Business-driven IT management

IT companies worldwide have started to improve their service management processes based on best practice frameworks, such as IT Infrastructure Library (ITIL). However, many of these companies face difficulties in demonstrating the positive outcomes of IT service management (ITSM) process improvement. This has led us to investigate the research problem: What positive impacts have resulted from IT service management process improvement? The main contributions of this paper are 1) to identify the ITSM process improvement outcomes in two IT service provider organizations and 2) provide advice as lessons learnt.KeywordsIT service managementserviceIT Infrastructure Libraryprocess improvementprocess

Enterprises and service providers are increasingly looking to process-based automation as a means of containing and even reducing the labor costs of systems management. However, it is often hard to quantify and predict the additional complexity introduced by IT service management processes before they actually have been deployed. Our approach consists in looking at this problem from a different, new perspective by regarding complexity as a surrogate for potential labor cost and human-error-induced problems: In order to effectively evaluate the benefits of IT service management processes – and to target the types of processes that contribute most to management complexity and cost – we need a set of metrics for quantifying the complexity and human cost of carrying out IT service management processes. This paper proposes such measures, and demonstrates how they can be applied to a typical service delivery process in order to assess its complexity hotspots as a basis for process re-engineering.

This paper summarises the results of a Dutch PhD research project on IT security vulnerability and incident response management, which is supervised by the University of Twente in the Netherlands and which is currently in its final stage. Vulnerabilities are ‘failures or weaknesses in computer (application) system design, implementation or operation which can be exploited to violate the security policy defined for that system’. Incidents are defined as ‘events that have actual or potentially adverse effects on computer or network operations resulting in fraud, waste or abuse, compromise of information or loss or damage of property of information’. Hacking, denial-of-service attacks and computer viruses are examples of such events. The research project identifies a number of shortcomings in IT service management processes which affect the speed and quality of IT security vulnerability and incident response processes in enterprises. To shorten the lifecycle of vulnerabilities organizations should implement three basic process elements: (1) filtering and analyzing of vulnerability announcements and alerts, (2) prioritizing of vulnerability response activities and (3) scanning of infrastructure components. Each of these steps can be related to specific IT service management processes and to IT security incident management in particular. Using checklists, procedures and dedicated response capabilities, IT organizations are able to faster detect and respond to incidents.

IT Service Management and Business-Driven IT Management

A growing number of organizations are implementing the ITIL (IT Infrastructure Library) “best practice” framework in an attempt to improve their IT service management processes. However, not all ITIL implementations are successful and some companies have been disappointed with the outcomes. This exploratory research reports on four case studies of “successful” implementations of IT service management using the process-based ITIL V2 framework. Two companies are located in the U.S. and two in Australia. The cases demonstrate a mix of implementation justifications and strategies. Critical success factors (CSFs) suggested in the literature are compared against those attributed to these successful ITIL implementations. Some CSFs, including executive management support, interdepartmental communication and collaboration, use of consultants, training and careful software selection are confirmed. Three new CSFs are identified: creating an ITIL-friendly culture, process as a priority, and customer-focused metrics. Practitioner guidelines, to assist IT managers, who are contemplating adopting ITIL for process improvement and organisational transformation, are also provided together with some challenges encountered and their associated resolutions.

The IT Service Management (ITSM) industry has defined processes as best practices in the widely-accepted IT Infrastructure Library (ITIL®) framework. However, there are few tools available to provide decision support to IT Service Managers who wish to improve service management processes. It is essential to assess the current capability of processes before process improvements are planned. Our research addressed the problems of the lack of transparency and the need for efficiency in ITSM process assessment. Using the Design Science Research methodology, we developed an innovative Software-mediated Process Assessment (SMPA) approach that automates assessment of ITSM processes and supports the decision-making of IT Service Managers. The SMPA approach includes process selection, an online survey to collect assessment data, measurement of process capability and specific recommendations for managers to commence process improvement. We implemented a decision support system (DSS) to automate the SMPA approach and evaluated it at two IT service providers. The evaluations indicated that the SMPA approach supports decision-making on process improvements. In the future, data analytics performed on the assessment data can help IT managers to analyse and visualise the ‘big data’ of process knowledge.

IT service catalogs are a pivotal element for managing IT services in many organizations, in accordance with common practice IT service management frameworks such as the IT Infrastructure Library. However, both in theory and practice, IT service catalogs are underspecified as much emphasis is put on the structure and content of the catalogs while the use and integration into IT service management processes are often neglected. Consequentially, the aim of the present paper is to propose a maturity model for IT service catalogs that covers structure and content as well as use and integration. This advances our understanding of this pivotal artifact in many IT service management systems and helps practitioners to identify improvement potentials for their IT service catalog-related practices.

This research was conducted to evaluate the effectiveness and efficiency of the Simampu information system implementation at the Regional Disaster Management Agency (BPBD) of Serang Regency using the COBIT 5 framework. The information system was designed to assist BPBD in disaster data management, reporting, monitoring, and facilitating quick and accurate decision-making. However, the current implementation of Simampu was found to be suboptimal as it is still under development, and several issues were identified, such as system errors, network disruptions, and inadequate data security, hindering effective disaster data processing and reporting. The research utilized a qualitative approach involving direct observations and in-depth interviews with the system management team at BPBD Serang Regency. This study focused on four COBIT 5 domains: BAI01 (Manage Programmes and Projects), DSS02 (Manage Service Requests and Incidents), DSS03 (Manage Problems), and DSS05 (Manage Security Services). These domains were selected due to their relevance to BPBD’s operational needs and strategic objectives in disaster management. Findings revealed several weaknesses in the management of the Simampu information system, particularly concerning IT service management processes, incident handling, problem management, and information security services. To address these weaknesses, the researcher provided technical recommendations, including improvements in data security, network infrastructure enhancements, and optimization of data processing procedures.

The main objective of the Service Level Management process is to ensure that an agreed level of IT service is provided for all current IT services and that future services are delivered to agreed achievable targets. The number of agreed SLAs has rapidly increased in the IT industry while more and more IT customers have become aware of Service Level Management best practices. IT Infrastructure Library (ITIL) is the most widely used IT service management framework that provides best practices for implementing IT service management processes including Service Level Management. The research problem of this study is: how Service Level Agreements can be implemented with an IT service management tool. We use a combination of IT service management and knowledge management approach to study the problem. The main contribution of this paper is to present results of a case study that focused on improving Service Level Management practices in a Finnish IT service provider company Tieto.

Accurate prediction of process execution time in IT Service Management (ITSM) is essential for service providers to meet service-level agreements (SLA). However, traditional pre dictive process monitoring methods struggle with processes delivering complex process artifacts, where event log data is insufficient to understand the flow of instances. To overcome this challenge, exogenous predictive process monitoring is proposed, utilizing exogenous data sources available in IT organizations to improve the accuracy of ITSM process predictions. This approach leverages a wide range of exogenous data sources, such as the service knowledge management system, to enhance the predictions and decision-making process. The resulting planning and decision support system, incorporating exogenous data, improves SLA compliance through better resource allocation and decisions throughout the ITSM process instance lifecycles.

For an IT service provider, incident management process in which particularly incident prioritization plays a pivotal role in the improvement of service quality and maximization of business profits. Traditional prioritization methods are concern impact and urgency exclusively but overlook financial losses and risks. In this work, an optimal method is proposed using Business Driven IT Management (BDIM) concepts and risk decision-making theory, whereby numbers of incidents can be prioritized to minimize the sum of business losses and risks. The method captures the linkage between IT decisions and business impacts through risk management and sensitivity analysis. A real network is discussed to demonstrate the value of the approach.

IT service management and incident management is a hot topic in every company which serves IT services and they require human effort to manage. In ITIL framework for IT service management, it's always useful to link the incidents with configuration items, in other words the assets or components necessary to deliver IT services and this task is managed manually by IT support technicians in many IT service management tools. The aim of the study is to remove this manual linking step by applying text classification methods and instead to provide an automatic assignment of CI's to incidents. Four of the text classification methods, Naive Bayes Multinomial, k-Nearest Neighbor, Support Vector Machine and J48 decision tree classifiers, are used on three different sets of incidents extracted from the same database by using different filters. The impact of some pre-processing steps is compared on different sizes of datasets.

2008 3rd IEEE/IFIP International Workshop on Business-driven IT Management

Knowing the dependencies among computing assets and services provides insights into the computing and business landscape, therefore, facilitating low-risk timely changes in support of a business-driven IT management. In general, the results of a dependency analysis can be used for infrastructure reengineering, show evidence of policy and process compliance, and support assessments of business resilience. Current passive discovery approaches using network monitoring analyze only direct communication between assets and provide just a single- link mesh view. This work introduces a new algorithm based on NetFlow data preprocessed by the Aurora system developed at IBM Research to create a dependency model of the network. The algorithm uses time-based event correlation and the data mining concept of association rules to detect and classify dependencies that span two or more components. The advantages of the algorithm is that no access credentials are required and no packet payload inspection is performed. The suggested algorithm populates and maintains a dependency model of an observed network that describes dependencies among computer systems, software components, and services. The model combines the mined association rules that express relations between flows into dependencies, which are given intuitive semantics. Tests with simulated and authentic data prove the accuracy of the dependency mining algorithm.

To summarize to business people the main challenges of business-driven information and communication technology (ICT) systems management, we suggest "the 5 C challenges of ICT systems management": 1) cost-benefit relationship, 2) complexity, 3) conformance to higher-level objectives, 4) circumstances and their diversity, and 5) change. We also advocate the slogan "To address the 5 C challenges you need at least the 5 A approaches and a compromise." Here, the "5 As" are the main approaches for addressing the "5 Cs": 1) analysis of benefits and costs, 2) automation of management activities, 3) aims (objectives, policy) modeling and processing, 4) accommodation of different circumstances through customization and context-sensitivity, and 5) adaptability. We also discuss how these 5 Cs and 5 As relate to self-management, policy-based management, and contract-based management and how they can be used for presenting a new project on modeling and using business value information.