Infrastructure management is undergoing a transformation. ITIL can help manage conflicting demands like – “low cost but high service quality”, “ubiquitous access but enhanced security”?

« June 2008 | Main | August 2008 »

July 31, 2008

Ignite Your Configuration Engines - Real world experiences for CMDB success: Part 1

Posted by Gaurav Uniyal, Consultant, Infosys Technologies


ITIL V3 (IT Infrastructure Library - Version 3) celebrated its first anniversary last month, and the authors would be reasonably pleased with the way industry has accepted the new concepts introduced by the framework. One of the interesting changes introduced by ITIL V3 is the Configuration Management System (CMS), a more realistic and realizable version of ITIL V2's CMDB (Configuration Management Database).

To discuss the changing dimensions of CMS/CMDB with the arrival of new service oriented technologies,  market trends, vendor strategies, typical challenges and best practices for implementation, this month, the British Computer Society Configuration Management Specialist Group (BCS CMSG) and IT Service Management Forum (itSMF, UK) jointly organized the “The CMDB and CMS - the Powerhouse of Service Management” conference in London.


I also attended the event to present my thought paper - “Ignite your configuration engines: Real world experiences for CMDB success”, sharing my experience on the typical implementation challenges and real world's best practices for CMDB design and implementation.

This is the presentation I made

Ignite Your Configuration Engines

From my experience in executing CMDB assessment, design and implementation engagements, here are some of the best practices, which I believe, should be considered while designing and building CMDB solutions -


Know what could be delivered and how? - While participating in quite a few discussions with different organizations for designing CMDB solutions, I have realized that there is general lack of understanding on the “End-State” of the implementation. In fact, in response to a question asked during a research study conducted by Freeform Dynamics, CMDB project managers rated “General understanding of what CMDB is and what it offers” as the prime challenge associated with CMDB implementation. An early consensus on the “End-state” helps in managing the CMDB implementation project effectively and identifying interim milestones for demonstrating CMDB value.  


Baseline current processes and technology landscape - A comprehensive assessment of the current process capabilities, technology landscape, interfaces with other processes/ tools, staffing and governance structure not only provides information on the improvement areas, but also helps in identifying the “Business Critical” areas for implementation prioritization. Assessment exercises also help in developing a business case to justify the investments and securing funds for the project.
 

Structured Requirements Gathering - Traditionally, interviews/ workshops are conducted to gather business and IT user's requirements for building the CMDB solution. However, user’s requirements are endless and a lot of time is consumed in capturing the accurate and complete set of requirements. One better approach for requirements gathering is to use a “Requirements gathering tool” with a list of requirements for selection. Use a “drop-down” kind of functionality to let users select the requirements across multiple sections e.g., interfaces, reporting, CIs coverage, CIs attributes etc., and document additional requirements which are not present in the tool. Doing this, a lot of time could be saved in capturing requirements and determining CMDB customization effort.
 

Analyze impact of the rollout - Is my organization operationally ready for the rollout? Have we identified the deficiencies in the present environment and its consequences? Do we have a backup plan if something goes wrong? These are some of the questions which need be answered before starting the implementation. Analyze the impact on the existing process, people and technology, and in turn analyze the "business impact" of the rollout. This not only help in getting prepared for any last minute surprises but also provide information on the steps required to make organization ready for the rollout e.g., trainings, communications, tool demo etc.
 

Develop processes to extract value out of the rollout - The true value of CMDB can never be achieved unless it is well supported by robust processes. One good approach for designing process architecture is to follow a top-down approach. Starting with writing high level policy statements, translate these policies into process/ procedures and then develop detailed work instructions to manage the CMDB operational tasks. While developing the processes, it is worthwhile to consider future growth and plan for a flexible and scalable architecture.
 

In my next blog, I will share some more real world’s best practices. If anyone has any questions, please feel free to post comments.      

Posted by Guest Author at 07:08 PM | | Comments (0) | TrackBacks (0)

CMDB Implementation ... Introducing Gaurav Uniyal

The Configuration Management database (CMDB) is the most talked-about, failure-prone and cost & effort consuming implementation among all service management systems. The ITSkeptic goes as far as to call it ITIL's Dead Elephant. Given the dependence of all other service management processes on CMDB, it has unquestionably attained the status of the “must-have” but "no-idea-how-to-get-there" system for most organizations.

With the introduction of the Configuration Management System (CMS) in ITIL V3, is it time for organizations to revisit their implementation strategy? Can an organization really hope to deploy and manage a CMDB / CMS? And what does a CMDB / CMS look like - a monolithic database or an integrated multiple federated solution?

Here's introducing Gaurav Dutt Uniyal.

Gaurav is an IT Service Management Consultant who has been associated with CMDB assessments, design and implementation projects. Gaurav has extensive experience in executing large-scale ITSM based process and technology projects. Recently, he participated in the “The CMDB and CMS - the Powerhouse of Service Management” conference organized jointly by BCS and itSMF. As one of the speakers, he presented his views on typical challenges encountered in successful CMDB implementations. I am inviting Gaurav to share his thoughts and experiences through these blogs. Over to you Gaurav.

Posted by Arvind Raman at 11:25 AM | | Comments (0) | TrackBacks (0)

July 28, 2008

People over process – Is your IT department doing it too?

Posted by Bhoopendra Adhikari 

Some kind of dependency on one person is a way of life in most IT departments in small and mid size organizations and its not uncommon even in large organizations. We are all used to that ‘wizard’ in IT department who knows those key systems like no one does and who can do everything. Every once in a while these guys turn rogue and we start debating how imperative it is to be not dependent on one person but do we ever try going beyond this reasoning!

Latest in this is the case of Terry Childs who was a network administrator with San Francisco city’s department of telecommunication information services (DTIS). As per the few details that were released Terry changed all the devices passwords (locking everyone else out of the system) and set up devices to gain unauthorized access to city’s prized WAN which carries 60% of municipal government  traffic. Worse, for some devices system configurations have been changed to erase configurations in case an attempt is made to restore the administrative access. Now he is in Jail and despite the continued efforts by the city’s department and vendors like CISCO, understanding the extent of damage and regaining the control back is still a “Work in progress”. The chances that they may end up reconfiguring the whole system are not ruled out currently.

So what are we looking at here. Is it too much dependency on one person that was the cause? Yes and No. Apart from dependency on one person, which certainly played a part, what I am looking at is a blatant circumvention of processes/best practices and a lack of management oversight to prevent that abuse. It’s not difficult to deduce here that simple controls over access and change management are either not in place or were overlooked completely by the staff and management in IT. Had they been in place, had a proper backup was mandatory before configurations can be changed, had a proper permission required to change admin access and privileges, had a proactive monitoring for rogue devices is in place, a lot of it could either be prevented or discovered before it assumed this grave shape.

The fact that these instances are few and far between is not assuring enough. First a lot of them actually go unreported. Secondly various studies including Verizon 2008 data breach report and Information weeks 2008 strategic security study  have made it clear that insiders have potential to do a lot more damage then outsiders due to the inherent trust placed in them. If insider is in privileged position like these and you have no processes to mitigate the risks then you may be  sitting on a ticking bomb. So before you beef technology and start relying on few people to manage it ensure that you have processes in place to manage the risks from them.

Having dependency on one person or a set of persons is a reality many  IT departments have to live with due to limited resources but does having some process in place to reduce the avenues of exploitation/risk really too much to ask for? Alas, we always learn it the hard way.

 

Posted by Guest Author at 05:58 AM | | Comments (3) | TrackBacks (0)

July 25, 2008

Reminiscence of Consulting All Hands Meeting on 18th and 19th July 2008

Preparing the Consulting team of North America for the next giant leap – By Anurag Bahal

As we saw our turbaned colleague tethered with the fragile rope struggling to breathe and sweating profusely we were excited and thrilled, not because of the moment of doubt but on the heights he had already accomplished. We wanted him to succeed; we wanted him to ring the sound of bell at the mountain. We cheered him to continue the relentless pursuit to the top and when he made it we were all lifted to the high spirits.

At the fag ends of the Infosys Consulting N.A. rendezvous, as I saw the bodies of top brains overcoming their limitation and climbing rocks, my mind echoed the thoughts of Og Mandino ( Author and Speaker)

"Failure will never overtake me if my determination to succeed is strong enough."

What happens when top consulting brains come together?  Opportunities abound, sky is what we can do. Rewind a few months, there was some apprehension on the value of doing an all-hands meet, but I was overwhelmed by the enthusiasm of our group that put all doubts to sleep. There was a wave of exhilaration, an ocean of ideas in our 2 days meet.

Day 1

When the Infosys Leadership Institute (ILI) delivered the training program on Client Interfacing skills, all the consultants were jumping right into the thick of discussions. It is such an important area of a consultant life, that enough does not seem to be enough. The lessons on Probing Skills were very well received by the group and so was the exercise on practicing various types of questions. The Relationship Tracker is a good tool to track the client affinity for Infosys. The lesson on Polite Disagreement helped us frame our next client discussion for saying “No”.  My personal favorite is the instructor’s definition of a good client interaction that goes “It is a good interaction only when the Value is flowing in both directions”

 The 8 hours of training including the pizza lunch just flew away. We could have done for another 8 hours but for the promise of a beautiful evening at Malee’s.  As William Feather, Writer said it "Plenty of people miss their share of happiness, not because they never found it, but because they didn't stop to enjoy it.", our group made sure that they not only found their fun but also had enough of it. People were amused to see Bombay curry at the Thai restaurant. Time to booze and celebrate the bonding.

 

Day 2

Next day started with an engrossing first half of active Business Presentation skills. It was impressive to see the creative spirits flowing when people were asked to present any topic of their interest. There was good feedback for individuals and that stays with us.

If that was not enough we had a session with Madhukar I B on future strategy and a follow up brain storming on our course of action followed by an evening of fun and excitement in the Rock Climbing. The famous part of the lunch was the compliment received by our principal Ram on his drop dead looks that made him an eligible bachelor.

To me the biggest take away of the meeting is that as a result of the all hands meeting our team members will be happier to pick up phone and talk to each other. This team spirit gives us the plank for future growth. I will leave you with another thought that epitomizes the experience –

"If you make the unconditional commitment to reach your most important goals, if the strength of your decision is sufficient, you will find the way and the power to achieve your goals." Robert Conklin Teacher, Author and Speaker

Together we surmount another rock!

 

 

 

Posted by Guest Author at 10:29 PM | | Comments (0) | TrackBacks (0)

The ITIL Master Exam - V2 Service Manager

It's been over a year now since the ITIL V3 publications came out. The recently announced new V3 certification scheme has been much awaited. The format and style for the V3 Service Manager exam is expected to be announced in the near future. That however, doesn't seem to have halted folks from continuing with plans for taking the ITIL V2 Service Manager Exam. I have been recommending my colleagues who have been putting off their V2 Master exam to take it up quickly. After all, a known "beast" (read V2) is easier to tackle than an unknown one (read V3).

So, to those still planning to go ahead with their ITIL V2 Service Manager exam, here's my compilation of nine tips to see you through. Let me know what you think.

  1. Write, write, write
    And I don't mean type SmileLike most people in this industry, I had not written anything longer than my address since I left college. The V2 masters exam is a three hour written exam each for Service Support and Service Delivery. By the end of the first hour, my fingers and wrist were aching. The biggest trouble I faced was not what to write but getting my fingers and wrist to cooperate.
  2. Space your Service Support and Deliver exams
    Take a break of at least 1-2 months between the two exams. I took mine in a span of 3 months. That was a tad too long a break. One month is ideal since it allows your fingers to recover, brains to undump the dope from one exam and all the while you are still fresh with the format and the case study. Definitely don't take it on the same day or over subsequent days. Your fingers will complain more than anybody else.
  3. Read only the two books - Service Support and Service Delivery
    Ok ok. I know "only" is a little too much. Yes, I don't like them too - far too verbose. But read them and nothing else. Don't bother about quick reference guides that tend to pop up suddenly as you start preparing. Mastering the books alone should get you past the passing score of 50%.
  4. How many times should I read?
    Read up each chapter at least three times. One caveat - if you have been in this space for way too many years than you remember, you should be ready for some good old unlearning. Forget how you mixed up Incident and Problem Management last week - well, at least until the exam is over.
  5. Read up the case study before you go for the exam and once more before you start the exam - just to make sure it is the same one. My case study had an extra page added in and most questions based off that.
  6. Which exam to take first?
    Go for Service Delivery first. Why? Simple answer. Lesser number of chapters to read - five in Delivery as against six in Support (including Service Desk). Plus Delivery is more theoretical, so there are less chances of tricky questions Smile And, if you leave aside Availability Management, the Delivery processes are far shorter and less verbose than the Support processes.
  7. Worst case - skip one chapter
    If you absolutely must leave out one chapter, let that be Availability Management. Far too long. Just glance through the key concepts from there and you should be fine.
  8. Draw, draw, draw
    Draw diagrams straight out of the ITIL books. The best example is the one on Release Management. The one process where I scored a perfect 10 was Release Management. And that was the only one diagram I was fully confident I had got an exact copy paste from the book. Coincidence? I don't think so.
  9. Make sure you get an extra half hour
    The standard exam is 3 hours each. But if your first language is not English, you can specify that with your examination body before the exam - that should get you an additional 30 mins time. Trust me - every extra minute helps!

Let me know what you think. And good luck.

Posted by Arvind Raman at 10:44 AM | | Comments (3) | TrackBacks (0)

July 22, 2008

IT Controls: Essential vs. Excellent

Posted by Bhoopendra Adhikari

The Data breach report 2008 from Verizon business risk team shares many useful results some of which are surprising, some commonly known and some encourage us to look at few old things in a new way. The report is debated widely among the IT security community since its release and I am picking few related results here which in my opinion give an insight on a key aspect of your IT controls eco-system:

  1. 83% percent of breaches were caused by attacks not considered to be highly difficult. 85% were opportunistic.
  2. Only 4% of data breaches were discovered by existing event monitoring and log analysis tools. This percentage is nearly same as breaches that were discovered by routine internal audit (3%).
  3. No breaches were noted for systems which were patched within one month of vulnerability identification.

It’s easy to deduce that all of the above are related to IT security and control environment but the common thread which relates the first two is lack of the ‘essential’ elements either in control design or operation. Third one establishes that if you maintain at the least the ‘essential’ (without rushing for deploying the patch as soon as it’s released) you are good. Now like any research document the report has its shortcomings but still it gives everyone of us who is interested in IT controls some food for thought.

 

So ‘essential’ is adequate to prevent most security breaches if the philosophy is applied uniformly to all the required risk areas. What it means is that implementation of an essential set of effective controls to all identified risk elements is far better then applying excellent set to some and ignoring others totally. I use the word effective with a control always, as having a control means nothing unless it’s effective in design as well as operation.

 

Quest for excellence also sometimes make people overlook effectiveness and sustainability of control operation. You can adopt and deploy an expensive, top in line event analysis and monitoring tool (which the vendor promised will bring the desired excellence in security) but if its not supported by a regular and efficient process of analysis and monitoring you will end up having a fake sense of security which a script kiddie can quickly bring to its knees.

 

To wrap it up it’s always a good strategy to apply essential controls, ensure they work well and then target the excellence part. Not only you have a peace of mind that you have a comfortable control environment while you are pursuing excellence but also it’s better to handle the advance pieces of security in a gradual (also different) way then the essentials piece.

Posted by Guest Author at 09:56 PM | | Comments (1) | TrackBacks (0)

Introducing Bhoopendra Adhikari

Deep Insights come from those in the thick of action. Introducing Bhoopendra Adhikari- someone who's been throught it all. He is an IT risk and compliance consultant and is CISSP, CISA, CISM and PMP certified professional. He has a wide range of consulting experience in IT Risk, Compliance and Governance domain. Over to you Bhoopen

Posted by Ramshankar Ramdattan at 09:12 PM | | Comments (0) | TrackBacks (0)

July 18, 2008

Accelerating an ITSM Transformation

Posted by Shraddha Tilloo, Consultant, Infosys Technologies.

While on my way to the airport, I noticed the fast growth taking place in and around the city in terms of the infrastructure, facilities and technology as well. With the new Bangalore International Airport located 40 miles away from city, my journey was a big long 2.5 hrs, cutting across the city gave me an opportunity to closely watch this change.Smile

Soon I realized that in this agile environment, there is no place for slow movers. It applies to the organizations as well where all the initiatives, products and services have to be just in time, quick and at an accelerated speed. It is more prominent and prudent for IT organizations which are coping up with unprecedented pressure of being a cost effective, innovative, agile and customer focused service provider. In the course of meeting these business demands, IT organizations take on the IT Service Transformation journey.

Soon after starting on this journey, IT organizations adopt the guidelines and practices from ITIL, only to realize that besides these guiding principles, they also need help around the faster implementation of ITSM. They have the vision, goals and objectives but do not know what is the best way, shortest method and a definitive approach which will take them to the point of success and most importantly, in just the right time.

The million dollar question in front of most of the IT organizations is: How can I accelerate my ITSM Transformation? Is there a packaged solution which helps expedite this journey and achieve the goals faster?

In this blog I wish to bring out this important aspect of ITSM transformation, where lack of a definitive approach and a comprehensive methodology makes these initiatives, out of sync, out of time and eventually out of market as well.

Please watch my next entry on this blog and post your comments..

Thanks

Shraddha Tilloo

Posted by Guest Author at 06:01 AM | | Comments (0) | TrackBacks (0)

July 17, 2008

On diversity ... Introducing Shraddha Tilloo

"IT is not a great atmosphere for those with families and women with children are constantly having to compromise." Says Deloitte's CIO Mary Hensher, in a recent edition of CIO. And for women in consulting that pressure is far higher. Being flexible about work locations and being willing to relocate on a short notice are what characterize a typical process consultant's life.

Just three years ago, I remember even our consulting group had less than five women consultants. However, things have changed for the better now. That number today stands at a healthy 30%! One giant leap that. As one of the long-standing consultants within our group, Shraddha Tilloo should know all about the ups, downs and pressures that come along with the job of being a traveling consultant with a family.

With over 12 years of experience in the IT industry, Shraddha has played key roles in IT Infrastructure Management Services including advisory roles in consulting, planning & implementation of ITIL & ITSM transformation initiatives for Fortune 100 clients across the globe. Her entry into process consulting was quite a natural progression with her strong Enterprise Service Management background. Among her assignments, she fondly recollects conducting ITIL assessments for a US Insurance major and a CA NSM tool assessment. She enjoys advising clients in the development of Service Management Strategy. She has shown her thought leadership in developing Intellectual properties for Infosys as well.

On a personal front, she loves to travel across the world, understanding different people, cultures, preparing cuisines such as Thai, Greek & Mexican burritos. Needless to say Indian cuisine tops the list of her all time favourite cuisine. She is also a social entrepreneur of sorts and wants to create a difference in the world through e-education in remote villages.

Posted by Arvind Raman at 11:57 AM | | Comments (0) | TrackBacks (0)

July 10, 2008

Delivering IT Service Management Consulting from Offshore – Part 2

By Bruno Calver

In my last entry I discussed some of the benefits of the offshore consulting model, of which there are many, and concluded that overall it was definitely advantageous to the customer. In this posting, I want to open the door a little into some of the challenges I came across when working offshore and what I did and suggest could be done to address them...
 

As mentioned in my last entry, I am used to fairly frequent and rich client interaction, putting to use a number of soft skills and making judgements on when to probe further on certain issues and just as crucially when to leave alone. I especially enjoy a good debate and the process of challenging existing modes of thought. I like getting to the nub of a problem and directing activity to root cause type solutions rather than just addressing things on face value.

It would be dishonest to pretend that as an offshore consultant you get this same kind of opportunity, it just is not possible, especially when working with a customer in the U.S. where the time difference is so pronounced. You are reliant on your onsite counterpart to relay their interpretation of client interactions, agreements and events and then take direction from them on next steps.  There is limited room in this context for the creative contribution of solution ideas from offshore. Having said that, my onsite counterpart was very willing to engage in debates on project approach and the like, which was great.

To get even more out of the process I think requires some selling of offshore capabilities, i.e. getting the client to buy into the fact that further quality can be delivered from offshore and preparing them for slight in-flight course adjustments as a result. The offshore consultant has the advantage of both being physically and mentally distant from the client therefore giving them an objective view of the work, sometimes this can lead to clearer insights.

There can also be a tendency for an onsite consultant to focus on all the nice creative stuff and expect to ship out all the leg work offshore and I have heard stories of this kind of thing. This is to a degree correct in the context of the model, but a balance needs to be found, it should not work exclusively in this way. I know, as when I was working in previous companies I had to do the client relationship stuff and the leg work that backs it up. In long term assignments such an approach is bound to de-motivate the offshore consultant and they are in danger of just feeling like a robot that has to do as programmed from over a thousand miles away.

As previously mentioned, the offshore role is naturally subordinate, given this I am not sure that it is always ideal to have highly experienced consultants working in this situation. What the role does offer, however, is an excellent proving and development ground for less experienced consultants, giving them the confidence and exposure to projects, enabling them to grow into more senior roles at a sensible pace. In practice this is very much the model that is employed at Infosys.

I am really glad I took the time to work in Bangalore as now I feel that I will be able to work with my offshore colleagues far more effectively when I’m onsite. I will try to keep in mind the need to take on board suggestions and leave space for input from offshore and ensure that those suggestions are visibly taken up with the client. I will probably be spending most of my time in Europe so given the time difference is not as acute as the U.S. this will also mean I can include offshore colleagues in client meetings over the phone. Finally, I have got to know a lot of my colleagues who often work offshore much better and I am sure this will make working with them a lot easier and more enjoyable.

On a personal note, I have taken pleasure in growing a beard, just because I can in India, I would not dream of it in the UK!

Unfortunately, I will be leaving India soon, so I think in my final blog of the series I might discuss some of the general aspects of living in India and some of my more interesting experiences (and of course shave off the beard Frown)…

Bruno with beard!

Posted by Bruno Calver at 04:46 AM | | Comments (4) | TrackBacks (0)

July 08, 2008

Delivering IT Service Management Consulting from Offshore – Part 1

By Bruno Calver 

So, it has been some time since my last post, that’s because I have recently been working on an IT Service Management project from Offshore, not that that should be an excuse to suspend blogging! The project was to design an IT Service Management audit framework for a U.S. finance customer.

In this post I want to talk about the specific experience of working offshore, as well as some general observations regarding working in a company with an offshore/onsite consulting delivery model. I think the picture is slightly different when it comes to high value services such as consulting in comparison to operational support and delivery activities.

 

First, how was it delivering a project from offshore? To be honest, a radical change to how I normally work. In my previous roles, a mixture of project management and onsite consulting, I have always been client facing and I found it to be one of the more enjoyable aspects of my work. Working offshore certainly required an adjustment in approach! Let’s start, however, by looking at the positive aspects of the onsite/offshore consulting model.

First, having an offshore consultant very much focuses activity on outputs and deliverables. The onsite consultant manages the client end and assignment approach, whilst the offshore consultant’s efforts are channelled towards tangible outcomes and products. I guess the enhanced productivity is based on the division of labour principle.

I also found that with so many colleagues around me (as all the offshore consulting team work in the same office), I always had excellent help and support on tap. This is in contrast to the normal situation where you are on a client site and you are on your own or with just one or two colleagues. One area I received a fair amount of assistance was in using some of the advanced functions in Microsoft Excel, my skills were a bit rusty!! This was not the only area, of course, and the pool of knowledge sat around me across a whole range of IT service management disciplines was very reassuring and often useful.

In addition, there is the well known benefit of what I call the ‘relay race’, what I mean by this is that the onsite consultant briefs the offshore consultant late in the evening, they go to sleep and when they wake up and the offshore consultant has already progressed the project by a day. Most work is serial in my experience so in this sense the time difference is a significant accelerator to delivery. A simple example would be when working on a spreadsheet tool, two people can not edit it at the same time and it is tricky to split the work if formulas are inter-dependent across work areas. Of course, the handover from onsite to offshore must be very carefully managed otherwise it is easy to spend a day offshore working in a slightly divergent direction.

One other general advantage I wanted to mention is that with the offshore consulting model there is a lot more time for practice development. This, I think, is because there is a much lower cost of research and capability building by offshore resources, again this presents the added bonus of more collateral and artefacts to back up consulting engagements.

These benefits, combined with the obvious cost advantage (which is considerable, having seen the difference in rates between purely onsite providers) are a significant bonus to the client, things get done quicker and at a reduced cost.

In my next blog I am going to talk about some of the challenges we face with offshore consulting, which I alluded to in my introduction. I will also discuss some of the things that we do to try and ameliorate some of these issues…

 

Posted by Bruno Calver at 08:02 AM | | Comments (0) | TrackBacks (0)