Reduce Risk: Three Best Practices for Integrating Change and Compliance in the Data Center

Transcription

1 Thought Leadership white paper Reduce Risk: Three Best Practices for Integrating Change and Compliance in the Data Center By Vick Vaishnavi, vice president of Worldwide Marketing, BMC Software

2 Table OF CONTENTS executive Summary Change Versus Compliance The Challenge of Change and Configuration Management The Challenge of Compliance The Solution: Integrate Change and Compliance BEST PRACTICES FOR INTEGRATING Change and Compliance Create an End-to-End Management Model Ensure Data Integrity Achieve Configuration Standardization Create a Holistic I.T. Compliance Score get Off to a Fast Start with BSM Change and Configuration Management Solutions The Value of a Configuration Management Database Conclusion

3 Executive Summary How can IT executives remain responsive to the varying needs of the business, in spite of frequent changes to the IT infrastructure that impact stability and control? And how can they accomplish their goals while still maintaining compliance with many internal and external policies and regulations? They can meet these objectives by implementing effective change and configuration management processes and technology. This paper presents an approach that enables IT to be highly responsive to the business while maintaining and demonstrating compliance with internal and external policies, standards, and regulations. It focuses on automating change management to ensure agility while effectively controlling change to maintain compliance. The approach includes three important best practices: 1. Create an end-to-end configuration management model 2. Ensure data integrity 3. Achieve configuration standardization Business Service Management (BSM) can help IT get off to a fast start with integrating change and compliance. BSM is a com prehensive approach and unified platform for running IT based on business priorities. BSM can provide significant business benefits by helping IT organizations: Reduce labor costs and time to market by automating configuration changes to adapt to constantly shifting business requirements Increase staff productivity and operational control, and improve the cost structure while supporting a growing data center infrastructure Lower compliance costs through automated auditing, testing, and remediation 1

4 Change Versus Compliance As Figure 1 illustrates, IT organizations find themselves faced with two seemingly conflicting objectives. They must remain highly responsive to the business by rapidly implementing changes to the IT infrastructure to meet changing business requirements. At the same time, they must ensure the integrity of configurations through increased configuration control. The need for increased control is being driven by internal factors, such as security policies and operational processes, and by external compliance requirements, such as those imposed by Sarbanes Oxley (Sarbox) and the Health Insurance Portability and Accountability Act (HIPAA). Stability and Control Responsiveness No Common Approach Lack of Visibility Lack of Automation COMPLIANCE Assure Visibility and Integrity CHANGE Support the Business Figure 1. Responsiveness versus stability and control One of the major factors hindering the achievement of both objectives is that most IT organizations are fragmented into silos based on their roles. This fragmentation has resulted in an inconsistency of change processes across the organization and a lack of visibility into IT infrastructure configuration and changes. In addition, many IT organizations employ manual or immature change processes that are error-prone and consume an inordinate amount of resources. The Challenge of Change and Configuration Management Configuration management for the data center involves controlling and changing the configurations of the components of the server and application infrastructure. The targets of these changes may include registries, system files, middleware applications, and operating system configurations. Together, the component configurations comprise the genetic makeup of servers and applications used to support a given business process. 2

5 The majority of today s data centers have a heterogeneous mixture of platforms and applications, making configuration change implementation and tracking an exceedingly difficult task. Additionally, most data centers have derived their IT operations organizational model based on groups of platform or application specialists. Figure 2 shows examples of the kinds of silos found in today s IT organizations. Sample Silos in an IT Organization Development Engineering Operations Security Applications Development Architecture Windows Support Server Security Applications QA Windows Engineering UNIX/Linux Support Desktop Security Application Deployment Unix/Linux Engineering Network Support Compliance Network Engineering Service Desk Network Security Application Support Desktop Support Figure 2. Silo examples The top priority of each siloed group is to fulfill the increasing demand for configuration changes to the platforms and applications under their management. A siloed group may not always be aware of the effect its changes may have on components that lie outside its group. These types of changes can compromise compliance goals. The operations staff may rely on limited automation and homegrown scripting tools to implement and manage configuration changes. Over time, these tools, which have been implemented by different groups, have often diverged into a proliferation of point tools that focus on specific areas: platforms, applications, and functions. Although they may be helpful in controlling changes within a single silo s area of interest, they rarely ensure the configuration consistency of a change across appli ca tions or services. Silos have become islands of automation with few, if any, bridges connecting them. This leads to consistency gaps and poor orchestration of changes, which can have a direct negative impact on service delivery. The Challenge of Compliance Ensuring compliance requires a goal of zero configuration variance across the data center. Therefore, this goal appears to be at direct odds with the need for responsiveness. Data center configuration compliance requires the creation of a stable, well-defined configuration baseline. That necessitates capturing a consistent, moment-in-time snapshot of configurations across multiple silos. The siloed organizational model, however, is not well suited to taking such a baseline. This requires a major manual effort to analyze configuration states across multiple silos to determine the overall configuration of the data center. Because manual processes are subject to error, the results from these processes may not be accurate. In addition, a manual approach does not ensure relevance over time, because the physical reality typically changes faster than the manual updates. As a result, the baseline may be outdated even before the work to create it is completed. Therefore, it is ineffective to use manual processes as a reference for auditing and detecting noncompliance. A silo-based configuration management approach focuses on consistency within a single silo, and little or no consideration is given to other silos. It does not provide visibility into the overall dependencies among servers and applications, which makes configu ration changes risky and compliance maintenance difficult. 3

6 The Solution: Integrate Change and Compliance The solution to the dilemma of change versus stability and control lies in recognizing that the disciplines of configuration manage - ment and compliance are not mutually exclusive. In fact, change management, an important factor in configuration management, is an inextricable component of ensuring compliance. According to industry analysts, one of the leading reasons why IT organizations fail compliance audits is their inability to demonstrate established, repeatable change controls. Effective change management, however, reduces the risk of noncompliance. Consequently, to achieve both responsiveness and stability, IT needs to integrate configuration management with compliance. As shown in Figure 3, these two disciplines not only can, but must be balanced. By integrating configuration management with compli ance, IT can maintain alignment with both business goals, which involves responding to the needs of the business and to maintaining compliance. COMPLIANCE ASSURANCE Change Integrity CONFIGURATION MANAGEMENT Change Execution Figure 3. Balancing configuration management and compliance assurance Truly effective change management ensures that every change made in the data center satisfies not only compliance requirements, but also the operational and security requirements. As a result, the benefits of integrating configuration management and compliance assurance go well beyond maintaining compliance. Improperly managed change is a major cause of service disruption. This exposes the organization to the risk of security breaches that can have severe consequences. Today s headlines abound with stories citing substantial business losses from IT security breaches and examples of attacks on corporate IT infrastructures by hackers. Effective change management minimizes the risk of service disruption and security breaches. BEST PRACTICES FOR Integrating Change and Compliance To achieve integration between configuration management and compliance assurance, IT must follow these three major best practices: Create an end-to-end configuration management model. Integrate functions between change management and compliance disciplines in an end-to-end management model. Ensure data integrity. Ensure that all configuration change and compliance data remain accurate and up to date at all times. Achieve configuration standardization. Transform the heterogeneous physical data center environment into a homogeneous management environment. 4

7 In addition, IT should implement automation wherever possible. This automation should not necessitate disruptive changes to existing processes or organizational structure. 1. Create an End-to-End Management Model What is required is an end-to-end configuration management model with 360-degree management control. (See Figure 4.) This model can be created by identifying stand-alone server and application change management functions, automating them, and creating interoperable data exchange interfaces across the functions. With this approach, the integrated solution appears as a single, seamless automation engine that marries configuration change control with compliance. Discover and Inventory Remote Administration Define Standards and Access Controls COMPLIANCE ASSURANCE Change Integrity Deploy and Track Changes Audit and Report CONFIGURATION MANAGEMENT Change Execution Application Packaging and Promotion Remediate Provision Figure 4. End-to-end management model This integrated solution provides several functions that enable IT to do the following: Maintain a complete, accurate, and authentic inventory of servers and applications Determine the current configurations of, and the dependencies among, servers and applications Build, deploy, and roll out configurations, configuration changes, and entire applications across the infrastructure hitting all affected assets concurrently and consistently Patch and update configurations in a timely manner to ensure compliance with security and other policies Automate mundane administrative tasks that are not related to business process change but are required as part of day-to-day operations Automate the definition and maintenance of compliance baselines. This includes automation of compliance audits and tracking, accurate remediation of noncompliant elements, assurance of data integrity, and automatic gathering of metrics to authenticate, analyze, and demonstrate continuous configuration compliance and to identify noncompliance issues 5

8 2. Ensure Data Integrity The key to compliance is data integrity. To achieve data integrity enterprisewide, the integrated, end-to-end configuration lifecycle management model must support two types of configuration data: real-time data and time-series data. With respect to real-time data, the model must establish a live context for viewing configuration data as it exists for any server or application at any moment in time. The ability to support real-time data ensures that the management view accurately reflects the actual physical environment at all times. To provide the necessary time-series data, the model must track all changes (deltas) to configuration data over time and store them as a series of lightweight data models. This series provides a time-based chronicle of changes that IT can use to track the configuration drift of servers and applications from their compliance baselines. IT can quickly reconstruct configuration states and perform analytics to accurately and authentically track compliance trends. Using this approach, IT can identify trends of noncompliance as soon as they emerge. Traditional time-series models take periodic snapshots of the configuration database and store them as heavyweight, storageintensive database models. These database snapshots are inadequate in that they only permit demonstration of compliance to a given reference state that existed at one static point in time, and that is of little value because the information might change at another point in time. 3. Achieve Configuration Standardization To ensure the consistency of configuration change across silos, IT must transform the heterogeneous physical environment typically found in data centers into a homogeneous management environment. This transformation makes configuration data and hence configuration change platform independent. To create a homogeneous management model requires the normalization of platform-specific representations of configuration data, sometimes referred to as configuration items (CIs). Normalization requires the standardization of configuration item definitions across all platforms. The normalized configuration items can then be rolled up into higher-level definitions that represent the overarching business services supported by the configuration items. IT can create a homogeneous data center management model using a bottom-up approach that mirrors the business-process model of the overall business. The resulting model is independent of platform and is also independent of any silo from a management perspective, enabling IT to achieve consistency in the configuration states of services. A major benefit of the homogeneous data center management model is that it permits IT to enjoy significant benefits without necessarily needing to reorganize away from a siloed organizational structure. The model centralizes the propagation and orchestration of changes while still permitting individual platform changes to be made at the silo level. Here s how: For each change made at the service level, the homogeneous model creates an atomic-level interpretation. This interpretation indicates what changes must be made to configuration items on all affected platforms to accomplish the service-level change. Consequently, the platform changes can still be implemented at the silo level without compromising the overall integrity and consistency of the configuration change at the service level. With a homogeneous data center management model, IT can create a centralized management environment that offers the strong control found in a mainframe computing environment while still retaining the flexibility of a distributed computing environment. 6

9 Create a Holistic I.T. Compliance Score Using the homogeneous data center management model, IT can extend the scope of compliance definition beyond a security vulnerability assessment. The scope can be extended to create a holistic IT compliance score that indicates not only the effectiveness of detective controls (categories of IT activities associated with security), but also the effectiveness of preventive and corrective controls. With the compliance score, IT can provide comprehensive answers to these five questions, as required for enterprise IT audits: Who is performing the IT control and its associated activities? What is being done under a given activity category and how can it be verified? When is the activity being performed? Where is the activity being performed? Why is the activity being performed? (Is it a detective, preventive, or corrective activity?) A holistic IT compliance score provides IT with important capabilities. IT organizations can segment, measure, and improve specific operational activities and their associated processes by answering such critical questions as the following: What is the ratio between the approved, authorized, and active changes in the data center? (Determine the efficacy of the change control process and activity.) What percentage of active changes has been authorized and what percentage has been approved? (Determine the adoption rate of the change control process versus changes being made ad hoc.) What percentage of changes involves a specialist and what percentage of changes, typically those of a repeatable type, involves a generalist? (Check for segregation of duties and roles.) IT can also determine which IT controls are in place (or required) to achieve and maintain continuous configuration compliance. In addition, IT can analyze and report evidence across the board to answer auditors key questions, such as the following: What IT controls are being used to implement and ensure continuous configuration compliance? What IT controls are in place to provide detective measures against noncompliance? Which IT controls can be used to prevent noncompliance? Which IT controls can help correct/remediate noncompliance? With a holistic IT compliance score, IT can address the vast majority of IT controls that typically appear on auditors target lists. This maximizes the breadth (and depth) of control coverage that IT can claim is in place for supporting overall corporate compliance objectives. In addition, IT can determine an overall IT operations capability maturity score and segment it by security compliance, operational compliance, and process compliance. Get Off to a Fast Start with BSM Business Service Management can accelerate the implementation of this approach for integrating change and compliance. A BSM approach helps IT to create an end-to-end configuration management model, ensure data integrity, and achieve configuration standardization. BSM also enables IT to automate many processes. For example, while migrating part of its server base to Linux, the Chicago Mercantile Exchange (CME) needed to ensure the reliability of its Linux servers, which were used to route trades and disseminate market data to partners. The CME deployed BMC BladeLogic Operations Manager to manage the rollout of software changes. Some of the results included the ability to quickly track configuration and patch problems and correct them quickly as well as reduce downtime, which can cost CME $2 million per hour of lost revenue. Change and Configuration Management Solutions BSM change and configuration management solutions provide centralized, end-to-end, lifecycle management of configuration and changes. Through policy-based automation, these solutions not only speed change implementation, but also enforce the use of best-practices change processes, such as those outlined in the IT Infrastructure Library (ITIL ) guidelines. In addition, they ensure that all changes are implemented according to policy, including security and compliance policy. As a result, the solutions facilitate change without sacrificing control. 7

10 The Value of a Configuration Management Database A configuration management database (CMDB) provides a single source of reference and control across all IT disciplines to ensure that all processes are working from consistent and accurate data. This becomes even more critical in an environment of frequent changes. The CMDB should maintain information on the relationships of the IT infrastructure components to the business services they support. In addition, it should provide an auto-discovery capability that can automatically build asset registers and populate the database with detailed information about the assets in the IT infrastructure, including their location and configuration, as well as their physical and logical interrelationships. Conclusion IT executives no longer have to look at responsiveness and compliance as two competing areas and trade off one against the other. This paper described an approach that integrates change and configuration management with compliance assurance. BSM solutions can help IT speed implementation of the approach by enabling three key best practices: create an end-to-end management model, ensure data integrity, and achieve configuration standardization. With this approach, IT can reconcile responsiveness and compliance in the data center while also reducing labor costs, improving time-to-market, increasing staff productivity, and lowering the cost of compliance. For more information about BMC solutions that address change and compliance, visit 8

11 Business runs on IT. IT runs on BMC Software. Business thrives when IT runs smarter, faster, and stronger. That s why the most demanding IT organizations in the world rely on BMC Software across both distributed and mainframe environments. Recognized as the leader in Business Service Management, BMC offers a comprehensive approach and unified platform that helps IT organizations cut cost, reduce risk, and drive business profit. For the four fiscal quarters ended June 30, 2009, BMC revenue was approximately $1.88 billion. Visit for more information. About the Author Vick Vaishnavi, vice president of Worldwide Marketing for BMC Software, is responsible for driving BMC s global marketing strategy, market development, campaigns, and field operations activities. He has 20 years of experience in enterprise IT software and has held executive and leadership roles in marketing, alliances development, product management, engineering, and sales operations at various companies, including BladeLogic, Rishisoft, Opticom, and APRISMA. Before joining BMC, he played a key role in trans forming BladeLogic from its start-up stages to its successful acquisition by BMC. He has been awarded six United States and international patents for his work in IT management software systems. He holds a BSEE from IIT India, an MSCE from the University of Massachusetts, and an MBA in marketing and finance from Boston University School of Management. BMC, BMC Software, and the BMC Software logo are the exclusive properties of BMC Software, Inc., are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office, and is used here by BMC Software, Inc., under license from and with the permission of OGC. IT Infrastructure Library is a registered trademark of the Office of Government Commerce and is used here by BMC Software, Inc., under license from and with the permission of OGC. All other BMC trademarks, service marks, and logos may be registered or pending registration In the U.S. or in other countries. All other trademarks or registered trademarks are the property of their respective owners BMC Software, Inc. All rights reserved. *105465*