Educate your employees about change management and controls.
Posted by : Dwayne Melancon
Every day networks around the world go down, causing untold losses in
productivity and revenues. Despite highly publicized cases of hackers,
viruses and worms, the majority of these outages are the result of
changes made to network configurations by people within the company.
Industry analysts IDC and Gartner Group estimate that as much as 70 to
80 percent of all changes resulting in downtime or reduced operational
capabilities are in fact initiated by people within the
organization--and most of those changes are accidental or unintentional.
While some of these inadvertent changes come from general users, the
most notable outages occur on production servers where the IT department
is the culprit. In the midst of implementing workarounds, quick fixes,
or patch updates, changes are often made that negatively impact network
performance and unintentionally cause a chain reaction across the
network.
Enterprise network infrastructures are becoming exponentially more
complex, and budgets are dwindling. IT teams are stretched with
increased demands, costs, requirements, and operational risks. Some
bigger organizations have the added distraction of a "cold war" between
different IT departments.
Establishing processes for implementing changes can be difficult to
enforce, and groups within the IT department--such as security and IT
operations--sometimes appear to be working toward opposing goals. One
group implements a policy, only to have it completely ignored by the
other, and soon the situation quickly degrades to finger-pointing and
arguing.
Unauthorized changes to a server, router, or switch configuration can
have a major impact on the level and quality of IT services. Without a
way to know when change occurs (and whether or not it was called for,
malicious, intentional, or even internal), IT teams have few options for
preventing negative consequences and minimizing damage.
But don't worry--things are not as dismal as they first appear when an
unforeseen change is not for the better.
A need for IT controls
The need for effective change management is driven by two factors:
regulatory compliance and the drive toward operational excellence.
Regulations are becoming increasingly complex and specific, making
compliance a difficult and resource-intensive process. Auditing for
compliance with a variety of these new regulations (including
Sarbanes-Oxley Act, Grimm-Leach-Bliley, and HIPAA) is a growing business
need. Sarbanes-Oxley Section 404 actually requires a company's
independent auditor to sign off on the client's internal controls.
In most large businesses, critical financial processes run automatically
on a vast, complex computing and networking infrastructure. Most
executives presume (and maybe even hope) that this infrastructure is a
monolithic, unchanging entity, and that once policies are established
and the systems are running, everything is fine. In fact, IT operations
are surprisingly and alarmingly fluid.
Auditors understand that financial applications reside on infrastructure
managed by IT departments, and they look for integrated processes and
controls ensuring that the underlying systems are managed responsibly.
In an auditor's view of the world, symptoms of poor service levels
typically point to control issues. An ERP system may be running
flawlessly, but if nobody can reach it due to a network failure, failed
system upgrade, or improperly tested business rule change, the whole
system needs to be examined. For today's organizations to operate
effectively, defined service levels must be maintained throughout, not
just at the system level.
The change management dilemma
In a recent Meta Group report, Dan
Vogel and Homan Farahmand wrote, "Change management is among the most
complex and challenging processes Global 2000 organizations face.
Indeed, many IT service quality problems can be linked directly to poor
change-management procedures."
In spite of the difficulties associated with change management, many of
these organizations have implemented costly, often ineffective change
management processes. Few feel their processes are working at an optimum
level; a frustration often voiced by companies is that they have solid
policies and documented processes in place for change management, but
their people don't consistently follow them. Furthermore, they have no
way to really put "teeth" in the process to hold their people
accountable to the policy.
Despite these challenges, a growing number of high-performing
organizations have effectively implemented change management strategies
that translate to their bottom line.
In these organizations, change management works by observing three key
practices: rigorous enforcement of change management processes; a
"culture of causality;" and making sure that workers involved in IT
security adhere to and help enforce change management policies.
Establishing change management processes
Typically, the first question of someone diagnosing an IT problem is
"What changed?" With a change management process in place, that question
is far easier to answer. Change management is a process made up of
people, software, and procedures. When properly followed, the process
results in many benefits including increased staff efficiency and
reduced server and network device downtime. Change management can also
increase security and provide trusted audit data, all of which leads to
reduced IT costs.
Change management is critical for maintaining reliable systems. To this
end, best organizations are pushing all changes back into the
build-and-test phases so that only rare emergency changes are actually
performed on production systems. The whole network device change process
must become formalized and should incorporate security, testing, and
documentation.
Automating the change management process means addressing the six steps
in an effective change management process:
1. A change is requested--for example, install a security patch to a
Windows XP server.
2. Requested changes are reviewed, the impact assessed, and resources
estimated and assigned.
3. Changes are either approved or rejected.
4. If approved, changes are developed and tested in a preproduction
environment.
5. Changes are implemented into production.
6. Changes are verified and reconciled by someone else in the
organization.
The final step is the critical missing piece in many organizations. In
order to effectively manage change, you need to "close the loop":
Conduct a final verification confirming that the requested change was
implemented properly, verify that change was implemented on all target
systems, and, finally, have the ability to see if the change control
process was circumvented.
Without this step, the change management loop remains open-ended, and
it's impossible to tell the difference between authorized, successful
changes and unauthorized (or unsuccessful) ones.
The experts agree that reducing service outages from human error
through automated processes provide IT savings and a more efficient
business. Eighty percent of IT budgets is used to maintain the status
quo.
By implementing enforceable change management process, IT gains control
of the infrastructure. By gaining visibility in what changed, IT closes
the loop on change management and improves availability, improves audit
performance, and lowers IT operational costs.
Dwayne Melancon is vice president of Services and Support for Portland,
Ore.-based Tripwire, a provider of change monitoring and analysis
software.
Here are the topics we cover computer certification computer careers computer training computer games consulting data recovery data security digital entertainment emerging technology gadget reviews handheld computers hardware reviews home automation home networks home office how-to advice internet linux local companies local news local profiles macintosh mp3 players network security online music online security open-source small-business technology soho software reviews technology books technology dictionary vpn web site reviews wi-fi windows wireless technology tech articles tech news press releases tech dictionary education resources career solutions create your personal blog upload your videos become a writer usergroups special interest group SIG 3com cipts adobe adobe certified expert apc ncpi apple achds acpt acsa actc avaya bea 8.1 certified administrator 8.1 certified architect 8.1 certified developer 9 certified administrator bicsi rcdd checkpoint ccmse ccsa ccsa ngx ccse ccse ng plus with ai ccse ngx cisco access routing and lan switching ccda ccdp ccie ccip ccna ccnp ccnp old ccsp ccvp crmam ip communications optical proctored exams for validating knowledge sales specialist storage networking vpn and security wireless lan citrix cca 3.0 cca 4.0 cca 4.5 cca xp ccea 3.0 ccea 4.0 ccea xp ccia ciw ciw associate ciw certified instructor master ciw admin master ciw designer master ciw enterprise developer security analyst comptia a+ network+ security+ server+ computer associates ca cusa cuse cwna cwna cwsp dell eccouncil cea cep certified ethical hacker chfi e-commerce architect emc emc specialist implemenation technology foundations enterasys ese eta exam express exin exin itil extreme networks ena ens filemaker f7cd f8cd fortinet fortigate foundry cne fujitsu fujitsu guidance software ence hdi css hda hdm hdsa hitachi hitachi certified professional hp ais apc app aps ase certified systems developer csa cse master ase huawei hcne hyperion hcp ibm advanced deployment professional advanced technical expert application developer business process analyst certified administrator certified advanced system administrator certified advanced technical expert certified associate developer certified enterprise developer certified solution designer certified specialist certified systems expert database administrator db2 deployment professional enterprise developer eserver certified specialist ibm on demand business solution advisor solution designer solutions developer solutions expert storage administrator system administator iisfa cifi intel isaca cisa isc cissp sscp iseb itil ism cpm juniper jncia jncis legato lcaa lcea lotus clp lpi lpic level 1 lpic level 2 lpic level 3 macromedia mcafee mcdata csnd microsoft crm mbs mcad .net mcdba mcdst mcitp mcp mcpd mcsa longhorn mcsa 2003 mcsa 2008 mcsd .net mcse mcse 2000 security mcse 2000 to mcse 2003 upgrade mcse 2003 mcse 2003 messaging mcse 2003 security mcse 2008 mcts microsoft business solutions microsoft partner competency mile2 cnsa network appliance nac-na nac-nie naca nace nacp network general sniffer certified professional nokia nokia security administrator nortel ncde ncds ncse ncss ncts novell5 cna 5 cne 6 cna 6 cne 6.5 cne cne upgrade omg ocup oracle 10g dba 10g oca 11i 8i dba 9i dba 9i internet application developer oca ocp8 to ocp8i dba upgrade exam pmi project management professional polycom pcve redhat rhce rhct sair sas institute sas scp saas scp snia snia certified architect snia certified professional snia certified systems engineer snia storage networking certification program administrator professional associate symantec scse scsp scta scts teradata tca v2r5 tcad v2r5 tcda v2r5 tcis v2r5 tcm v2r5 tcp v2r5 tia ccnt ctp tibco tcp trusecure ticsa veritas infraguard chamber of commerce vcp vmware certified professional webex linkedin facebook myspace Professional page layout, image editing, vector illustration, and print production Website design, development, prototyping, and blogging Creation of rich interactive content Industry-standard visual effects and motion graphics Video capture, editing, and production; DVD titling; and digital audio, Adobe Photoshop CS3 extended, Adobe illustrator CS3,Adobe indesign CS3,Adobe Acrobat 8 Professional, Adobe Flash CS3 Professional, Adobe Dreamweaver CS3,Adobe Contribute CS3,Adobe Fireworks CS3,Adobe After Effects CS3 Professional, Adobe Premiere Pro CS3,Adobe Soundbooth CS3,Adobe Encore CS3,Adobe OnLocation,Adobe Bridge CS3,Adobe Version Cue CS3,Adobe Device Central CS3,Adobe Stock Photos, Intel Pentium 4 (1.4GHz processor for DV; 3.4GHz processor for HDV), Intel Centrino, Intel Xeon, (dual 2.8GHz processors for HD), or Intel Core, Duo (or compatible) processor; SSE2-enabled processor required for AMD systems Microsoft Windows XP with Service Pack 2 or Microsoft Windows Vista Home Premium, Business, Ultimate, or Enterprise (certified for 32-bit editions) 1GB of RAM for DV; 2GB of RAM for HDV and HD; more RAM recommended when running multiple components 10GB of available hard-disk space (additional free space required during installation) Dedicated 7,200 RPM hard drive for DV and HDV editing; striped disk array storage (RAID 0) for HD; SCSI disk subsystem preferred Microsoft DirectX compatible sound card (multichannel ASIO-compatible sound card recommended),1,280x1,024 monitor resolution with 32-bit color adapter Blu-ray burner required for Blu-ray Disc creation OHCI compatible IEEE 1394 port for DV and HDV capture, export to tape, and transmit to DV device QuickTime 7.1.2 software required to use QuickTime features Broadband Internet connection required for Adobe Stock Photos* and other services
