EPS IT Infrastructure Planning & Implementation Rev 13(2)

8/10/2019 EPS IT Infrastructure Planning & Implementation Rev 13(2)

1/82

1

IT Infrastructure

Planning and Implementation

Dr. Gita A. KumtaSchool of Business Management

NMIMS (Deemed University)


2/82

The Impact of IT on Businesses

Technology is redefining the business model,

and creating major opportunities for

companies positioned to take advantage.

The IT infrastructure is now so intimately

enmeshed with business processes, that it

effectively dictates the pace of change. Growing dependence of businesses on

Information Technology.


3/82

IT as a Financial Responsibility

How should IT investments be designed and

managed to ensure alignment with corporate

strategy

What other components are required to realize

the full potential of IT?

What are the risk implications of theseinvestments?

How can the value of IT investments be

managed over time?


4/82

The Four Ares

Alignment Benefits

Capability/EfficiencyIntegration

The Information Paradox:John Thorp

Are we doing

the right

things?

Are we doing

them the right way?

Are we getting

the benefits?

Are we getting

them done well?


5/82

Purpose of IT Management

Reduce duplication of effort Ensure adherence to standards

Enhance the flow of information throughout an

information system

Promote adaptability necessary for a changeable

environment

Ensure interoperability among organizational and

external entities Maintain effective change management policies

and practices


6/82

Managing IT


7/82

Components of IT

Management Application Software Understanding Requirements

Evaluating Solutions & Options

Identifying the gap Deploying the solutions

ICT Infrastructure

Hardware

System Software

Network

Data Management


8/82


9/82

Business Perspective

Collection of best practices suggested to address some of theissues often encountered in understanding and improving IT

service provision.

Business Continuity Management

Surviving Change. IT infrastructure changes can impact

the manner in which business is conducted or the

continuity of business operations.

Transformation of business practice through radicalchange.

Partnerships and outsourcing.


10/82

What do we need to do?

Manage

Development

Deployment

Capacity & Connectivity

Operations & Facility

Ensure Business Continuity


11/82

Infrastructure Management

Processes Design and Planning

Deployment

Change Management

Operations

Technical Support


12/82

Maintenance Of Information

Systems

Systems maintenance is the on-going maintenance of a

system after it has been placed into operation.

Systems maintenance can be categorized into four groups.

Each of these four categories can affect an organization's

information strategy plan in different ways:

Corrective Maintenance

Customized Maintenance

Enhancement Maintenance

Preventive Maintenance


13/82

Change

No matter where you are in the system life

cycle, the system will change, and the desire

to change it will persist throughout the lifecycle.

Bersoff, et al, 1980


14/82

Dr. Gita A Kumta, NMIMS

What is a Change?

Change in the configuration of Hardware /

software on the desktop

Change in the functionality of the system

Change in the configuration of Hardware /

software on the server

Change in the Network configuration

Change in the storage requirements

Change in the location Change in the Profile

Change in the Business Process


15/82

Change Management

Plan or Manage the Change so that users

and System are ready at the same time and

expectations on both sides are matched Theres no change, no matter how awful, that

wont benefit some people, and no change, no

matter how good, that wont hurt some.( Verblens Principle (Weinberg and Gause 1989)


16/82

Components of Change

Management

Strategies for awareness, acceptance &

incorporation of change into the organizations

environment

Systems Administration of hardware andsoftware components

Version and Change Request Control

Conducting business differently (BusinessProcess Reengineering).

Changes in Roles: requires knowledge transfer

and skill development.


17/82

Change

Manager

Development

Project

Team

Prepare Users Prepare System

Convergence

Change Management Processes


18/82

Key Principles of Change

Management

Steering Committee Must Have Product and Process

Champions or Stakeholders

Communication needs to multi-channeled (up is as valued

as down) Conflict resolution and knowledge acquisition are

collaborative (information sharing not hoarding)

Implementation Team (change management team) has a

structure and roles of individuals are defined Resistance to Change is always there but may be hard to

detect until after Go Live (Be Proactive)


19/82

Who initiates a Change in the

Application? End- user

Application developer System Administrator

Database Administrator

Project Manager AMC Vendor


20/82

Change Management

A Process to control & Coordinate all changes toan IT production environment

Control involves:

Requisition

Prioritization

Approval

Coordination involves:

Collaborating

Scheduling Communicating

Implementing changes

Several flavours of change management


21/82

ScopeChange Control

Request:submit a change proposal

to a reviewing board

Prioritize:specify priority of changebased on criteria already agreed

upon

Approve: recommend for

implementation or defer


22/82

Storage Management

Optimizing involves ensuring:Maximum amount of usable data is written &

read at acceptable rate of response

Availability of adequate amount of storagespace

Protecting integrity implies:

Data will always be accessible to authorizedusers & it will be changed only by them

Reliable backups are available for recovery in

the event of loss of data


23/82

Backup and Recovery

Backup -an exact copy of a systems

information

Recovery- the ability to get a system up and

running in the event of a system crash or failure

and includes restoring the information backup


24/82

Major Backup Considerations

Backup window

Restore times

Expiration dates

Retention periods

Recycle period

Generation data groups

Offsite retrieval times Tape density, format, packaging

Shelf life

Automation techniques


25/82

Types of Data Back-up

Physical backup: copying the data as it

resides physically on the disk without regard

to database structures or logical organization Three categories:

Full backup:

Incremental backupOnline backup


26/82


27/82


28/82

Disaster Recovery/ Business

Continuity Planning Disaster Recovery Planning

The strategic and detailed

planning for the timelyrestoration of information

technology, network and

telephony following a

disaster.

Business Continuity Planning

The strategic and detailed

planning for the timelyrestoration of vital business/

support functions following a

disaster.


29/82

Business Continuity Planning (BCP)

A plan for how an organization will

recover and restore partially or

completely interrupted criticalfunction(s) within a predetermined

time after a disaster or extended

disruption.


30/82

The Cost Of Downtime

REVENUE Direct Loss

Lost Future Revenue

Billing Losses

Investment Losses

FINANCIAL

PERFORMANCE Lost Market Share

Revenue Recognition

Cash Flow

Payment Guarantees Stock Price

Credit Rating

OTHER EXPENSES Temporary employees,

Equipment Rental,

Overtime,

Extra Shipping Costs,

Travel Expenses,

Etc.

REPUTATION Customers

Suppliers

Financial Markets

Banks

Business Partners Etc.

PRODUCTIVITY Loss Of Productivity

Employees Impacted @ X

Burdened Hourly Rate

LEGAL/REGULATORY Contractual Requirements

SLAs

Regulatory Requirements

Why Business Continuity?


31/82

Creating BCP/DRP

Identify the scope and boundaries of business

continuity plan. It provides an idea for limitations

and boundaries of plan.

Conduct a Business Impact Analysis (BIA).

In case of disaster, each department has to be

prepared for the action.

The BCP project team must implement the plan.

National Institute of standards and Technologies has

published tools which can help in creating BCP.


32/82

Disaster Recovery


33/82

DRS Strategies

Prior to selecting a disaster recovery strategy, a

disaster recovery planner should refer to their

organization's business continuity plan. organization's business continuity plan should

indicate the key metrics of

Recovery Point Objective (RPO) and

Recovery Time Objective (RTO)

for various business processes (such as the process to

run payroll, generate an order, etc).


34/82

Disaster Recovery Site

Hot site - a separate and fully equipped

facility where the company can move

immediately after a disaster and resumebusiness

Cold site-

a separate facility that does nothave any computer equipment, but is a

place where employees can move after a

disaster


35/82

Disaster Recovery

Disaster Recovery Plan -a detailed processfor recovering information or an IT system inthe event of a catastrophic disaster such as a

fire or flood

Disaster Recovery Cost Curve

Cost of the unavailability of information andtechnology

Cost of recovering from a disaster over time.


36/82

Perspective on Capacity Planning

A server operating at 60% capacity is good

news for performance tuning specialist but a

matter of concern for financial analyst who

views the 40% as unused resources and

wasted costs


37/82

Capacity Planning

A process to predict the types, quantities, and timing

of critical resource capacities that are needed within

an infrastructure to meet accurately, forecasted

workloads and ensure adequate capacity. Ensuring adequate capacity involves:

Types of resource capacities required such as servers, disk

space, or bandwidth

Size or quantity of resource in question

Exact timing of when the capacity is needed

Thorough forecasts of anticipated workload demands


38/82

Capacity Planning and

Capacity Management

Capacity Planning is a Strategic activity

Focuses on the future - based on workloadforecasts

Capacity Management is a Tactical activity

Focuses on the present- involves optimisingthe utilisation and performance of the

infrastructure resources


39/82

Resources to be Considered Network bandwidth

Centralized disk space

Centralized processors in servers

Channels

Tape drives, cartridges, etc. Centralized memory in servers

Centralized printers

Desktop processors

Desktop disk space

Desktop memory


40/82

Workload Forecast WorksheetItem Current

Status

Forecast

6months

1year

2years

Total users

Concurrent users

Transactions per dayDisk space required (GB)

Expected response time (sec)

Print requirements (pages/day)

Backup requirements

Desktop processing requirements

Desktop disk requirements

Desktop print requirements

Remote network requirements


41/82

Network Management Process Integration

An effective network management process will

have strong relationship with the following six

system management processes:

Availability

Performance & tuning

Change management

Problem management Capacity planning

Security


42/82

Incidence Handling

Response by a person or organization to an attack.

An organized and careful reaction to an incident

Sequence of steps that need to be followed

Preparation

Identification of Attack Containment of Attack

Recovery and Analysis


43/82

What are Problems?

Problem with desktop- Not booting

- PC hangs

- Office software does not work

Production service interruption

- Inability to access the network

- Extremely slow response to online applications

- Functionality problem within applications


44/82

Problems, Changes & Requests

Changes may cause problems or can be aresult of a problem

Problem may cause a change or may be the

result of a change Requests applies to individuals requesting

services or enhancements

Initial input may be similar but managingeach will vary significantly


45/82

Developing a Problem Management

Process

Select an executive sponsor & assign aprocess owner

Assemble a cross-functional team

Establish a priority & escalation scheme

Design call handling process

Select & implement a call-tracking tool

Negotiate service levels

Review metrics continually to improve

process


46/82

Sample Priority & Escalation Scheme

Priority

Levels

Description Examples Response

Time

Escalation

Time

Critical (impacts

business & systems)

Total system or

application failure or

loss of availability

Critical

database

corrupted

Immediate 30 minutes

Serious (impacts a

system or functionality)

Major system or

application failure

Billing

centre

down

1 hour Daily

Moderate (some impact

on system or

functionality

Some system or

application failure

Individual

desktop

problems

4 hours Daily

Low (minimal impact

on business operations)

Some peripheral

failure

Report

format

problems

As able Weekly


47/82

Problem Management

Opening of problems: registering problems.Properly opened tickets can lead to quick closing

of problems or escalation

Closing of problems: customers confirmation that

the problem resolution activity was satisfactory &

that there is no recurrence

Closing a problem is distinct from resolving a

problem A problem is closed only when the customer is

satisfied


48/82

C f A


49/82

Common Types of Attacks

ConnectionFails

Organizational

Attacks

RestrictedData

AccidentalBreaches

In Security

Automated

Attacks

Attackers

Viruses,

Trojan Horses,

and Worms

Denial of

Service (DoS)

DoS


50/82

Layers of Security

Physical Security

Personal Security

Operational Security

Communications Security

Network Security Information Security


51/82

Security Model

Prevention

Accesscontrols

Firewall

Encryption

AntiViruses

Detection

Audit Logs

IntrusionDetection

System Anti

Viruses

Response

Backups

IncidentResponse

teams Computer

Forensics

Protection = Prevention + (Detection + Response)


52/82

Information Security Criteria

Authentication: Who r u? Authorization: What can you do?

Confidentiality & reliability: Privacy & dependability

Monitoring & tracking: What did you do?

Backup & recovery: Rebuilding the system Physical security: Locking the others out

Change Management: Protecting the business process

Legal Requirements: What the law expects

Training & awareness: What you need to know? Contingency planning: What if?


53/82

Security Management

Data & programs are critical corporate assets to

be protected through policies that are

developed, approved, implemented & enforced.

A process designed to safeguard the

availability, integrity, & confidentiality of

designated data & programs against

unauthorized access ,modification, ordestruction.

C t I f ti S it


54/82

Corporate Information Security

Management-Process Flow

54

Development Monitoring Measurement

Develop

Corporate

Information

Security Policy

Develop

ControllingFramework

Develop Support

system

Framework

Monitor &

Review

Information

Security Policy

Awareness

Monitor &

ReviewInformation

Security Level for

the Servers &

Desktops (PC,

Notebook, and

else)

Measurement of

compliance to ISO

27001 & COBIT

Analysis of

system

vulnerabilitiesAnalysis on

Information

Security incidents

Review of

existing policies

Maximize the use

of all application

of information

security

management

Sharing good

practice in

informationsecurity

management across

business units

Improvement of

existing policies

CORPORATE INFORMATION SECURITY MANAGEMENT PROCESS

Improvement


55/82

Policies, Standards & Procedures

Policies Formulated by Senior Management.

Standards are built on sound policies.

Practices, Procedures and Guidelines.

Detailed rules / steps required to meet

standards.


56/82


57/82

Security Architect: Control Analysis

Placement

Effectiveness

Efficiency

Policy

Implemen-

tation

Where are controls located?

Are controls layered?

Is control redundancy needed?

Does control protect

broadly or one application?

If control fails, is there a

control remaining?(single point of failure)

If control fails, does appl. fail?Are controls reliable?

Do they inhibit productivity?

Are they automated or manual?

Are key controls monitored in real-time?

Are controls easily circumvented?

Do controls fail secure or fail open?

Is restrictive or permissive policy

(denied unless expressly permitted

or vice versa?)

Does control align with policy

& business expectation?

Have controls been tested?

Are controls self-protecting?

Do controls meet control

objectives?

Will controls alert security

personnel if they fail?

Are control activities logged

and reviewed?


58/82


59/82

Key Customers of IT Services

Someone whose success critically dependson the services you provide.

Someone who frequently uses, or whose

organization uses, your services.

Someone who has significant impact on

your organisation. Some one who, when

satisfied, helps assure your success as an

organization.


60/82

Key Services of Key Customers

IT Professionals normally agree to Project

schedules that cannot be met,Availability levels that

cannot be reached, Response times that cannot be

obtained and accept Budgets that cannot beenhanced.

Negotiating and Managing Realistic Customer

Expectations.- Face-to-face interviews with key customers

- Explain nature & cause of the problem, what is

being done to resolve and prevent it in future

i i G


61/82

Points that undermine Good

Customer Service

Presuming your customers are satisfied

because they are not complaining

Presuming that you have no customers

Measuring only what you want to measure to

determine customer satisfaction

Presuming that written SLAs will solve

problems, and ensure great customer service


62/82

The Universal Truth

An unreasonable expectation,

rigidly demanded by an

uncompromising customer and

naively agreed to by a well-

intentioned supplier, is one of themajor causes of poor customer

service.


63/82

People Management

No matter how well you design and

implement the IT managementfunction and processes, they are likely

to fail if adequate attention is not given

to the 'people issues'.


64/82

Acquiring Executive Support

Build a Business Case: Cost-Benefit Analysis

Highlight application of Cost effective

technology rather than Tech itself. Educate Executives on the value of Systems

Management.

Managers love alternatives, hate surprises and

appreciate meaningful business metrics.


65/82


66/82

Information Systems Organization

System Management groups need to evolvetheir organizational structures so as to succeedin delivering the service levels required by the

organization. Most companies start with a structure, which

has three basic functions

- Application development & maintenance

- Operations

- Infrastructure management

Organization of IT System Function


67/82

Organization of IT System Function

IT Manager/

CIO

Systems

developmentOperations

Technical

support

Analysis and

Design

Programming

Documentation

User training

Production

support

Data entry

Computer

operations

Systems

administration

Database

administrationData

Communications

S it P f i l d th O i ti


68/82

Security Professionals and the Organization

Chief Information Officer (CIO)

Translates the strategic plans of the organization as a whole

into strategic information plans for the Information Systems.

Chief Information Security Officer (CISO)

Assessment, management and implementation of securing the

information in the organization.


69/82

Staffing of Systems Management

Functions Skill sets and Skill levels

Basic Characteristics

Attitude, Aptitude, Applicability, Experience

Process of selection of staff

Retention of staffTraining, counseling, job enrichment


70/82

ImplementingIT System

Management Every IT organization wants to be known

for its proactive monitoring and automated

Service Level Management. Cost to Manage

Hardware, Software, & Maintenance.

Facilitiesbuilding, cooling, electricity,access control, disaster recovery sites.

Peopledesign, operations, support.


71/82

Supporting Systems

Asset Management: If you know whatresources you have used in the past, you can

better plan for the future.

Analysis: identifying potential problems beforethey happen.

Reporting: Quick notification gives a jump to

the technical team who repairs the service. Knowledge Management: Repository of

failures and resolutions- effective training tool.


72/82

IT Infrastructure Library (ITIL)


73/82

IT Infrastructure Library (ITIL)

ITIL is a set of best practices standards forInformation Technology (IT) service management.

Provides businesses with a customizableframework of best practices to achieve quality

service. Consists of a series of books giving guidance on

the provision of quality IT services and thefacilities needed to support IT.

ITIL framework: Eleven disciplines, two sections- Service Support

- Service Delivery


74/82

ITIL Service Delivery Model


75/82

Business, Customers and Users

QueriesEnquiries

Service LevelManagement

AvailabilityManagement

CapacityManagement

FinancialManagement

For IT Services

IT ServiceContinuity

Management

CommunicationsUpdatesReports

RequirementsTargets

Achievements

SLAs, SLRs OLAsService reportsService catalogueException reportsAudit reports

IT continuity plansRisk analysisRequirements defnControl centersDR contractsReportsAudit reports

Financial planTypes and modelsCosts and charges

ReportsBudgets and forecastsAudit reports

Capacity planTargets/thresholdsCapacity reportsSchedulesAudit reports

Availability planAMDBDesign criteriaTargets/ThresholdsReportsAudit reports

Alerts andExceptionsChanges

ManagementTools

Executives are asking tougher questions


76/82

Executives are asking tougher questions..

76

Am I sure that my business

can keep going in a crisis or

emergency?

Do we really need a

disaster recovery plan?

Do we have service

level agreements with

our users?

Are we building

operational excellence into

our IT service?

If the system fails, how

quickly can it recover?

How can we get the right levels

of security & availability in our

new system from day one?

The pastToday

CEO

CIO

IT

Manager

Need for Value Management


77/82

Need for Value Management


78/82

Focus Areas Constituting IT

Governance Strategic alignment

Value delivery

Resource management

Risk management

Performance measures

IT Governance: CobiT 4 1


79/82

IT Governance: CobiT 4.1

Consists of the leadership, organizational structuresand processes that ensure that the enterprises ITsustains and extends the organizations strategiesand objectives.

COBIT structure: COBIT covers four domainsPlan and OrganizeAcquire and Implement

Deliver and SupportMonitor and Evaluate


80/82


81/82

What is Val IT Primarily targeted at IT-enabled business

investments in sustaining, growing or

transforming the business with a critical IT

component. Provides a comprehensive, structured and

proven-practice based source, including the

overall governance framework and supportingprocesses to maximize the return on IT-

enabled investments.

What does Val IT do?


82/82

What does Val IT do?

Fosters the partnership between IT and the rest of thebusiness

Assists the board and executive management in

understanding and carrying out their roles related to

IT-enabled business investment

Helps enterprises make better decisions on where to

invest in business change

Provides a common language for executives, businessmanagement and IT professionals to ensure IT-related

investments are in line with business strategy

EPS IT Infrastructure Planning & Implementation Rev 13(2)

Documents