UCISA-Infrastructure Group Case Study

Transcription

1 UCISA-Infrastructure Grup Case Study King s Cllege Lndn Infrastructure Analysis and Resilience Review 1. Intrductin Infrmatin Services and s (ISS) at King s Cllege Lndn has recently restructured a significant part f its IT services (integrating business and academic IT systems), and recruited several new members f staff t the IT s Management Team. In additin, ISS has secured a significant amunt f funding frm the Cllege fr upgrading and imprving its ailing legacy IT infrastructure. In this cntext, it has been timely t cnduct a high-level review f systems and services, with a particular fcus n resilience and business cntinuity. A high level methdlgy designed t prvide a pint-in-time assessment and measurement f the resilience risk acrss the IT systems, and the impact f infrastructure unavailability has been designed and implemented. This has been highly successful in assisting with develpment f a shared understanding f the existing infrastructure within the Team, transparent decisin-making and priritisatin, and cmmunicatin with the Cllege s management team. 2. Descriptin f the wrk 2.1 Infrastructure Analysis methdlgy The bjectives f develping the Infrastructure Analysis methdlgy were: T quickly develp a shared understanding f the existing IT systems and infrastructure acrss the IT Management Team T assess and measure the risk f failure f these systems (resilience) T assess and measure the impact n the Cllege f the unavailability f the systems, and imprve the shared understanding f this acrss the IT department. T assist with decisin-making and priritisatin T assess the in-huse knwledge and breadth f supprt skills T assist with cmmunicatin f these findings t Cllege senir management and hence secure resurce t reduce resilience risk In rder t meet these bjectives a light-tuch high-level methdlgy has been designed, with the intentin f being able t measure the resilience and impact f unavailability f each system. At a weekly meeting fr each system, a cmparative scre (ut f 10) was assigned t each f the criteria verleaf: Page 1 f 5

2 Resilience Risk Cmplexity f the service infrastructure Age f hardware Age f sftware (distance frm current implementatin t latest pint release) Supprtability (reliance n key staff, market availability f skills and supprt, third party supprt etc) Single pints f failure Estimated disaster recver time Current capacity/perfrmance Envirnmental vulnerability (pwer, lcatin f equipment, risk f tampering etc) Institutinal impact f unavailability f the system/service Client/user ranking (high fr VIP users) Level f business functin affected Number f IT services affected Number f clients/users affected Impact f unavailability n institutinal image/brand 2.2 Infrastructure Analysis meetings In rder t implement the methdlgy, weekly (hur-lng) meetings f a team cmprised f senir IT managers and technical specialists, led by the Chief Technlgy Officer, were cnducted. Using existing dcumentatin where available, diagrammatic representatin f the systems and assessments were made f the fllwing systems/services accrding t the abve criteria: systems Web systems Student Recrds systems Finance/payrll systems HR systems Library systems Research systems Backup/restre systems E-learning systems Student cluster wrkstatin infrastructure Netwrk infrastructure Wireless infrastructure Directries/Authenticatin systems Netwrked filestre systems Telephny systems An example scring spreadsheet is detailed in Appendix A. Page 2 f 5

3 Impact The scres assigned t the individual criteria were aggregated t prvide a final scre fr risk and impact fr each system, and these ttals were then pltted n axes t prvide a visual cmparisn. In additin, ntes were made where apprpriate detailing why decisins were made t allcate particular scres. 2.3 Outcmes and Analysis Results An example utcmes graph is shwn belw (sme results have been changed fr cnfidentiality which may distrt the impact findings): 50 Directries Netwrk Web Research Library 25 Wireless Student Recrds Telephnes Finance Clusters filestre 1 HR Research s Restre Resilience Risk This clearly enabled identificatin f thse systems mst at risk and thse which were f high criticality t the institutin, relative t ther systems and has enabled fcussed resurce allcatin in these areas. The graphical presentatin is easily understd by nn-technical stakehlders and has resulted in a shared understanding f risk pints and pririties at senir level within the Cllege. Analysis f the figures als enabled the calculatin f an verall resilience risk figure, which has been helpful in measurable gal setting. ISS identified an verall 65% resilience risk which we have undertaken t reduce t 40% within ne year. In additin, mre granular gals have been set in specific areas. The spreadsheet als allwed fr calculatin f the highest risk categries. At King s these were identified as Supprtability and Envirnmental Risk. Prgrammes are nw underway t mitigate risks in these areas, primarily by reducing the range f hardware and perating systems supprted and addressing issues with facilities in data centres. By-prduct benefits f the prcess have been in the area f staff engagement and transparency. IT Senir Management were initially cautius abut the reactin f technical staff t the exercise but feedback has been that they were keen t share the burden f respnsibility regarding systems resilience and pleased t have the pprtunity t engage with clleagues. In turn management have been able t share the results with all IT staff as an indicatin f why we are fcussing resurces and Page 3 f 5

4 change prgrammes in particular areas. 2.4 Further wrkstreams and spin-ff activities The success f the methdlgy has inspired staff in ISS and the Cllege t adpt a similar apprach t assessment f systems and services. In particular, a high-level assessment f the Cllege s Business s is nw being cnducted by a range f staff frm acrss the business units using a similar prcess. Business systems are being assessed fr fit-fr purpse (via a range f criteria) and pltted against the extent t which they prvide supprt fr the Cllege s strategic bjectives. In this way, priritisatin f resurces can again be facilitated in a transparent fashin with buy-in frm acrss the institutin. There is als an exercise underway t assess systems security risk against the impact criteria. 3. Cnclusin The infrastructure analysis methdlgy has been highly successful in develping a shared understanding f systems risk and impact f unavailability within IT s, ISS and the Cllege. It has enabled transparent allcatin f resurces t areas f pririty, setting f measurable gals and targets and cmmunicatin f IT risks and issues at all levels. The benefits f the exercise have been recgnised by varius stakehlders, frm the Cllege s senir management thrugh t IT staff, and several spin-ff prcesses are underway. 4. Cntact Fr further infrmatin please cntact Lynne Tucker: Lynne Tucker Chief Technlgy Officer Infrmatin Services and s King's Cllege Lndn Rm 4.27, 4th Flr Waterl Bridge Wing Franklin Wilkins Building 150 Stamfrd Street Lndn SE1 9NN Lynne.Tucker@kcl.ac.uk Tel: Fax: Page 4 f 5

5 Appendix A A B C RESILIENCE Descriptin Degree f cmplexity based n the number f items and intercnnects required t prvide Cmplexity service Hardware age Age f hardware Factr based n number f items > 2 versins Sftware age lder than current release Supprtability Supprtability factr based n in huse capability (key persn dependencies), reliance n 3rd party and cntractual arrangements Single pints f failure Factr based n number f single pints f failure DR time Factr based n time t implement full DR plan Capacity/Perfrmance Utilised capacity at tightest bttle neck Envirnmental Factr based n risk t virus attack, user breakage, physical damage, pwer failure etc TOTAL IMPACT Client Ranking highest level f staff/student affected. E.g.: 1= student, 10=VIP Business Functin level f Cllege Business functin affected. E.g.: lss f Cllege website = 10. Lss f student printing services = IT Services ranking fr type and number f IT services unavailable r affected. E.g.: lss f netwrk infrastructure = 10, lss f individual system (e.g. printing)= Number f Clients number f clients affected. 1= less than 50,2=50-99, 3= , 4= , 5= , 6=1,000-1,999,7=2,000-4,999, 9=5,000-9,999, 10=10,000 r ver Brand/Image factr rating fr the ptential effect n the Cllege s external image TOTAL Page 5 f 5