1 8 - Management and Operation of Technology Infrastructure Management and Operation of Technology...

1

8 - Management and Operation of Technology Infrastructure

Management and Operation of Technology Infrastructure

© Robert G Parker – UW-CISA 2010


• 40% of Respondents were using the cloud

• 20% planned to use the cloud within 24 months

• 22% were in the process of evaluating the cloud

Dealing with changing infrastructure environments and the new technologies that are driving business changes and creating risks and management issues

Source: Informationweek Analytics

Of the remaining 18%, 6% decided not to use clouds and 12% has no plans to evaluate them.

Concerns associated with infrastructure management included :

• Control of data handling systems that are outside of the formal system, such as the use of spreadsheets (13)

S-2

3

• User managed data bases that are locally developed and processed within business units but which may lack rigorous processes typically associated with IT-developed solutions such as quality reviews, testing, change management and access controls.

• Security of data that is or can be stored on portable devices or that is easily moved among stakeholders


Empowered Users

Portable Devices



• Increasing use of cloud computing without an understanding of the associated risks (Lack of a cloud risk management strategy)

• Increasing risks associated with the quality and integrity of information processed and presented from these ad hoc systems and applications.

• Increased risks of subsequent and ongoing problems caused by incomplete, unperformed or erroneous unchecked change management procedures.

• Lack of ‘Security over information moved between various sites, or stored, on moveble/moblie media

• Lack of control over portable media

Business Risks

S-4



• Implement requirements for, and conduct full technology and business risk assessment prior to adopting new technologies

• Where ad hoc systems and applications are integrated into the enterprise’s information systems, ensure that controls exist and are operation to validate the integrity of the information prior to it further use.

• Establish, adhere to and monitor rigorous change management procedures

• Implement procedures, such as encryption over information at rest, in transit and while archives to minimize the risk of an information breach

• Implement and monitor procedures over when portable may be used, the types of information that may be placed on them and the security and control restrictions over them

Operational / Technology Risk Management

S-5

© Robert G Parker – UW-CISA 2010S-6

9 - Business Continuity and Pandemic Awareness

Business Continuity and Pandemic Awareness



Information technology departments have an obligation to provide services throughout the enterprise. However, they are frequently challenged in developing and testing effective technology disaster recovery plans due to lack of enterprise planning, lack of funding or denial of the potential severity of the risks.

Lack of meaningful preparedness for a pandemic

Entity centric continuity plans; inward focus

Lack of supply chain resiliency, redundancy

Lack of comprehensive continuity plans

Plans have not been tested

Plans are not being maintained

S-7

The Same Issues



Lack of meaningful preparedness for a pandemic

No single point of contact

Conflicting messages, priorities

Plans differed by region

Different groups defined as high risk

Initially insufficient vaccine

Numerous individuals not vaccinated

No instructions for travellers across Canada

Coughing in the crook of your arm campaign was effective

We Dodged the Bullet - This Time!



Entity centric continuity plans; inward focus

• Plans do not consider third party infrastructure

• Plans do not consider up stream and down stream impacts

• Plans do not address catastrophes• Impact on immediate area• Impact on foreign operations• Risk mitigation strategies and plans• Financial and cash flow issues• Impact on franchised operations

Business Continuity Plans frequently address only recovery of the business and its infrastructure:



A Catastrophe Poorly Handled



For Want of a Nail

The Shoe was Lost



For Want of a Shoe

The Horse was Lost



For Want of a Horse

The Battle was Lost

Lack of Supply Chain Resiliency, Redundancy



For Loss of a Battle

The Kingdom was Lost

Contingency Planning or Catastrophe

Lack of Comprehensive Continuity Plans



Plans Have Not Been Tested

A BCP or DRP that has not been Tested is Not a Valid Plan

It is an Idea of What May Have to be Performed

Plans are Not Being Maintained

An out of date BCP or DRP Likely does not Reflect the Current Environment, Risks, etc.

Relying on an Out of Date Plan Will Likely Not Result in a Successful Outcome



Expansion of the Panama Canal to handle super tankers

17


Business Reaction

Business Continuity Risk ManagementChanging external environment not reflected in BCP-DRP plansLack of understanding of supply chain risksLack of understanding and knowledge of extend to which up stream and down streams supply and delivery business are addressing their BCP-DRPLack of effective communicationIt won’t happen to me

Reassess BCP and DRP initiativesImplement plans to link BCP-DRP to enterprise and IT risk management initiativesEnsure supply chain risk are monitored and assessedImplement employee awareness and training programs, newsletters


10 - Impact of the Economy on Information Technology

Impact of the Economy on Information Technology


10 - Impact of the Economy on Information TechnologyThe financial crisis and following recession resulted in the restructuring of many organizations, including, for many, their Information Technology departments. With the recession waning, concern has been expressed over increasing IT departments’ to their previous staffing levels

Concerns over adopting new technologies as a means of controlling costs while meeting the increasing needs for IT:

• Virtualization• Cloud Computing• BYOC

Concern over risks of increased fraud and malicious activity; disgruntled employees and lack of control

Concern over controls over outsourcing; • Intellectual capital, customer information, other information assets• Contract Management -adhering to schedules, providing capacity,

saleability

S-19


Thank You For Your Interest and Participation

Robert G. Parker

1 8 - Management and Operation of Technology Infrastructure Management and Operation of Technology...

Documents

Transcript of 1 8 - Management and Operation of Technology Infrastructure Management and Operation of Technology...