Availability + Security

[Ziad]

As most of us are aware, ITIL v2 does not have a Security Management process, I have been informed that this will be part of ITIL v3.

I've been taught that Security Management is part of Availability Management.
- Does anyone have any thoughts that can support that fact? Please explain some?
- In case we agree on the above, can someone tell how can availability management (as a support for security) protect against security threats, ie: a website hack?

Thanks,
Z!

[UKVIKING]

Funny

I see Security Management as a separate process set covering Service Support Delivery, ICT Infrastructure & Application Management

The graphic from itSMF pocketbook IT Security Managment shows that

BS7799 is another standard for this endevour.

Or are you talking about specific threats or setup

If you are talking about a hack attack or an exploit, it is an Incident - solved by a Change to the environment

SQL Slammer worm patch from Micrsoft prevents the worm from working
Cisso IOS vulnerability patch prevents exploits
Period MS patches fixing holes.

If you are talking about what ports/protocols the specific network groups should block allow etc... that is a business decision not an ITIL or any other process decision.

What ITIL and the other processes should do is help you write the processes, review them, evaluate and enforce them.
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[Ziad]

Indeed we can clearly see "Security Management" in the graph from the ITSMF booklet... But if we dig within the same booklet we won't find any chapter about Security Management. While we can find Security as an Element of Availability Management (page 65).
So yes, Security Management is part of of Availability Management.

You are right, BS7799 handles all aspects of security but I wanted to know how is this handeled with ITIL.

I am not trying to play the smart guy here, but my question was in reference to a question that was part of a previous Service Manager exam (I do not know which one), it was referred to be by a friend since I am currently preparing to sit for my Service Manager exam early next month.

Cheers,
Z!

[UKVIKING]

Bonk.. Ouch... that hurts

You are right.

OK How would ITIL handle security.

OK let us look from all the support disciplines
Service Support
Incident Mgmt
Any security event could be an incident or a Major Incident
Problem Mgmt
A recurring event could be a candidate for Problem Mgmt - problem or error control
Change Mgmt
In order to fix the security issue, a RFC has to be raised
Release Mgmt
Pushing out the fix after the required Build//Test
Configuration Mgmt
Having the details about the software version, IP ranges, software...
Service Desk
poor sods.. they have to get the monitoring alerts, customer complaints, and create all the incident tickets

Service Delivery
Availability
Any security issue can affect the Availability of Service
Service Level MGMT
Any SLA should have a clause for emergency patching, network protocals and ports open (relevent to the particular service of course)
Capacity
Will the security concerns adversely affect the capacity of IT to provide services.
Continuity (Disaster Recovery)
need I say more.... a Security breach may force you to activate your DR site
Financial
Cost of the security breach or the fix to prevent it if ithas not occured

This I think is more what you want
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[m_croon]

Actually, a seperate book on security management was published by CCTA/OGC in 1999. I think it was somewere in between of ITIL1 and ITIL2 that this was published. For years, it has been debated whether it was a full part of service delivery. It has in my opinion always "stood apart".

Book ISBN: 011330014X
CD ISBN: 0113309422
Online Subscription Code: 7003152
Date Published: 20 April 1999

[Ziad]

Thank you John,
Very helpful as usual.

Z!