Class 10:

IT Operations

day-to-day activities that protect the organization from ongoing threats to the confidentiality, integrity, and availability of information systems

Controls associated with IT operations

• Data input, processing, and output (=integrity)

• Data backups (=availability)

• Hardware lifecycle management (=availability)

• IT service desk management (=integrity & availability)

Who is responsible for IT Operations

• Help desk

• Facilities management

• Systems developers

• Information security

• Human resources

Types of Processing Integrity Controls

• Input

• Data Entry

• Processing

• Output

Integrity Control - Input

Designing an AR system to sequentially pre-number invoices, so we can easily tell if any are missing

Integrity Controls - Data Entry

Field checks make sure data entered is the proper type, completeness check

Integrity controls - Processing

Matching (ie. an invoice cannot be paid unless a purchase order, vendor invoice, and goods receipt are consistent with one another)

Integrity Controls - Output

Data transmission controls (ie. checksums) check to ensure that all data sent to another database is received

IT Service Desk

The primary point of contact for users and IT staff in regard to IT-related objectives

Responsibilities of IT Service Desk

• Reporting disruptions to users

• Fielding calls for users with problems

• Capacity management

• Communicating upcoming system changes or maintenance

• Supplier management

Physical Controls

Physical protection of people, equipment and data (ie. physical controls attempt to prevent and detect fires from destroying servers in the data center)

Logical Controls

Controls attempting to prevent unauthorized individuals from logging into the company’s information systems

Physical Control Categories

• Disaster recovery and business continuity (ie. plans ensuring information recovery)

• Environmental controls (ie. protection against liquid, smoke, fire, extreme temperature)

• Physical access control ((ie. threats related to physical access to buildings/facilities)

Physical and logical controls

• communicate expectations (ie. policies)

• Preventive controls (ie. card access required)

• Detective controls (ie. temperature changes)

• Corrective actions (ie. regular battery check and replacement)

Physical threats

• Natural: Earthquakes, floods, storms, hurricanes, fires

• System/technical: hardware/software outages, system errors

• Supply systems: communication outages, power distribution interruptions

• Man-made: Explosions, toxic spills

• Political events: Civil disturbances, strikes

• Public health: Pandemic

Types of Physical Controls

• Fire detection and suppression (ie. smoke/heat detectors, wet/dry pipe system)

• Power supply (ie. UPS, battery and/or generator backups)

• Heating, ventilation, and air conditioning (HVAC) (ie. notable issue due to the sensitivity of mainframe systems to fluctuations in temperature and humidity)

• Perimeter and interior intrusion prevention and detection (ie. using sensors to detect and alert security guards to a breach)

Business Continuity planning *BCP)

process of identifying potential threats to critical business functions and preparing effective responses to protect stakeholders, reputation, and operations during incidents

(a document describing how an organization will respond to an event ensuring critical functions operate without unacceptable delay or change)

Disaster recovery planning (DRP)

processes, policies, and procedures related to preparing for recovery or continuation of technology infrastructure following a natural or human-induced incident

(a document providing detailed procedures to respond to a disaster)

BCP/DRP Components

1. Team members

2. Responsibilities

3. Emergency procedures

4. Alternative sites

5. Communication approach

6. Training, testing, and revision of the plan

7. Employee contact information

8. Timeline

9. Vendor contact sheet

10. Client contact sheet

11. Vulnerability assessment, business impact analysis

12. Employee signoff

Disaster Recovery strategies

• mirror site

• hot site

• warm site

• cold site

Mirror Site

A fully redundant, extra replica of the original data center, including the live, production data

Hot site

a fully configured data center with complete hardware and software (without the data)

Warm site

Similar to a hot site, but without the expensive equipment (ie. mainframes), which are delivered shortly after a disaster occurs

Cold site

required physical space for a data center, including air condition, power and telecommunications, but no technical equipment

DR/BCP steps

• Sept 2004, Hurricane Ivan threatened data facilities

• Jan Rideout’s team had carefully secured its IT assets

  • Data backups to Iron Mountain

  • Servers protected physically (wrapped in plastic)

  • Backup generator

  • Extranet that kept critical projects online

Impact of Hurricane Ivan

• Days of lost communication

• 1BN in damage

• Shipyard destroyed

• HVAC failure caused previously working email and IM servers to stop working

• Focus on personnel

  • Used company tools to help employees

Key Lessons from Junglas & Ives

• Keep data and data centers out of harm’s way

  • backup sites be maintained in a geographically separate location from the original site

• Assume some people will not be available

  • backup staff should be assigned and cross-trained

• Leverage suppliers:

  • plan for hardware and software resources to reduce the risk of delay