GxP compliance metrics. These metrics articulate objectives and key results of the target entity. Agreement on accurate metrics and their measurement logic improves operational and financial transparencies, thereby promoting adoption of the integration / divestiture decision.<|endoftext|>2. Data policies and standards: It is essential to establish a common set of data standards and policies to maintain data assets in the target environment. This involves defining standard data formats, structures, and rules for data management and establishing governance policies to ensure security, privacy, compliance, and protection of data. In a merger or a divestiture scenario, data policies for resulting entities are driven by target business needs and operational requirements.<|endoftext|>Key elements of data strategy and execution 4 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 5 / 10

---

 3. Metadata management: Metadata helps to classify, manage, and interpret master data.<|endoftext|>Managing metadata is essential in ensuring standardization of data elements across systems e.g., customer ID, distribution channel codes, clinical trial identifiers, drug classification codes, etc.<|endoftext|>Effective metadata management promotes improved data consistency, better data quality, governance, compliance, and security. Like data policies and standards, metadata management standards are driven by target business needs and operational requirements.<|endoftext|>4. Master data management: Data ownership is crucial in MA&Ds because it determines necessary accountabilities and responsibilities towards maintaining the data assets.<|endoftext|>Defining master data ownership during the pre/post-close phases is critical in ensuring smooth transition to integrated operations6. All parties involved must align on a clear ownership on gaining access, maintaining, and governing the master data assets after the transaction. Establishing data stewardship roles and processes to maintain master data is essential to avoid pitfalls such as delays in integration, legal disputes, and potential regulatory penalties. In addition, clear data ownership contributes to better intellectual property protection in a MA&D transaction. This ownership also means managing data at a product level with a promise of a required level of data quality, making it easier for users to extract valuable insights and intelligence.<|endoftext|>5. Data lineage management: MA&D transactions create large data assets, which increasingly become interconnected, complex, and challenging to work with. Data lineage tracks flow of data from source to destination, noting any changes in its journey across different systems. This allows for tracing data origins, evaluating data accuracy and pinpointing potential risks, enabling risk management, thus elevating probability of success of MA&D transactions.<|endoftext|>6. Data qualification: A crucial element for consideration is qualification of data into GxP and non-GxP. GxP data is subject to stringent regulations, while non-GxP data has fewer regulatory constraints. Proper data qualification enables organizations to manage GxP data in compliance with regulatory guidelines and handle non-GxP data as appropriate for its intended use. This helps in adoption of efficient data management processes especially from an extract, transform and load perspective. It also emphasizes relevance of systems that will hold the regulatory


Continue # Infosys POV
 data thus ensuring required controls in place when interacting with such systems.<|endoftext|>5 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 6 / 10

---

 7. Data integration: Effective integration of data across systems such as clinical trial databases, product development pipelines, and sales and marketing platforms into a single, unified environment is critical for the new entity to make effective decisions. Integration of data requires consistent understanding of data and minimization of data redundancies. This helps the new entity gain better and more accurate understanding of its business and operational data, thereby expediting envisioned synergy realization. It also increases operational efficiency by streamlining internal processes, reducing duplication of effort, thereby improving risk profile. Effective data integration is essential for achieving information protection and transparency in a MA&D transaction.<|endoftext|>8. Data governance: Data governance is a crucial element for managing “data at rest” and “data in motion”. Robust data governance establishes policies, processes and controls to manage data throughout the life cycle. An effective data governance framework ensures both “data in motion” and “data at rest” are adequately protected while tracking data health in a near real time manner, thereby fostering trust with regulators, customers, and partners.<|endoftext|>Common pitfalls in a MA&D and ways to overcome them Data design and execution to support an integration / divestiture transaction is often complicated and stressful. However, with the right interventions, organizations can navigate around these complications. A non-effective data strategy can have far-reaching consequences, such as reduced financial and operational transparency, compromised intellectual property protection, decreased fair play among entities involved and weakened consumer protection. We have identified sixcommon pitfalls and their impact.<|endoftext|>Fig 2 – Critical elements of pitfalls in a MA&D transaction 6 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 7 / 10

---

 1. Data ownership: One of the most common pitfalls in MA&D transactions is limited clarity around ownership of data assets in target state. The issue is particularly pronounced when organizations involved have multiple focus areas with data stored in a single system but without proper segregation and ownership. For example, an organization may have three focus areas such as BioSimilars, BioPharma and Med Devices. Data on these focus areas may be stored in one system but not segregated based on focus areas. MA&D in any one of these areas will impose a significant challenge in terms of data segregation dependency identification. Ambiguities regarding data asset ownership often leads to intellectual property disputes, faulty data integration, and challenges extracting data specific to a new entity. To avoid such confusion, it is essential to establish data ownership early in the transaction and assign data stewards to manage data in rest as well in motion.<|endoftext|>2. Business metrics: Organizations involved in a MA&D transaction may prioritize select GxP and non-GxP metrics based on their distinctive strategic objectives and market priorities. For example, in a MA&D involving a generic and a specialty drug maker, the generic drug maker might emphasize GxP metrics such as manufacturing quality and regulatory submission timelines, as well as non-GxP metrics such as market share and cost efficiency. On the other hand, specialty drug makers might focus on GxP metrics such as clinical trial data quality and patient safety, and non-GxP metrics such as R&D pipeline growth and innovative therapy development. Given these diverse priorities, establishing common performance criteria for the new entity might be a challenge. Moreover, lack of uniformity in underlying logic for measuring the performance may further exacerbate the issue. Organizations must establish uniform metrics and underlying measurement criteria that is reflective of strategic priorities of the target entity.<|endoftext|>3. Data standards: Organizations also face roadblocks when they fail to establish common definitions for data elements. The resulting inconsistency in data standards increases the risk of inaccurate transaction records. Such inaccuracies can impair decision-making during critical stages of the MA&D and might even jeopardize the overall success of the transaction. Creating a unified data dictionary and standardizing data definitions across all entities involved is essential to mitigate such risks.<|endoftext|>4. Data lineage: A common pitfall is related to replication of source data elements across multiple source systems. Replication of data elements in multiple systems increases complexity of managing data and leads to additional synchronization overheads.<|endoftext|>Establishing standardized data lineage practices along with synchronized replication processes through automated tools is key to increasing data congruency.<|endoftext|>7 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 8 / 10

---

 5. Data governance: Another common challenge encountered during MA&Ds arises from ineffective and inconsistent data governance processes. Inconsistent data governance processes decrease accuracy of inferences and insights which can be derived from datasets. A consistent data governance process ensures data protection and regulatory compliance.<|endoftext|>6. Knowledge management: Heavy reliance on individuals makes knowledge retention vulnerable to personnel changes. To overcome this challenge, organizations must develop a knowledge management capability that is not solely dependent on people but facilitated through a set of processes and tools. A robust knowledge management capability enables effective and efficient use of data during the transaction.<|endoftext|>7. A well-designed data strategy is complemented by an effective execution plan. By proactively identifying potential challenges and implementing mitigating solutions, organizations can effectively navigate through the complexities and maximize value realization from a MA&D transaction. Effective data strategy and execution can safeguard the success of the transaction and ensure that the resulting entity(s) operates efficiently and effectively.<|endoftext|>About the CIO advisory practice at Infosys Consulting Over the next 5 years CIOs will lead their organizations towards fundamentally new ways of doing business. The CIO Advisory practice at Infosys Consulting is helping organizations all over the world transform their operating model to succeed in the new normal – scaling up digitization and cloud transformation programs, optimizing costs, and accelerating value realization. Our solutions focus on the big-ticket value items on the C-suite agenda, providing a deep link between business and IT to help you lead with influence.<|endoftext|>8 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 9 / 10

---

 MEET THE AUTHORS Inder Neel Dua inder_dua@infosys.com Inder is a Partner with Infosys Consulting and leads the life sciences practice in India. He has enabled large scale programs in the areas of digital transformation, process re-engineering and managed services.<|endoftext|>Anurag Sehgal anurag.sehgal@infosys.com Anurag is an Associate Partner with Infosys Consulting and leads the CIO advisory practice in India. He has enabled large and medium scale clients to deliver sustainable results from multiple IT transformation initiatives.<|endoftext|>Ayan Saha ayan.saha@infosys.com Ayan is a Principal with the CIO advisory practice in Infosys Consulting. He has helped clients on business transformation initiatives focusing on IT M&A including operating model transformation.<|endoftext|>Manu A R manu.ramaswamy@infosys.com Manu is a Senior Consultant with CIO advisory practice in Infosys Consulting.<|endoftext|>He has assisted clients on technology transformation initiatives in the areas of IT M&A and cloud transformation.<|endoftext|>Sambit Choudhury sambit.choudhury@infosys.com Sambit is a Senior Consultant with the CIO advisory practice in Infosys Consulting. His primary focus areas include enterprise transformation with IT M&A as a lever. He has helped clients in areas of IT due diligence, integration, and divestitures.<|endoftext|>1 FTC Requires Abbott Laboratories to Divest Two Types of Point-Of-Care Medical Testing Devices as Condition of Acquiring Alere Inc.<|endoftext|>2 EU clears Abbott acquisition of Alere subject to divestments | Reuters 3 Pfizer formally abandons $160bn Allergan deal after US tax inversion clampdown | Pharmaceuticals industry | The Guardian 4 Why, and when, CIOs deserve a seat at the M&A negotiating table | CIO 4 The New M&A Playbook - Article - Faculty & Research - Harvard Business School (hbs.edu) 5 Don’t Make This Common M&A Mistake (hbr.org) 6 6 ways to improve data management and interim operational reporting during an M&A transaction 9 Data Imperatives in IT MA&D in Life Sciences Industry | © 2023 Infosys Consulting

---

  Page: 10 / 10

---

 consulting@Infosys.com InfosysConsultingInsights.com LinkedIn: /company/infosysconsulting Twitter: @infosysconsltng About Infosys Consulting  Infosys Consulting is a global management consulting firm helping some of the world’s most recognizable brands  transform and innovate. Our consultants are industry experts that lead complex change agendas driven by disruptive  technology. With offices in 20 countries and backed by the power of the global Infosys brand, our teams help the C- suite navigate today’s digital landscape to win market share and create shareholder value for lasting competitive  advantage. To see our ideas in action, or to join a new type of


Continue # Infosys POV
 consulting firm, visit us at  www.InfosysConsultingInsights.com.  For more information, contact consulting@infosys.com  © 2023 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is  accurate as of its publication date; such information is subject to change without notice. Infosys acknowledges the  proprietary rights of other companies to the trademarks, product names, and other such intellectual property rights  mentioned in this document. Except as expressly permitted, neither this document nor any part of it may be  reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printed,  photocopied, recorded or otherwise, without the prior permission of Infosys Limited and/or any named intellectual  property rights holders under this document.

***


# Infosys Whitepaper
Title: Need for data masking in a data-centric world
Author: Infosys Limited
Format: PDF 1.6

---

  Page: 1 / 4

---

 VIEW POINT Abstract With data gaining increasing prominence as the foundation of  organizational operations and business, ensuring data security  is emerging as a main priority. It is critical to safeguard sensitive  data and customer privacy, the lack of which can lead to financial  and reputational losses. Thus, there is a rising demand to protect  personally identifiable information during transfer within  organizations as well as across the external ecosystem. This paper  highlights the need for data masking solutions. It also explains how  customized data masking solutions can be used in today’s data  centric world.<|endoftext|>Paromita Shome, Senior Project Manager, Infosys Limited NEED FOR DATA MASKING IN A  DATA-CENTRIC WORLD

---

  Page: 2 / 4

---

 External Document © 2018 Infosys Limited Introduction The key differentiator for today’s  businesses is how they leverage data.  Thus, ensuring data security is of utmost  importance, particularly for organizations  that deal with sensitive data. However, this  can be challenging because data that is  marked critical and sensitive often needs  to be accessed by different departments  within an organization. Without a well- defined enterprise-wide data access  management strategy, securing data  transfer can be difficult. The failure to  properly control handling of sensitive  information can lead to dangerous data  breaches with far-reaching negative  effects. For instance, a 2017 report by the  Ponemon Institute titled ‘Cost of a Data  Breach Study, 2017’1 found that: • The average consolidated total cost of a  data breach is US $3.62 million • The average size of a data breach (number  of records lost or stolen) increased by 1.8%  in the past year • The average cost of a data breach is US  $141 per record • Any incident – either in-house, through a  third party or a combination of both – can  attract penalties of US$19.30 per record.  Thus, for a mere 100,000 records, the cost  of a data breach can be as high as US $1.9  million These statistics indicate that the  consequences of data breaches go beyond  financial losses. They also affect the  organization’s reputation, leading to loss  of customer and stakeholder trust. Thus,  it is imperative for organizations to adopt  robust solutions that manage sensitive  data to avert reputational damage and  financial losses.<|endoftext|>External Document © 2019 Infosys Limited

---

  Page: 3 / 4

---

 External Document © 2018 Infosys Limited Data masking as a solution Data masking refers to hiding data such  that sensitive information is not revealed.  It can be used for various testing or  development activities. The most common  use cases for data masking are: • Ensuring compliance with stringent  data regulations – Nowadays, there are  many emerging protocols that mandate  strict security compliance such as Health  Insurance Portability and Accountability  Act (HIPAA) and General Data Protection  Regulation (GDPR). These norms do  not allow organizations to transfer  Types of data masking There are various masking models or  algorithms that can be leveraged to  address the above use cases. These ensure  data integrity while adhering to masking  demands. The most common types are: • Substitution or random replacement of  data with substitute data • Shuffling or randomizing existing values  personal information such as personally  identifiable information (PII), payment  card information (PCI) and personal health  information (PHI)  • Securely transferring data between  project teams – With the increasing  popularity of offshore models, project  management teams are concerned  about how data is shared for execution.  For instance, sharing production data  raises concerns about the risk of data  being misused/mishandled during  transition. Thus, project teams need to  build an environment that closely mimics  production environments and can be  used for functionality validation. This  requires hiding sensitive information when  converting and executing production data  It is important to note that data sensitivity  varies across regions. Organizations with  global operations are often governed by  different laws. Hence, the demand for  data security and the potential impact of  any breach differ based on the operating  regions. Thus, having an overarching data  privacy strategy is paramount to ensure  that sensitive data remains protected. This  calls for a joint data protection strategy  that includes vendors in offshore and near- shore models as well.<|endoftext|>vertically across a data set/column • Data encryption by replacing sensitive  values with arithmetically formulated data  and using an encryption key to view the  data • Deleting the input data for sensitive fields  and replacing with a null value to prevent  visibility of the data element • Replacing the input value with another  value in the lookup table While the above models enable straight- forward masking, they cannot be applied  to all cases, thus creating the need for  customized data masking. Customized data  masking uses an indirect masking technique  where certain business rules must be  adhered to along with encryption as shown  in Fig 1.<|endoftext|>In the figure, the source data – WBAPD11040WF70037 – is received from any source system like RDBMS/Flat files. The business rules state that:  1. There should be no change in the first 10 characters post masking   2. The next 2 letters should be substituted with letters post masking 3. The last 5 numerals should be substituted with numerals only post masking Fig 1: A technical approach to customized data masking External Document © 2019 Infosys Limited Data Masking RDBMS Individual Data (WBAPD11040WF70 037) Data  Splitter Data Splits WBAPD11040 WF Individual Data (WBAPD11040AG817 26) Masked Data Source Data Data  Concatenation 70037 Masking TDM Tool PLSQL WBAPD11040 AG 81726 Masked Data Splits Files Input Source RDBMS Files Output Source

---

  Page: 4 / 4

---

 © 2019 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com Infosys.com | NYSE: INFY Stay Connected As part of customized masking, the source  data is passed through a data splitter.  The single source data is then split into  individual source data based on the  business rules as shown in Fig 1.<|endoftext|>After this, the individually-split data is  run through the data masking tool and  the masking algorithm defined in the  tool is executed for each item, yielding an  output of masked data. In each section,  the masking type is selected based on the  business rule and then the encryption is  applied. The three individual sections of  masked data are finally concatenated  before being published at the output,  which can be a database or a flat file. The  masked data for the reference source data  now reads as WBAPD11040AG81726. This  output data still holds the validity of the  source input data, but it is substituted  with values that do not exist in line  with the business rules. Hence, this  can be utilized in any non-production  environment.<|endoftext|>Customized masking can be used in  various other scenarios such as: • To randomly generate a number to check  Luhn’s algorithm where masked data  ensures that the source data lies within the  range of Luhn’s algorithum • To check number variance in a range  between ‘x’ and ‘y’ where the input  values will be replaced with a random  value between the border values, and the  decimal points are changed • To check number variance of around +/- *  % where a random percentage value  between defined borders will be added to  the input value Conclusion As the demand for safeguarding sensitive  data increases, organizations need  effective solutions that support data  masking capabilities. Two key areas where  data masking is of prime importance are  ensuring compliance with data regulations  and protecting data while it is transferred  to different environments during testing.  While there are several readily-available  tools for data masking, some datasets  require specialized solutions. Customized  data masking tools


Continue # Infosys Whitepaper
 can help organizations  hide source data using encryption and  business rules, allowing safe transfer while  adhering to various global regulatory  norms. This not only saves manual  effort during testing but averts huge  losses through financial penalties and  reputational damages arising from data  breaches.<|endoftext|>References 1. https://securityintelligence.com

***


# Infosys Whitepaper
Title: Infosys Test Automation Accelerator
Author: Infosys Limited
Format: PDF 1.7

---

  Page: 1 / 4

---

 WHITE PAPER HOW TO ENSURE DATA QUALITY   DURING DATA MIGRATION Naju D Mohan, Delivery Manager

---

  Page: 2 / 4

---

 Introduction In today’s business world, change is the  only constant and changes make their  appearances in various forms, some of  which are: • Mergers and acquisitions • New compliance requirements • New Package implementations •  Migration to new technologies such as  the cloud • Big data programs Being data driven, the business has to  upgrade and keep its intelligence up- to-date to realize the benefits of these  changes. So in short, all these changes  result in data migrations.  Most of the time, it is assumed that data  migration is an IT problem 2. All the visible  changes and the actions lie with the IT  team, so the business moves on, putting  the entire burden of data migration  management on the IT team.  Mergers and acquisitions and compliance  requirements clearly stand out as having  its origin with the business team. So does  the decision to implement a CRM, loyalty  or HR package with its beginning at the  business department. The need to optimize  operating costs and make intelligent  decisions and act in real-time, leads the  business to migrate to cloud and embark  on big data programs. But the onus of the  migration management, often, lies with the  IT team.<|endoftext|>It must be clearly understood that any data  migration without the business leading the  program has a high rate of failure. Business  has to not just care about data migration  but command it.<|endoftext|>Who is the Primary Owner? According to Gartner, 83% of the  data migration programs fail to meet  expectations, running over time and  budget1.<|endoftext|>Some key reasons for this are: 1.  Poor Understanding About Data  Migration Complexity •   The focus on data migration is lost in  the excitement of the new package  implementation, migration to cloud  or big data initiatives  •   Most often, it is assumed that data fits  one-one into the new system •   The whole attention is on the  implementation of the new business  processes with less or almost no focus  on data migration 2. Lack of Proper Attention to Data •   Lack of data governance and proper  tools for data migration can impact  the quality of data loaded into the  new system •   Mergers and acquisitions can  introduce new data sources and  diverse data formats •   Huge volumes of data may force us  to overlook whether the  data is still  relevant for the business   3. Late Identification of Risks •   Poor data quality of the source  systems and lack of documentation  or inaccurate data models would be  identified late in the migration cycle •   Lack of clarity on the job flows and data  integrity relationship across source  systems would cause data load failures Why Such a High Failure Rate for Data Migration Programs? External Document © 2018 Infosys Limited

---

  Page: 3 / 4

---

 An innovative data migration test strategy  is critical to the success of the change  initiatives undertaken by the business. The  test strategy should be prepared in close  collaboration with the business team as  they are a vital stakeholder, who initiated  the change resulting in data migration. The  two principal components which should be  considered as part of the test strategy are: 1. Risk-Based Testing    The data volumes involved in data  migration projects emphasize the  need for risk-based testing to provide  optimum test coverage with the least  risk of failure. Master test strategy  can be created by ensuring proactive  analysis with business and third- parties. Tables can be prioritized and  bucketed based on the business  criticality and sensitivity of data.  Composite key agreed with the  business can be used to select sample  rows for validation in tables with  billions of rows.  2. Data Compliance Testing    It is very important that the quality  assurance (QA) team is aware of the  business requirements that necessitated  data migration, because the change  would have been to meet new  government regulations or compliance  requirements. The test strategy must  have a separate section to validate  the data for meeting all compliance  regulations and standards such as Basel  II, Sarbanes-Oxley (SOX), etc.  Is There a Right Validation  Strategy for Data Migration? A Test Approach Giving Proper Attention to Data Data migration, as mentioned earlier, is  often a by-product of a major initiative  undertaken by the company. So in a  majority of scenarios, there would be an  existing application which was performing  the same functionality. It is suitable to  adopt a parallel testing approach which  would save effort spent to understand  the system functionality. The testing can  be done in parallel with development in  sprints, following an agile approach to  avoid the risk of failure at the last moment.<|endoftext|>1. Metadata Validation    Data migration testing considers  information that describes the location  of each source such as the database  name, filename, table name, field or  column name, and the characteristics  of each column, such as its length and  type, etc. as part of metadata. Metadata  validation must be done before the  actual data content is validated, which  helps in early identification of defects  which could be repeated across several  rows of data.<|endoftext|>2. Data Reconcilliation    Use automated data comparison  techniques and tools for column to  column data comparison. There could  be duplicate data in legacy systems  and it has to be validated that this is  merged and exists as a single entity  in the migrated system. Sometimes  the destination data stores do not  support the data types from the source  and hence the storage of data in such  columns have to be validated for  truncation and precision. There could  be new fields in the destination data  store and it has to be validated that  these fields are filled with values as per  the business rule for the entity.<|endoftext|>Benefits  A well thought-out data migration validation strategy helps to make the data migration  highly predictable and paves the way for a first-time right release. Regular business  involvement helps to maintain the testing focus on critical business requirements. A  successful implementation of the shift-left approach in the migration test strategy helps  identify defects early and save cost.<|endoftext|>External Document © 2018 Infosys Limited

---

  Page: 4 / 4

---

 Case Study: Re-Platforming of Existing HP NEOVIEW Data Warehouse to Teradata The Client   One of the largest super market chains in  the United Kingdom which offers online  shopping, DVD rentals, financial services,  and multiple store locations.<|endoftext|>The Objectives •  To complete the re-platform of HP  Neoview to Teradata and re-platform  associated services before HP  discontinued support to Neoview  •  To migrate the existing IT business  services currently operating against a  Neoview data warehouse onto a Teradata  warehouse with minimal disruption •  To improve the performance of  current  Ab-Initio ETL batch processes and  reporting services using Microstrategy,  SAS, Pentaho, and Touchpoint  The QA Solution The validation strategy was devised  to ensure that the project delivered a  like-for-like, ‘lift-and-shift’. This project  had environmental challenges and  dependencies throughout the entire  execution cycle. SIT phase overcame all  the challenges by devising strategies  that departed from traditional testing  approach in terms of flexibility and  agility. The testing team maintained close  collaboration with the development and  infrastructure teams while maintaining  their independent reporting structure.  The approach was to maximize defect  capture within the constraints placed on  test execution.<|endoftext|>It was planned to have individual  tracks tested independently on static  environment and then have an end- to-end SIT, where all the applications /  tracks are integrated. Testing was always  focused on migrating key business  functions on priority such as sales  transaction management, merchandise  and range planning, demand  management, inventory management,  price and promotion management, etc.<|endoftext|>The Benefits •  15% reduction in effort through  automation using in-house tools •  100% satisfaction in test output  through flexibility and transparency  in every testing activity achieved  through statistical models to define  acceptance baseline End Notes 1. Gartner, “Risks and Challenges in Data Migrations and Conversions,” February 2009 2. https://www.hds.com/go/cost-efficiency/pdf/white-paper-reducing-costs-and-risks-for-data-migrations.pdf © 2018 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document


Continue # Infosys Whitepaper
. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com Infosys.com | NYSE: INFY Stay Connected

***


# Infosys Whitepaper
Title: End-to-end test automation – A behavior-driven and tool-agnostic approach
Author: Infosys Limited
Format: PDF 1.7

---

  Page: 1 / 8

---

 PERSPECTIVE END-TO-END TEST AUTOMATION  – A BEHAVIOR-DRIVEN AND TOOL- AGNOSTIC APPROACH Anand Avinash Tambey  Product Technical Architect, Infosys Abstract In today’s fast changing world, IT is under constant pressure to  deliver new applications faster and cheaper. The expectation from  the quality assurance (QA) organization is to make sure that all the  applications are tuned to deliver to every rising user expectation  across devices, locations, and typically, at no additional cost. And  with an exponential growth in the diversity and number of end  users in almost all sectors, requirements are fairly fluctuating and  demanding too.<|endoftext|>

---

  Page: 2 / 8

---

 Let us discuss these approaches in detail to face the above challenges.  How to face these challenges Challenges l Technical complexity l Infrastructure, licensing, and      training costs l Late involvement of users l Late involvement of testers    Approaches l De-skilling l Using open source stack l Using behavior-driven techniques l Utilizing the testers and users      effectively     This fast-paced software engineering  advancement is also posing challenges to  software engineers to build an ecosystem  that enables rapid prototyping and  design, agile development and testing,  and fully automated deployment. For  the QA community, this translates to a  need to maximize automation across  all stages of the software engineering  and development life cycle and more  importantly, do it in an integrated fashion.  Consequently, `extreme automation’ is the  new mantra for success. And there is more.  According to the 2014 State of DevOps  report, high-performing organizations  are still deploying code 30 times more  frequently, with 50 percent fewer failures  than their lower-performing counterparts.  High IT performance leads to strong  business performance, helping boost  productivity, profitability, and market  share. The report counts automated testing  as one of the top practices correlated  with reducing the lead time for changes.<|endoftext|>However, automated testing puts together  another set of challenges. The latest  technologies stack advocates multiple  choices of test automation tools, platform-  specific add-ins, and scripting languages.  There is no inherent support available  for generic, tool-agnostic, and scriptless  approach with easy migration from one  tool to another. Therefore, a significant  investment in training, building expertise,  and script development is required to  utilize these tools effectively. The cost  and associated challenges inadvertently  affect the time-to-market, profitability, and  productivity although it also creates an  opportunity to resolve the issues using a  combination of an innovative tool-agnostic  approach and latest industry practices   such as behavior-driven development  (BDD) and behavioral-driven test (BDT).<|endoftext|>Business challenges  A persistent need of businesses is to  reduce the time between development  and deployment. QA needs to evolve  and transform to facilitate this. And this  transformation requires a paradigm  shift from conventional QA in terms of  automation achieved in each life cycle  stage and across multiple layers   of architecture.   Technical complexity The technology and platform stack is not  limited to traditional desktop and the   web for current application portfolios. It  extends to multiple OS (platforms), mobile   devices, and the newest responsive   web applications.<|endoftext|>Infrastructure, licensing, and  training costs  To test diverse applications, multiple test  automation tools need to be procured  (license cost), testing environment needs  to be set up (infrastructure), and the  technical skills of the team need to be  brought to speed with training and self- learning / experimentation (efforts).  Late involvement of users  The end user is not involved in the  development process until acceptance  testing and is totally unaware of  whether the implemented system meets  her requirements. There is no direct  traceability between the requirements and  implemented system features.  Late involvement of testers Testing and automation also need to  start much earlier in the life cycle (Shift- Left) with agility achieved through the  amalgamation of technical and domain  skills of the team, as well as the end user.  External Document © 2018 Infosys Limited

---

  Page: 3 / 8

---

 Using open-source stack To reduce the cost of commercial tool  license and infrastructure, utilize open-  source tools and platforms.<|endoftext|>De-skilling  Using easy modeling of requirements and  system behaviors, accelerated framework,  and automated script generators, reduces  the learning curve and the dependency  on expert technical skills.<|endoftext|>Using behavior-driven  techniques Behavioral-driven development and  testing (BDD and BDT) is a way to reduce  the gap between the end user and the  actual software being built. It is also  called `specification by example.’ It uses  natural language to describe the `desired  behavior’ of the system in a common  notation that can be understood by  domain experts, developers, testers,  and the client alike, improving  communication. It is a refinement of  practices such as test-driven development  (TDD) and acceptance test-driven  development (ATDD).<|endoftext|>The idea behind this approach is to  describe the behaviors of the system being  built and tested. The main advantage  is that the tests verifying the behaviors  reflect the actual business requirements  / user stories and generate the live  documentation of the requirements,  that is, successful stories and features  as test results. Therefore, the test results  generated can be read and understood by  a non-technical person, such as a project  sponsor, a domain expert, or a business  analyst, and the tests can be validated.  Utilizing testers and users   effectively  Our accelerated automation approach  provides a simple modeling interface  for a scriptless experience and thereby  utilizes non-technical staff effectively.  It introduces the `outside-in’ software  development methodology along with  BDT, which has changed the tester’s  role dramatically in recent years, and  bridges the communication gap between  business and technology. It focuses on  implementing and verifying only those  behaviors that contribute most directly to  the business outcomes.<|endoftext|>Solution approach Our solution approach is threefold, to  resolve challenges in a holistic way.  It applies a behavior-driven testing  approach with a tool-agnostic automation  framework, while following an integrated  test life cycle vision. It ensures that  business users and analysts are involved.<|endoftext|>It provides the flexibility of using any tool  chosen and helps save cost and effort. It  also provides a simple migration path to  switch between tools and platforms, if  such a case arises. With an integrated test  life cycle approach, it ensures seamless  communication between multiple  stakeholders and leverages industry- standard tools.<|endoftext|>External Document © 2018 Infosys Limited

---

  Page: 4 / 8

---

 Finally, it introduces automation in early stages to realize the benefit of Shift-Left.<|endoftext|>Behavior-driven test (BDT) To facilitate real-time traceability of user  stories / requirements and to aid live  documentation, we have implemented  a BDT approach across multiple Infosys  projects as described below.<|endoftext|>This approach acted as a single point of  continuous interaction between the tester  and the business users.  The user story is divided into various  scenarios by the testers into a feature file.<|endoftext|>l  These scenarios are written using    Gherkin language. These scenarios   include the business situation, the   pre-ions, the data to be used, and the   acceptance criteria.<|endoftext|>l  The end user signs off the features /   scenarios. This provides the user control   to execute and validate the scenarios   based on the data as per the user   need  and bring up feature   reports / dashboard.  l  The underlying technical  implementation is abstracted from   the business user.<|endoftext|>l  Tester creates the underlying test    scripts for the scenarios which could   be a business layer test script, service   test script, or a UI automated test script.<|endoftext|>l  The tool then converts the scenarios   to `step definitions,’ which act as the   binder between the test scripts and the  scenarios. This ensures that a single   point / interface is used to execute any   type of tests.<|endoftext|>Tester User story End user Zero distance with user  User aware of feature  success / failures early Shift-Left  Early  test automation from day one UI Testing framework (BDT) Reports in user's language Feature fles Step defnition 11% Back to Jenkins Tag Overview Cucumber Reports Feature Overview for Build: 15 The following graph shows passing and falling statistics for features in this build: Failed Skipped Pending Passed Steps Scenarios 89% 92% Passed Failed Feature Statistics Cucumber-JVM Jenkins report plugin - 06-07-2012 22:31:55 Account holder withdraws cash project


Continue # Infosys Whitepaper
2 8 40 40 0 0 0 113 ms passed 1 9 5 1 3 0 4 ms failed 8 40 40 0 0 0 112 ms passed 1 9 5 1 3 0 4 ms failed Account holder withdraws More cash project 2 Account holder withdraws more cash  Account holder withdraws cash  Feature Scenarios Steps Passed Failed Skipped Pending Duration Status 4 18 98 90 2 6 0 233ms Totals External Document © 2018 Infosys Limited

---

  Page: 5 / 8

---

 Tool- / platform-agnostic solution (BDD release) Tool-agnostic approach To remove dependencies on technical  skills, tools, and platforms, our solution  proposes modeling of system behaviors  using generic English-like language via  an intuitive user interface. This model  would be agnostic to any specific tool or UI  platform and reusable.<|endoftext|>This model will be translated into a widely  acknowledged format, XML, and will act  as an input to generate automation scripts  for specific tools and platforms. Finally,  it would integrate with a continuous  integration platform to achieve an end-to- end automation of build-test-deploy cycle.<|endoftext|>BDD modeling UI Scriptless, tool- / platform-agnostic implementation Business  analyst / end user User story Features Fields and  step defnitions QTP Selenium SAHI Protractor Tester Execution AUT Continuous integration Build Test Deploy Script generator External Document © 2018 Infosys Limited

---

  Page: 6 / 8

---

 Integrated test life cycle The role of the traditional tester and end  users is changing in the era of DevOps  and Shift-Left. The integrated-solution  approach enables a larger stakeholder  Benefits  Reduced time-to-market l Shift-Left, early automation, and early   life cycle validation l Single-click generation and execution   of automated scripts Reduced cost l 40–60 percent reduction in effort    for automated test case generation over   manual testing l Detailed error reporting reduces   defect reporting effort considerably base to contribute towards the quality of  the system under development. It also  ensures the satisfaction of stakeholders  via early validation and early feedback of  system progress while using the industry- standard toolsets seamlessly.<|endoftext|>l Easy maintenance of requirements,   stories, features, and the automated   test suite l No additional cost involved in     building integration components for   test management tools (HP-ALM) l The agnostic approach works for a    broad range of applications irrespective   of tools, technology, and platform Improved quality l Enhanced business user participation   and satisfaction due to the live     documentation of features and user  stories, available at fingertips l Developer, tester, and client     collaboration possible due to a   common language l High defect detection rates (95–99  percent) due to high test coverage Requirement analysis Test design Test execution Test reporting Tester Enhances  automation libraries Generates requirements and features HP ALM/QC IBM RQM JIRA Jenkins Others Executes automation scripts Generates test reports Designs business processes Generates automation scripts Tester BA BA Automation expert QA manager / end user  BDD & UML modeling tool BDD & UML modeling tool Features and metrics reports Tool-agnostic, platform-agnostic automation accelerator  Integration With  Popular  Tools Test Life Cycle Management View External Document © 2018 Infosys Limited

---

  Page: 7 / 8

---

 References    https://puppetlabs.com/sites/default/files/2014-state-of-devops-report.pdf    http://www.ibm.com/developerworks/library/a-automating-ria/       http://guide.agilealliance.org/guide/bdd.html          http://www.infosysblogs.com/testing-services/2015/08/extreme_automation_    the_need_fo.html Conclusion Our solution approach is the first step  towards reducing the complexity of test  automation and making it more useful  for the end user by providing early and  continuous feedback to the incremental  system development. Moreover, it  advances automation at every level to  achieve rapid development and faster  time-to-market objectives.<|endoftext|>With the advent of multiple technologies  and high-end devices knocking at the  door, using a tool- and platform-agnostic  approach will increase overall productivity  while reducing the cost of ownership.  External Document © 2018 Infosys Limited

---

  Page: 8 / 8

---

 © 2018 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com Infosys.com | NYSE: INFY Stay Connected

***