Luis lima v3
0 likes11 views
Cloud computing does not fundamentally change the core IT management disciplines and processes defined in ITIL. The key ITIL processes of Service Strategy, Design, Transition, Operation and Continual Service Improvement still apply when adopting cloud computing.
Luis lima v3
- 2. Cloud Computing Defined NIST “Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” GARTNER “A style of Computing where massively scalable, IT –enabled capabilities are provided “as a service” across the internet to multiple external customers”
- 3. Cloud Computing Vantages Reduced • Cloud technology is paid incrementally, saving Cost organizations money. Increased • Organizations can store more data than on private Storage computer systems. Highly • No longer do IT personnel need to worry about keeping Automated software up to date. • Cloud computing offers much more flexibility than past Flexibility computing methods. More • Employees can access information wherever they are, Mobility rather than having to remain at their desks. Allows IT to • No longer having to worry about constant server updates and other computing issues, government organizations Shift Focus will be free to concentrate on innovation.
- 4. What is IT Service Management (ITSM)? The origin of the term is generally unknown, but it has been in mainstream use during the 1990s, historically it has been associated with the introduction of, or improvement of existing IT operational practices through the adoption and adaptation of industry “best practices” ITIL® defines ITSM as, “The implementation and management of quality IT services that meet the needs of the business...” Wikipedia defines IT Service Management as, “a discipline for managing information technology (IT) systems, philosophically centered on the customer’s perspective of IT’s contribution to the business... IT Service Management is also the term commonly used to describe the process centric effort of transforming an IT organization from one focused on managing the IT infrastructure, to managing the provision of information system services.
- 5. ITIL Service Management v2 ITILv2 – 10 processes Support Service Incident Problem Change Configuration Release Management Management Management Management Management 5 Processes and a function (Service Desk) Delivery Service Service Level IT Financial Availability Capacity IT Continuity Management Management Management Management Management 5 Processes
- 6. ITIL Service Management v3
- 7. ITIL Service Management v3 ITILv3 – 5 books and 27 processes Service Service Service Service Cont Service Strategy Design Transition Operation Improvement Service Transition Demand Event Service Catalog Planning & Management Management Measurement Management Support Strategy Service Level Change Request Service Generation Management Management Fulfillment Reporting Service Asset & Incident Service Capacity Portfolio Configuration Management Improvement Management Management Management Release & Problem IT Financial Availability Deployment Management Management Management Management Service Service Access Continuity Validation & Management Management Testing Information Security Evaluation Management Supplier Knowledge Management Management Processes Processes ITILv3 Processes ITILv2 ITILv2 + ITILv3
- 8. Core IT Management Disciplines Have Not Changed ITIL for the Organization lTlL. for the Cloud Provider Service Architect service solutions by Identify services provided, their value Strategy piecing together Cloud service and costs, demand management is key providers and their service for providing on-demand services offerings Service Focus on integrating and securing Bundle service packages for Design services from suppliers consumption - capacity management key to disruption free, on-demand delivery. Service Manage and control a complex mix Provide customers with easy, smooth Transition of releases /changes across a wide and state ways to transition and access range of suppliers varying provided services schedules and priorities Service Ensure expected value is being Ensure that expected value is being Operation delivered, and service disruptions delivered and that services are not responses are coordinated across disrupted suppliers Continual Provide the needed transparency Provide a means for staying ahead of Service of results and coordinated competition and gauging customer improvement improvement efforts across many satisfaction or business will be lost providers.
- 9. Service Strategy Process Purpose Strategy Generation Identify the IT services, investments partners and delivery channels to meet customer needs and outcomes Service Portfolio Manage the investment portfolio of all the services Management avaiable to customers and users Demand Identify patterns of bussiness activity that consume Management services and manage activities to influence demand. IT Financial Management accounting and chargeback for IT Management services
- 10. Service Strategy Questions What Cloud Operating Model(s) will be used? What elements of services will be placed in the Cloud? Which service partners will we utilize? Who are my customers and what are they needs? What services will need to be provided? How will business demand consume services?
- 11. Service Strategy Input Output Organizational Strategic Asset Strategic capability Service Objectives Drive Business Strategy Define market space value Additional enterprise stakeholde Cloud rs Services Cloud Computing will not change The strategic objectives or the market spaces of a service
- 12. Service Strategy Input Output Provide understanding Cloud of business providers needs Measure and compare supplier performance Align Valued contracts Service with Partner business needs Maximixe Return of Investment (ROI) by selectin the right provider
- 13. Service Design Process Purpose Service Catalog Publish manage and communicate which services are available to Management customers and users Service Level Negotiate, monitor, report and measure SLA and OLAs Management Availability Define, measure, analyze and improve the availability of services Management Capacity Ensure appropriate infrastructure capacity in place to meet service Management demand volumes Information Protect the confidentiality, integrity and availability of services Security Management IT Service Ensure services can be recovered in the event of a major business continuity disruption Management Supplier Ensure suppliers support the needs of the business and meet their Management contractual obligations
- 14. Service Design Questions How will services be bundled and packaged for consumption? What SLAs and OLAs will be needed to meet business objectives? How will we ensure availability of services in the event of a major business? How will we secure our services and data across the Cloud? What supplier agreements and contracts need to be in place? How will we communicate available services to the business? What capacity needs to be in place to meet business demand? How will services integrate and sit on the Cloud Operating Model?
- 15. Service Transition Process Purpose Transition Plan and coordinate activities for transitioning services to te live Planning and production environement Support Change Protect services while changes are being made Management Release and Manage releases and their deployment to live production Deploy Management Service Asset & Maintain information about configuration items used to support Configuration services and their relationships Management Service Validate that new services and changes will match design and Validation and business objectives Testing Knowledge Gather, analise, store and share knowledge to reduce the need for Management rediscovery of information Evaluation Ensure a service will meet intended business objectives when it is transitioned
- 16. Service Transition Questions How will services be transitionet to a live production state? How will changes be managed across providers? How will releases and deployments be coordinated across providers? How will we test services across providers? What operating information should we retain across providers?
- 17. Service Transition Input Output Cloud Organization Providers Change R A, C Change Planed Management Requests Changes Support RFC C R classification Change R C Scheduling R- Responsible Cloud A- Accountable Services C- Consulted I- Informed Cloud Computing will not change The strategic objectives or the market spaces of a service
- 18. Service Operation Process Purpose Incident Restore an IT service to normal state operations as quiet as Management possible Problem Prevent incidents from happening or minimize their impacts Management by identifying their root causes Event Manage operational events and communicate them to Management apropriate parties for further action Access Ensure only authorized users are allowed access to Management services Request Manage the lifecycle of all service requests Fulfillment
- 19. Service Operation Questions How will incidents and problems be managed across providers? What events need to be generated and visible across and between providers? How do we ensure only autorized users have access to services? How will we prioritize and coordinate user service requests that may need proviser involvement? How will we coordinate operational control activities across providers?
- 20. Continual Service Improvement Process Purpose 7step Measure services to proactively identify opportunities for improvement improvement Service Produce and communicate reports for achievements and Reporting trends against service levels Service Put appropriate metrics into place that provide information Measurement for proactive decision making Questions What key measurements will be needed to ensure services are working across the Cloud? What measurements should be taken by suppliers to ensure service objectives will be met? What information and reports will we require from our providers? How will we work with our providers to proactively improve services?
- 22. Paradigm Shift Consistensy Share & Reuse Security & Privacy Customizability Control Cloud On-Premisses Economy of Scale Easy of Provisoning Global reach Partitioning & Redundancy Scalability & Availability
- 23. On Premisses vs. in the cloud
- 24. Challenges and risks Security Concerns Lack of Standards Legal, Regulatory and/or Compliance Issues Lack of SLAs Performance concerns Commitment
- 27. SLA - Internal Computing The Business User SLA SLA Custumer Service Desk Business Relationship Management Internal IT Service Support OLA Operational Organizations OLA Service Delivery
- 28. SLA - Cloud Computing The Business User SLA SLA Custumer UC Service Desk Business Relationship Management Internal IT Cloud Provider Service Service Desk Support Service OLA Support Operational Organizations Operational Business Organizations Relacionshiop OLA Service Management Delivery Service Delivery Suplier Management
- 29. Legal, Regulatory and/or Compliance Issues Liability • What recourse actions (e.g., financial compensation, early exit of contracts, etc.) can we agree on in the event of a security incident or failures to meet SLAs? • What conditions under which. . .? Intellectual Property • Can we stipulate in the SLA that all my data (or applications), including all replicated and redundant copies, are owned by me? • Ensure your service agreement does not lead you to relinquish any IP rights • Scrutinize the language in the terms of service that governs the ownership of and rights to information that you place in the cloud.
- 30. Legal, Regulatory and/or Compliance Issues Business Continuity / Disaster Recovery • Do you have any DR and BC planning documents, and can we review them? • Can we do a BC audit? • Where are your recovery data centers located? • What service-level guarantee can you offer under DR conditions? Logs and audit trails • Can they accommodate timely forensic investigation? • How do we access logs and audit trails? • How long do you keep logs and audit trails? • Can e have dedicated storage of logs and audit trails, how? • Show evidence of tamper proofing for logs and audit trails
- 31. Legal, Regulatory and/or Compliance Issues Specific compliance requirements • Are your data centers under local compliance? If so, which ones? • Do the local compliance requirements violate our own? • Are you SAS 70-compliant (if applicable)? • Are you ISO 27001-compliant (if desired)? • Can you prove that you are compliant for: • PCI? • S0X? • HIPAA?
- 32. Security Concerns It recently found a flaw that inadvertently shares users’ docs (March 2009). A Salesforce.com employee fell victim to a phishing attack and leaked a customer list, which generated further targeted phishing attacks (October 2007). It lodged a formal complaint to the FTC against Google for its privacy practices (March 2009). EPIC was successful in an action against Microsoft Passport.
- 33. Security Concerns Data Protection • Data segregation • How do you separate my data from other customers? • Data-at-rest protection Were do you store my data? Encryption and data integrity Access control and authentication Is there documentation for auditors? • Data-in-motion protection How do you transfer data from one place to another? Can any third party access my data (your SPs). and how? Can you ensure all my data is erased at the end of service? Vulnerability Management • Show evidence of your Vulnerability management program. • How often do you scan for vulnerabilities? • Can I conduct an external vulnerability assessment on your network? • What’s your vulnerability remediation process?
- 34. Security Concerns Personal and physical security • Do you have restricted and monitored access to critical assets 24x7? If dedicated infrastructure is desired, ensure that it’s isolated. • How often do you scan for vulnerabilities on your network and applications? • Do you do background checks for all relevant personnel? How extensive? SAS 70, ISO 27001. Application Security • Do you follow OWASP guidelines for application development? • Do you have a rigorous testing and acceptance procedure for outsourced and packaged application code? • What about third-party apps (components) used in your services? • What application security measures (if any) do you use in your production environment (application-level firewall, database auditing)?
- 35. Security Concerns Incident Response • What is your procedure in handling a da breach? Can notification occur within a specified time period? In what form at do notifications go out? What info do they contain? • Can you ensure that vendors incidence response procedures do not violate our own requirements? Identity Management • Can you integrate directly with directories, and how? • Review the architecture of integration. • Ensure it doesn’t create a security risk for my own infrastructure. • If not, how do you secure user IDs and access credentials? • If not, how do you handle user provisioning? • Can you support single sign-on (SSO), and which standards? • Can you support federation, and which standards?
- 36. Commitment End of Service Support • Specify what the cloud vendor will deliver at the end-of- service period: • Will data be packaged and delivered back to me? If so, in what End-of-service format? • How soon will I have all my data back? • Will any remaining copies of data be erased completely from your network? If so, how soon will it happen? • Specify any fees that may incur at the end of the service.
- 37. Lack of SLAs Make sure any framework compliance requirements (i.e. Federal Enterprise Architecture, SOA, etc.) are documented and agreed within the Contract. Include a formal Change Control process in the Contract and declare the cloud provider’s architectural framework within the scope of the Change Control. Treat cloud provider contract as you would an underpinning contract. Document expected service levels, audit process and reporting requirements.