All about IT Governance

If you hold your client’s classified or sensitive data as part of performing business with your client, you may want to get an ISO 27001 to offer ’security’ comfort to your clients. Get it?

Here is an example, if you hapenned to hold your clients’ source code or similar sensitive data as part of performing your business, your client will be concerned about the security of their sensitive data -  specifically, they would like to know if your Information security department is reliable and sustainable.  That is where ISO 27001 comes in. Not all companies benefit from ISO 27001. Right?

What does ISO 27001 offer that is different from what you have today? It is a measuring Framework. Framework which enables you to scale your policies and handle them appropriately as your grow.

Security policies in companies today are often abstract and gets close to the ‘terms of usage’ policy within a company. However, it is worth exploring an ISO security framework - ISO 27001. This enables you to formally enumerate policies, data classifications and provide an appropriate risk treatment and provide continuity.

For those who are not following  Symantec in the past 6 months, you may be in for a surprise that EDS was the appointed outsource vendor for taking over most portions of the IT. Although, the details are a bit sketchy, it is our belief that a minimal IT is being owned by Symantec and the rest of IT services including client services, help desk services, infrastructure management and core business applications management is handed out to EDI.

The following are the lessons we have gathered:

a. There are 3 schools of outsourcing:

1. Outsource business secondary services (helpdesk, client services etc.)

2. Outsource a portion of your growth services (Internal QA, Internal Development for IT)

3. Full-outsource: Outsource everything except Governance (including IT Security), Compliance and Vendor Management

We believe what has hapenned at Symantec is #3 above. It is a fairly large responsibility however, it is very common in Hospital environment.

b. Symantec & EDS are now in a wedlock - it is hard to even imagine looking back

c. We strongly believe, if the company is in either Run or Grow mode (not transform mode), then ‘full-outsource’ may work.

d. EDS does not come cheap however, if Symantec strongly believes in ‘Grow’ mode, maybe IT was a distraction (I know, I can’t believe I am saying it).

e. Company employees would have to be transitioned in various packages however, it may be hard to build a team ever again to build out IT - so skeletal team within above areas and ‘hard to find’ liaison people would have to be retained.

There are a few deployment strategies and would depend on the ’status’ of your IT applications and ‘posture’ of the current DR deployment (if any).

I will describe the status and posture later but lets assume that most of our Business Applications are deployed (and not being built/delivered) - then, one of the deployment strategies we have seen is: Start a DR site with ‘DR ecosystem’ and ‘Testing/Staging ecosystem’ in the same datacenter.  As you build the DR ecosystem, you can test failovers on testing/staging ecosystem with DR ecosystem. On reaching sufficient comfort, start fail-overs between primary-to-DR site. Treat this as a baseline and any additions, you first test between DR ecosystem and test ecosystem and finally test with primary site. This is a great strategy as long as your IT ecosystem is fairly stable.

The assumption made above is what I call ’status’ - term refered to status of the business applications - IT is always deploying upgrades one way or another - its hard to see a ’stable’ status.

In addition to the status, you could also have a ‘temporary’ DR site and that is what I call ‘posture’ - term used to refer to DR ecosystem status. In the above scenario, the posture of the DR site is completely new.

Now back to another example, if the status of IT is half-ready and DR posture is ‘temporary’, it might be best to do this:  Start creating a clone of the existing temporary DR site (assuming it is deployed right) at the new site - start migrating application by application to the new site. Essentially, you are doing DR-to-DR site migration and performing fail-over between these 2 sites. This would also enable you to not dump all the investments in the old DR site. While you are doing this, new deployments should be done in the new IT ecosystem and perform fail-over tests between the primary and new DR site. Once the old DR site is ready to be retired, start the fail-over testing between new DR site and the primary site.  Whoooosh!

If the IT status is pretty stable and posture is fully ready however you need a new DR site for logistics reason (which is very rare), you may want to consider building a DR site (which is almost or better clone of the old DR site) and perform Primary-to-New-DR-failovers and build this one application at a time.

If you need additional perspectives, please let me know. Maybe, I can help.

Simple answer: Data recovery.

Detailed answer: It would depend on your RPO expectations and data storage/retrieval strategy. If the data is mirrored (in real-time or almost real-time using NAS/SAN), it turns out to be expensive but RPO can be low. However, if the data is stored on tapes, it would be cheaper however, RPO would be high.

Companies like NetApp are  a key element for the first approach (Data mirroring approach) while Companies like SunGard are key players for the second approach.