February 5, 2008 2:00pm EDT, 11:00am PDT George Spafford, Principal Consultant

1. Using Network Behavior Analysis (NBA) and Service Asset and Configuration Management (SACM) to Improve Management Information February 5, 2008 2:00pm EDT, 11:00am PDT George Spafford, Principal Consultant Pepperweed Consulting, LLC “Optimizing The Business Value of IT” www.pepperweed.com

2. Housekeeping • Submitting questions to speaker • Submit question at any time by using the “Ask a question” section located on lower left-hand side of your console. • Questions about presentation content will be answered during 10 minute Q&A session at end of webcast. • Technical difficulties? • Click on “Help” button • Use “Ask a question” interface

3. Main Presentation

4. Agenda • An Overview of Service Asset and Configuration Management • An Overview of Network Behavior Analysis • How we can leverage the two areas for the betterment of the organization

5. ITIL v3 • ITIL v3 was released on May 30, 2007 • The core principles are the same as v2 • Five core books (11.4 pounds!) arranged as a lifecycle • Service Strategy • Value nets, adaptive strategies, managing uncertainty, strategy selection • Service Design • Policies, architecture, models, outsourcing • Service Transition • Transition Planning and Support • Change Management • Service Asset and Configuration Management • Release and Deployment Management • Service Validation and Testing • Evaluation • Knowledge Management • Service Operation • Incident and Problem Management, alerting, new functions • Continuous Service Improvement • Business cases, Portfolio Alignment, Metric selection

6. An Overview of SACM • “Manages assets in order to support other Service Management processes.” • Service Asset = Capabilities + Resources (i.e. assets) • Asset types include management, organization, processes, knowledge, applications, infrastructure, etc. • Configuration Management delivers a logical view of the world • Relationships between configuration items (CIs) • Details about each CI • Concerned with the management of service assets and the relationship of configuration items (CIs) in them • Tracking and report on assets • Manage and protect the integrity of service assets and CIs • Ensure that only authorized components are used • Only authorized changes are made

7. Categories of CIs • Think of these as relational data tables • Service Lifecycle CIs • Business case, service lifecycle plans, etc. • Service CIs • Service Capability Assets: People, knowledge, processes • Service Resource Assets: Systems, applications, data • Organization CIs • Elements about the organization that must be shared • Strategic plan, corporate policies, regulatory requirements, etc. • Internal CIs • Hardware, software, and facilities • External CIs • Customer agreements, vendor agreements • Interface CIs • Service provider interfaces (SPIs)

8. CI Attributes • Think of these as data fields • What do you need to know about each CI to manage it? • Parent CI relationships • Child CI relationships • Make • Model • Processor • OS (which could be a CI) • Memory • IP Port Requirements

9. SACM and the CMS • Provides information to other processes and functions • Change, Release and Deployment, Incident, Problem, etc. • SACM is an enabler for these processes • Accurate data is critical • Data stored in Configuration Management System (CMS) • We used to discuss the configuration management database (CMDDB) • Federated CMDBs make up a CMS

10. Configuration Management System

11. SACM Problems • Chant “meaningful and manageable” over and over • Can generate a ton of useless data that costs more to collect and maintain than what it is worth • Don’t track because you can, track because there is real value • Likely that 20% of the data will create 80% of the value • SACM can be a six month project that turns into a two year project with no results • Start simple and learn • Sustaining efforts • Launching the project to design the process is one thing • The organization must then live with the design • Configuration drift • Production no longer matches the CMS • Why? Uncontrolled / unauthorized change • We need detective controls to detect changes

12. An Overview of Network Behavior Analysis • Evolved from looking for signatures at the firewall, IDS, and security event management • Weakness - Signatures only turn up known problems • NBA tools monitor network activity and look for abnormal activity based on baselines and heuristics • Monitor things such as • Communications between network nodes • Who the actual users are • Frequency of communication • What are servers and what are clients • What protocols and ports are being used • Network Traffic levels • Behaviors based on day and time of day • Combines data collection, analytics and meaningful presentation • Need to find the needle in the haystack

13. NBA is a Detective Control • Controls mitigate risks • Three broad categories of controls • Preventive • Policies • Procedures • Look and sound great but how do you know people are following them? • Detective • Review data about historical events and look for a condition • Can be used to confirm that people are following policies and procedures • Can be used to detect unauthorized activity in general • Corrective • Return the CI to its last known good state

14. Defense in Depth • Think of the rings of walls in a castle. More walls equate to an overall better defensive posture • We need preventive controls • We need detective controls • Configuration integrity management – change detection at the device level • NBA – last line of defense because it’s based on behavior

15. NBA can benefit security, compliance and operations • NBA’s roots are in security but with proper integration, other process areas can benefit. • Consider the benefits of understanding: • Changes in behavior due to changes • End-User Experience • Actual dependencies • Unauthorized services • Configuration errors • Misuse of services • Security incidents

16. Leveraging the Two Disciplines

17. Service Transition - Change Management • Concerned with managing the risk of making a change • A balancing act between the risk of making and not making a given change • Steps include: Recognition of need, record the request, review, authorize, plan, schedule the implementation • Change Mgt is responsible to ensure the CMS is updated accordingly • From SACM and the CMS we know what changes were authorized • How do we know about changes when people do not follow the process? • Problems with Change Management are SACM’s Achilles' Heel • NBA allows us to identify that something has changed: • Network behavior • Application behavior • User behavior

18. Must Understand What Changed • Authorized Person, Authorized Change • Authorized Person, Unauthorized Change • Well intentioned • Malicious (a security event) • Erroneous • Unauthorized Person, Unauthorized Change – A security event • The only valid level of unauthorized change is zero • Vital that other processes • Have reliable accurate data from SACM • Understand if there are changes that can’t be reconciled and what has changed • NBA serves as a last defense

19. Service Transition – Release & Deployment Management • Need to ensure that there is proper requirements definition, testing and deployment of releases into production • Can review historical activity to improve rollout planning • Can confirm production releases match tested releases • Can profile and fingerprint releases • Could highlight tampering or errors with the deployment into production

20. Service Transition – Service Validation & Testing Releases • Can identify in testing if behaviors meet standards • Only authorized ports are used • No connection to certain hosts • A better understanding of the impacts of new or changed services based on historic observed user behaviors • Can also determine if actual behaviors = expected behaviors

21. Service Operation – Event Management • Event Management is concerned with interpreting the monitored data and taking an appropriate action • Outputs from NBA are routed appropriately by Event Management • Rejection • Manual Review • Automatic Processing • Create an Incident • Create a Problem • Trigger a standard change

22. Service Operation – Incident and Problem Management • The first triage question to ask should always be “What changed?” • 80% of MTTR is spent trying to answer/determine “What changed?” • Need to arm the resolution processes with detected change information • Understand how current behavior differs from normal behavior • Understand if a change happened and where • If a change is not detected, then rule change out

23. Continuous Service Improvement • Review NBA and SACM data to determine potential service improvement opportunities • We can use NBA to understand and improve the user experience of IT services • Capacity planning for services and component CIs including networks, servers and other devices • Usage patterns and potential demand management • Server consolidation • IT Service Continuity Management

24. Key Points • SACM gives us a logical view of the world with relationships • Integrity of its data is vital • NBA is a control that can help us • Understand behavior in production and testing • Better plan projects – Consolidation, DR/BCP, etc. • Confirm relationships between CIs • Detect configuration errors • Detect unauthorized changes • Drive down MTTR by better understanding what changed • Overall, we can use NBA to help ensure that we have accurate data to share with other process areas

25. Thank you for the privilege of facilitating this webcast George Spafford George.Spafford@Pepperweed.com http://www.pepperweed.com

26. Questions?

27. If you have any further questions, e-mail webcasts@jupitermedia.com For future ITSM Watch Webcasts, visit www.jupiterwebcasts.com/itsm Thank you again for attending