Information Technology Infrastructure Library (ITIL)

Today’s IT systems require a disciplined and controlled approach to system management. The ITIL framework provides a great guide for organisations seeking to streamline processes, improve service delivery and enforce controls. However, a rigid one-size-fits-all strategy to ITIL is not the right answer for all.

The IT Infrastructure Library® (ITIL) is the most widely accepted approach to IT service management in the world. ITIL is a best practice framework that has been drawn from both the public and private sectors internationally. It describes how IT resources should be organised to deliver business value, documenting the processes, functions and roles of IT Service Management (ITSM).

ITIL is a set of books that provide a practical, no-nonsense framework for identifying, planning, delivering, and supporting IT services to the business. The framework is based on proven best practices developed by IT experts around the world and has evolved over the past two decades. ITIL is the most widely adopted approach for IT service management.

ITIL is a public framework that describes IT service management best practice.  It “provides a framework for the governance of IT, the ‘service wrap,’ and focuses on the continual measurement and improvement of the quality of IT service delivered, from both a business and a customer perspective”.

ITIL was first developed in the 1980s by the Office of Government Commerce (OGC), a branch of the British Government. It has become a de facto global standard, with thousands of organizations worldwide adopting it as the framework for establishing IT processes .ITIL comprises of five chapter namely  first Service Strategy, provides an overall strategy for IT services and IT service management. The remaining chapters are Service Design, Service Transition, Service Operation, and Continual Service Improvement.

It’s important to note that the ITIL tell you what to do but not how to do it.

BRING YOUR DEVICE (BYOD)

A bring your own device (BYOD) is nothing but allowing employees to bring their own device to access enterprise network.A bring your own device (BYOD) strategy for enterprises can be a winner for both users and administrators. But switching to BYOD requires more than throwing open the barn doors and letting employees buy whatever device they want. IT still needs to manage and secure the data on mobile devices, whether they are owned by an enterprise or user.

In more traditional mobility deployments, the enterprise itself was responsible for all facets of the mobile device, including purchasing, its associated voice and data plans, as well as managing the device assets. The IT department would track what device was assigned to each user and would be the clearinghouse for any device replacement or upgrades. Essentially, IT treated mobile devices in the same way that it did other IT assets like laptops or printers.Consumers, however, are embracing smartphones and tablet devices as ways to stay personally connected. This has led to a two-device dilemma, with many enterprise users carrying both a personal and work device with them. The bring your own device movement is partially a solution for this dilemma, enabling users to carry a single device for both business and personal use.

Bring your own device (BYOD) programs, especially when they include desktop virtualization, have gained steam in organizations looking to centralize desktop management and make hardware management easier. Allowing end users to employ their own personal devices can also make them more productive, saving companies time and money. But if an organization implements BYOD poorly, it can lose control over its infrastructure and, even more importantly, its data.

It’s important to take some time and plan out a BYOD initiative by following these guidelines:

Determine the need for a BYOD program

Some organizations jump on the BYOD bandwagon too quickly, not realizing how it can affect their existing IT infrastructure. Examine how users work on their corporate PCs to gauge whether they will be able to continue this type of productivity on their personal devices. In some cases, users will be a lot more productive given the chance to use their own equipment. Other times, a BYOD initiative just won’t make sense, either because of employees’ work styles, the corporate culture or other reasons.

Consider desktop virtualization

Desktop virtualization can deliver corporate desktop images to personal endpoints, ensuring that there won’t be a drastic change for users when a BYOD program takes effect. At the same time, users can still have very powerful, personalized computing experiences because they are in charge of managing their devices. The added benefit is that IT administrators can manage desktop images directly from one interface and worry less about endpoint hardware.

Don’t forget application delivery

Even though they’ll be using their own devices, employees will still need access to corporate applications. Application delivery is an important subset of desktop management, especially when it comes to BYOD. It means not only controlling how applications get to end users, but also how to monitor and manage application settings all from a centralized location. Virtualization is one way to handle application delivery in your BYOD program.

Plan for BYOD security

Even with a BYOD program in place, IT admins still have to control and manage access to the corporate infrastructure and data. Another benefit of using desktop or application virtualization is that data and applications live in the data center. This way, a lost device doesn’t spell disaster, because the device doesn’t actually contain any sensitive corporate information. As they do with standard, corporate-owned devices, administrators will still need to create comprehensive security groups and strict policies, plus perform general security monitoring.

Get end users’ support

Keep in mind that some of your users might not be up for BYOD. Some people may take issue with the blurring of the line between their personal and work lives, for example. Educating end users and assuring them that their IT department can help them have a better work experience with their personal devices should be on the BYOD checklist. By gradually testing the program, organizations can gain employees’ support and make them much more enthusiastic about using their own devices for work.

Develop BYOD policies

Implementing a BYOD program doesn’t mean users will be able to use any device they want. For BYOD to be successful, admins must decide in advance which devices they will support for various workloads. For example, you can deliver a full desktop to an Android phone, but it probably isn’t practical because of the small screen (and other factors). But delivering that same desktop to an iPad might work for some users. Figure out what the needs of your users are, then pick a device (or devices) to fit those needs. IT also needs to develop, implement and enforce a BYOD policy that governs user access to corporate infrastructure and data on their device.

BYOD still requires mobile device management

Shifting users to a BYOD strategy does not absolve IT from responsibility for mobile device management. It doesn’t matter who is paying for the mobile device, IT will still have to manage that device as a corporate asset. Companies will need tools to support mobile devices, including tools for mobile device management (MDM), mobile security and mobile application management.

IDENTITY AND ACCESS MANAGEMENT(IAM)

Identity and Access Management (IAM) comprises of people, processes and products to manage identities and access to resources of an enterprise. The ultimate goal of IAM Framework is to provide the right people with the right access at the right time.

IAM components can be classified into 4 major categories: authentication, authorization, user management and central user repository (Enterprise Directory)

Authentication

This area is comprised of authentication management and session management.  Authentication is the module through which a user provides sufficient credentials to gain initial access to an application system or a particular resource.  Once a user is authenticated, a session is created and referred during the interaction between the user and the application system until the user logs off or the session is terminated by other means (e.g. timeout).  The authentication module usually comes with a password service module when the userid / password authentication method is used.  By centrally maintaining the session of a user, the authentication module provides Single Sign-On service so that the user needs not logon again when accesses another application or system governed under the same IAM Framework.

Authorization

Authorization is the module that determines whether a user is permitted to access a particular resource.  Authorization is performed by checking the resource access request, typically in the form of an URL in web-based application, against authorization policies that are stored in an IAM policy store.  Authorization is the core module that implements role-based access control.  Moreover, the authorization model could provide complex access controls based on data or information or policies including user attributes, user roles / groups, actions taken, access channels, time, resources requested, external data and business rules.

User Management

This area is comprised of user management, password management, role/group management and user/group provisioning.  User management module defines the set of administrative functions such as identity creation, propagation, and maintenance of user identity and privileges. One of its components is user life cycle management that enables an enterprise to manage the lifespan of a user account, from the initial stage of provisioning to the final stage of de-provisioning.

Central user repository (Enterprise Directory)

Central User Repository stores and delivers identity information to other services, and provides service to verify credentials submitted from clients.  The Central User Repository presents an aggregate or logical view of identities of an enterprise.  Directory services adopting LDAPv3 standards have become the dominant technology for Central User Repository.

Oracle, Microsoft and IBM are pioneers in IAM technology.

VIRTUALIZATION

1. What is virtualization?

In computing, virtualization (or virtualisation) is the creation of a virtual (rather than actual) version of something, such as a hardware platform, operating system (OS), storage device, or network resources.

2. How virtualization works?

Virtualization needs a special software that runs as a virtualization layer (called a hypervisor) between the hardware and the operating system.

3. Why virtualize?

There are many reasons for adopting virtualization. A popular one is better resource utilization. It is not uncommon to see servers running at 10 percent or less of their capacity, at different points in the day. By letting several virtual servers share a single set of hardware, a much higher average utilization rate is achieved, and hardware and support costs are lowered. Virtualization also makes it easier to provision and reallocate servers. Instead of having to manually set up a server, the virtualization software can set up a server using a pre-existing template and shift server images from one physical server to another to balance workloads or improve efficiency. It can also automatically set up a new virtual server on a different machine when there is a hardware malfunction. Each application is isolated from the others, which provides greater security.

4. What are the different types of virtualisation?

1. Hardware virtualisation

2. Desktop virtualisation

3. Software virtualisation

4. Storage virtualisation

5. Network virtualisation

5. What are big challenges to virtualization technology?

Backup and restoration of Virtual Machines (VMs), software licensing are big challenges to virtualization technology.

6. Who are the pioneers in the field of virtualization?

 VMware (EMC) is by far the largest vendor of virtualization technology for x86 platforms.

IBM is also into foray with their IBM Virtualization Engine Platform.

Microsoft is also playing a major role in virtualization technology with Windows Server.

ON INFORMATION SECURITY

1 .What is Information Security?

Information security is the process of protecting the availability, privacy, and integrity of data.

2. Why Information Security is important?

In today's high technology environment, organisations are becoming more and more dependent on their information systems. The public is increasingly concerned about the proper use of information, particularly personal data. The threats to information systems from cyber criminals are increasing. Many organisations will identify information as an area of their operation that needs to be protected as part of their system of internal control. It is, vital to be worried about Information security because much of the value of a business is concentrated in the value of its information.

3. What is data breach?

A data breach is an incident in which sensitive, protected or confidential data has potentially been viewed, stolen or used by an individual unauthorized to do so. The most common concept of a data breach is an attacker hacking into a corporate network to steal sensitive data.

4. What is data breach means to organisation?

A data leak, may lead to a business loss. An organisation may lose their edge against their competitors. Potential hacking of corporate network may affect business continuity of the organisation.

5. What are the different ways to secure information?

Install proper anti-virus software into the corporate network. Installation of Unified Threat Management (UTM) is highly recommended. Strong Information Technology (IT) policy is highly appreciated. Periodically change passwords wherever applicable. Encrypt and Decrypt the data as applicable. Regular system audit may help to know about the security of the data.

6. Are there any guidelines available?

Yes, there are guidelines available. Follow the guidelines mentioned in ISO:27001 for better governance, risk and compliance.

7. Who is responsible for information security in an organisation?

The ownership varies depend upon the size of organisation. Normally in a big organisation, it is the responsibility of chief information security officer (CISO) and in small organisation it is the responsibility of System Administrator or Network Administrator.

ON STORAGE STRATEGY

1 .Why storage Strategy is important to an organization ?

In an information environment, an organization's success is tightly coupled to its ability to store and manage information. Storage systems provide a critical part of an organization's network infrastructure. With the amount of data growing at an incredible rate, your storage strategy must keep pace. In designing a storage strategy for your organization, you must select the right technology for your primary storage system, implement solid backup procedures and ensure ongoing management of the system. The storage technologies are extremely important because as the company expand, the data expand and obviously, need for storage also expand. Enterprise should have robust storage network in order to store any amount of data under any given circumstances.

2 .What is driving storage growth?

Digital Data explosion is driving storage growth. Availability of data at anytime irrespective of how old it may be is another cause that drives the storage growth. In a, knowledge driven era where information is the engine that drives enterprises worldwide, management of information is gaining utmost importance. Widespread implementation of CRM and ERP solutions have contributed towards enterprise data explosion by triggering exponential growth in the volume of information generated about partners, suppliers and customers.

3.What are the factors needs to considered while designing storage system ?

1 .Capacity

2. Scalability

3. Cost

4 Performance

5.Reliablity

6.Manageability

 

3.What are the storage options available ?

Network-attached storage (NAS	one of the on-line storage architectures that promise to deliver businesses with cost-effective, scalable, and manageable alternatives for ever-growing data requirements. Advantages stacked in favour of the NAS technology include increase in data availability, improvements in server performance, optimized data access, end-user transparency, easy setup, low installation and maintenance costs and platform-independence
Storage area network (SAN)	is excellent for moving large blocks of data, exceptional reliability, Wide availability, fault tolerance, Scalability. SAN technologies can be used in large databases, Bandwidth-intensive applications and mission-critical applications
Optical storage technologies	can play a part in an organization's storage strategy. They offer a lower-cost alternative to magnetic disks for extremely large data sets. Magnetic disks offer significantly higher performance, and their costs per storage unit consistently decline
Solid State devices	SSDs can offer incredible performance-almost instantaneous writing and reading of data

 

Let me conclude my blog with the buzz word in managing storage i.e  ‘BIG DATA’.

 

BEING IN THE CLOUD

1.WHAT IS CLOUD COMPUTING ?

It is more than anything on the internet and also more than virtualization technologies. The concise definition put forth by the National Institute of Standards and Technology (NIST) is

cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to shared pool of configurable computing resources (e.g. networks,  servers, storage, application and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

2. WHAT ARE THE CHARACTERISTICS OF CLOUD COMPUTING?

NIST's five essential characteristics of cloud computing provides enough specifics to break the myth that "the internet equals the cloud".  Neither simple web hosting  nor virtualized data centers  deliver the following  comprehensive cloud benefits:

1. On-demand self-service

2. Broad network access

3. Resource pooling

4. Rapid elasticity

5. Measured Service

3. WHAT ARE THE SERVICE MODELS AVAILABLE?

1.  Infrastructure as a Service (Iaas)

2.  Platform as a Service (PaaS)

3.  Software as a Service (Saas)

The other two service model apart from the standard service models are:

4. Data as a Service (Daas)

5.  Business Process as Service (BPaaS).

 4 .WHAT ARE DIFFERENT TYPES OF DEPLOYMENT MODELS AVAILABLE?

Cloud computing environment fall into one of four different models mentioned below:

a. Public Cloud

b. Private Cloud

c. Community cloud

d. Hybrid cloud

5. WHAT ARE THE RISKS INVOLVED IN CLOUD COMPUTING?

Many foresee 'Security of data' as a major risk involved in cloud computing.

 Multitenancy  may bring performance issue.

6. WHAT ARE THE ADVANTAGES OF CLOUD COMPUTING BEYOND COST SAVINGS?

1. Reduced resource needs

2 .Reduced time to market

3. Reduced capital expenditure

4. Increased availability

                5. Cost transparency