44 per cent of senior management boards perceive it as a costly tick in the box exercise and a necessary evil
According to a pan European survey carried out by research experts Vanson Bourne on behalf of LogLogic, a leader in log management and intelligence, figures indicate that almost half (44 per cent) of medium to enterprise sized organisations (who have already implemented or are in the process of setting up an ITSM framework) feel that at a board level, ITSM is perceived as a costly tick in the box exercise and a necessary evil. A further 13 per cent feel that senior management arent even aware of its existence.
Despite poor awareness at board level, respondents had a clear vision for what they wanted to achieve through ITSM at the outset. Creating better controls and increasing visibility into IT for regulatory compliance was cited as the primary objective (27 per cent), closely followed by reducing IT costs whilst maintaining and improving IT service quality (25 per cent). Improving communication flow (20 per cent) and reducing labour wastage (13 per cent) were also listed as reasons to implement. Interestingly 8 per cent were unaware of what they wanted to achieve and said that it was a directive from senior management to follow.
The survey results indicate that is quite clear senior management and in some isolated cases, the IT department, are largely unaware of the key business drivers ITSM can deliver. says Pat Sueltz, CEO at LogLogic. As referenced by a quarter of respondents, ITSM can greatly assist organisations to become more efficient and secure through processes and controls. As a result, it aids compliance something 90 per cent of respondents said was important or very important to their business.
Key findings:
Biggest challenge in implementation and management: 35 per cent cited measuring process improvements, 27 per cent said monitoring the ongoing status of the IT services and the remainder were split (19 per cent each) between assessing the current state of the IT services and validating the effectiveness and benefits of the process changes.
Failure to report across all controls: A quarter (25 per cent) of respondents said that even after implementation they cant or wont be able to report and alert across all controls (outside of security management) including: identity and access monitoring, user activity monitoring, change control monitoring, IT infrastructure monitoring and business continuity management. Businesses need to address the whole IT picture not just 1-2 aspects. Its a strategic approach, not a tactical checklist. Addressing all controls will apply a consistent, clear policy across the business and will provide better results.
Unable to provide evidence of ITSM implementation (through automated reports that collect metrics across their organisation) for compliance purposes: 27 per cent are still not able to provide evidence or wont be even after implementation. This is critical for long term archival so that organisations can attest compliance activities on an ongoing basis. Organisations need to further support their framework with technology that addresses this critical area; otherwise the organisations compliance requirements are not complete.
Lack of skills and qualifications required to implement and manage an ITSM framework: Survey responses indicated just 46 per cent felt their teams were up to the task. Within the remaining 54 per cent who felt that they didnt have the skills, 31 per cent were said to manage but that it was not ideal and 23 per cent felt a lack of skills was becoming an increasing problem for them.
Sueltz continued: With just over half (52 per cent) of respondents investing in six months or longer to implement an ITSM framework and 42 per cent taking 3-6 months (the remainder doing it in less than 3 months just 6 per cent), its no small investment from a time, cost and resource perspective. Its therefore critical that the outcome/results are measurable. However, even this seems beyond most IT departments reach.
Organisations are missing a golden opportunity to realise clear business benefits. The key to successful implementation and to achieving their objectives is to follow service validation steps from start to finish. Collect and analyse log data that is already available within your organisations and use it to assess, monitor, measure and validate your framework. This can be carried out by the existing team and is well within their skill set. By proving criteria and targets are met, the IT department will gain senior managements respect and interest. It can and should be achieved, Sueltz concluded.
Alerting & Reporting
The LogLogic Compliance Suite is the first solution of its kind to provide out-of-the-box support for COBIT 4.0 and ITIL, which are common frameworks used frequently by businesses to help achieve Sarbanes-Oxley Act compliance, and ensure security and availability of IT assets in general.
The reports and alerts monitor the majority of controls defined in the new COBIT 4.0 IT audit framework specifically and cover all four sections broadly. The COBIT controls and corresponding LogLogic reports and alerts cover six important areas of IT risk management:
Access: Identity and access monitoring
Activity: User activity monitoring
Change: Change control monitoring
Security: Security monitoring
Infrastructure: IT infrastructure monitoring
Continuity: Business continuity management
By automating compliance reporting and alerting based on critical infrastructure data collected and stored by LogLogics appliances, the LogLogic Compliance Suite removes the complexity and resource requirements from implementing policies such as COBIT and ITIL to successfully meet SOX and other regulations.
Compliance reporting and alerting from LogLogic is ideal for IT administrators, auditors and financial executives who want to reduce time to compliance and realize dramatic improvements in risk mitigation and audit accuracy.
LogLogic allows for ongoing data monitoring and reporting and long-term archival so you can attest compliance activities on an ongoing basis. Breakthrough Log Learning technology delivers the industrys first smart behavioral alerts, which can be set by device, device group or network. Adaptive baseline, network policy and ratio-based alerts are all powered by artificial intelligence and machine learning technology. Managers receive early warning of insider misuse and unusual or suspicious behavior they can act quickly.
Customizable Compliance Reporting
LogLogic Compliance Suite uses LogLogics unique Agile Reporting Engine to allow on-the-fly customization of templates. Using Agile Reporting functionality, customers can match information log data against specific corporate controls and policies. Agile Reporting differentiates LogLogics compliance solution from industry alternatives based on static reports. Instead of having to write Perl scripts of statements to customize reports, Agile Reports can be customized with a few simple mouse clicks.
Real Alerts and Reports Based on Real Data
LogLogic Compliance Suite delivers reports and alerts on all four areas of the IT risk management framework defined by COBIT:
Plan and organize (PO): This domain covers strategy and tactics, and identifying the way can best contribute to achieving business objectives.
Acquire and implement (AI): To realize the IT strategy, IT solutions need to be identified, develop or acquired, as well as implemented and integrated into the business process.
Delivery and support (DS): This domain is concerned with the actual delivery of required services, which includes service delivery, security and continuity management, service support for users, and data and operational facilities management.
Monitor and evaluate (ME): All IT processes need to be regularly assessed over time for quality and compliance with control requirements. This domain addresses performance management, internal control monitoring, regulatory compliance and governance.
ROI
LogLogic customers normally experience a return on their investment of six months or less. The ROI of deploying the LogLogic solution can be measured in terms of:
Reduced cost and complexity of log management. LogLogic accelerates the time to identifying and reporting on critical log data and significantly reduces the infrastructure and labor costs associated with log management.
Improved storage and log data retention, reducing the amount of storage required and better utilizing existing NAS and SAN resources.
Better utilization of existing network and IT management systems. Log Routing technology directs critical log data, alerts and reports to the application of your choice, reducing the need to manage multiple systems and the associated costs of training, maintenance and support.
The ability to capture log data from virtually any application or device, eliminating the need for multiple systems. You can capture and store your data once, then report and alert to many different applications.
Reduced downtime and accelerated threat remediation LogLogic protects valuable data, saving resources and reducing downtime.
Automate key compliance activities such as log data collection, retention and analysis. LogLogic generates reports in real-time for proof of compliance.
Improved business continuity through mitigating the risk of network incidents and attacks.
Improved security by deterring IP theft and malicious attacks, and achieving greater insight into user activity
Learn More
Calculate Your Savings
Audience profile information:
Countries covered and number per country:
UK (51), France (52), Germany (51) and Spain (50)
Job title:
Senior level IT Managers, Service and Compliance Managers
ITSM status:
26 per cent already had an ITSM framework in place, 45 per cent were in the process of implementing one and 29 per cent were currently assessing options and the best fit for their organisations.
Framework choice:
43 per cent listed ISO27001 and/or ISO27002, 33 per cent ITIL, 20 per cent COBIT and the remainder were using another or their own internal guidelines.
About LogLogic
LogLogic provides the world's leading enterprise-class platform for collecting, storing, reporting and alerting on 100 per cent of IT log data from virtually any device, operating system or application. The LogLogic family of MX and LX-ST appliances address the compliance, operations and risk mitigation needs of mid-market companies, as well as the most demanding global enterprises. LogLogic's innovations include creating the world's first search engine for fast-moving IT log data, and Compliance Suites that automate using that data to enforce critical controls and regulations.
LogLogic has established a position as the market visionary and leader, with awards that include Info Security Product Excellence Awards 2008, SC Magazine 'Approved for SC Labs Rating' in 2006 and 2007, IT Week's 'Editor's Choice Award', AlwaysOn Top 100 Private Company 2006, Best of Interop 2005, SC Magazine's 'Best Computer Forensics', Info Security's 'Hot Company 2006', and designation to the Red Herring 100 in 2006.
Add a Comment
No messages on this article yet