The way to gain a good reputation, is to endeavor to be what you desire to appear.

Socrates

Balancing Customer Service and IT Security -

ITIL Based Solutions for a Service Desk Conundrum

As an employee, what do you want C&C to be?

A satisfied customer is the best business strategy of all.   

Michael LeBoeuf

The user's going to pick dancing pigs over security every time. 

Bruce Schneier

Topics for Discussion

Client hopes/requests for the future • ITIL – Best practices for improving IT Service Management

• The Service Desk as a function of ITIL

• Information Security Management - Why does ITIL make a difference?

• The Service Desk – helping balance the dichotomy

• Challenges going forward

• Discussion

ITIL – A Best Practice Framework

Technology leadership – MUN’s future

ITIL – Information Technology Infrastructure Library

• a collection of best practices for the management of IT Services

• improving customer outcomes through the effective delivery of services

• seeks to align people, processes and technology such that IT services become business activities that provide value to customers

• in and of itself ITIL exists only as a best practice framework. It will give you the “what” but not the “how”. Implementations are usually custom and organization specific

• benefits include better services for clients, cost savings for the organization, a better understanding and positioning of the role of IT in the business or organization

ITIL Processes

• Configuration Management• Incident Management• Problem Management• Change Management• Release Management • Service Level Management• Availability Management• Capacity Management• Financial Management for IT Services• IT Service Continuity Management• Security Management

The Service Desk – a single point of contact for incidents and Service Requests. Primarily, it serves as a function of Incident Management whereby it helps restore normal service to clients as soon as possible.

IT Security Management• Traditional ITSM thinking is far too limiting

• The oft referenced CIA – Confidentiality, Integrity, Availability – is really just a starting point

• Security is not just a process, but one of the most contentious intersections of people and culture with technology.

• So where does ITIL fit in?

• Best practices in IT Service Management point the way to defining, implementing, monitoring and assuring repeatable IT management objectives and processes.

• It’s often said that we can manage what we can measure. In the case of IT Security we can make secure what is defined, recognized and understood. That of course, applies to people, technology and processes within our organizations.

The ITIL Service Desk

One primary goal of IT Security Management within ITIL is to align security with people, processes and technology for the betterment of our clients and our organization. Seems simple enough, but how do we go about doing it?

The Service Desk should be a vital partner in IT Security.

• a single point of contact for your customers that has its hands on the pulse of the organization.

• broad understanding of everything that goes on around you. Why?

Because they are answering questions about your infrastructure every day.

A Collaborative EffortCommunication is the key – Making security a priority

The Service Desk should understand the critical nature of security related incidents and perhaps more than any other incidents, detailed processes should be defined so that procedures are followed correctly.

Service Desk staff should be encouraged to bring forward security related concerns especially if they find themselves hard pressed to explain security related policies to your clients.

If security related decisions within your infrastructure were based on policy make sure that your Service Desk staff are aware of the policies in question.

ITIL, if implemented correctly, is oddly self aware or perhaps more precisely, introspective. Service Desk reporting of security incidents should happen regularly and should be reviewed for timeliness of response and resolution. Better still, the root causes should be analyzed and understood.

Raising Client AwarenessIf the Service desk is the single point of contact for your customers then it can also play a crucial role in making clients aware of security concerns within your organization.

Here comes the sales pitch!

Not totally unlike a commercial entity that uses its Service Desk to push products and services, your Service Desk can be used to pitch ideas and to make clients aware of the how’s and why’s of security.

If client awareness of your Security Changes stops at the table of the Change Advisory Board then you have failed. And you have failed even if everything related to the 1’s and 0’s was successful.

A client who is consulted and informed is far more likely to be understanding of security policy and security related changes than the one who discovers that the new gadget he or she just bought is ….. not supported?

Challenges Going Forward

• ITIL – a lot of work and a slow process.

• Look beyond yourselves to see if you’re getting it right.

• The pace of IT will outpace you – just get used to it.

• ITIL – not just a roadmap, it’s the road

The way to gain a good reputation, is to endeavor to be what you desire to appear.

Socrates