80
Asset & Configuration Management (CMDB) Workshop Don Page Marval Group www.marval.co.uk

Asset & Configuration Management (CMDB) Workshop _HK_Mar07-CMDB_Workshop_D… · Asset & Configuration Management (CMDB) Workshop Don Page Marval Group •

  • Upload
    haminh

  • View
    262

  • Download
    2

Embed Size (px)

Citation preview

Asset & ConfigurationManagement (CMDB) Workshop

Don PageMarval Group www.marval.co.uk

• Co-author of ITIL (worldwide best practice in ITSM)• Co-author of BS15000 (British Standard for IT Service

Management) • Co-author ISO 20000 (worldwide ISO Standard for IT Service

Management)• Co-author BSI Code of Practice for ITSM (BS 15000-2)

• Don Page (ITSMF Life-Time Achievement award)• Fellow of the Institute of Service Management• Helpdesk Institute advisor• Award winning ITSM projects

Who is Don - Credentials

“Don’s ITSM projects have won 8 of last 10 annual European IT

Service Management Improvement Project of the

Year Awards”

News: At the recent UK ITSMF Service Management Awards, Marval & British Telecom Ireland picked up

“Service Improvement Project of the Year”

Finalists: BT Ireland, Racal Vodaphone, BT England, Pilkington's

Recent Projects Include

� European Central Bank (ISO 20000/SOX)

� Dimension data worldwide (ISO 20000/SOX)

� Heineken Worldwide (ITIL)

� AIB bank Europe (ISO 20000/SOX)

� UK National Health Service

� British Telecom Ireland (ISO 20000/SOX)

� Worldwide Scout Jamboree

CMDB played a critical role in delivering success

Don’s thought for the day

1. I believe many traditional IT departments are not currently capable of delivering a quality & cost effective business servicewithout having a critical re-think

ICT Strategic Objectives1. Internal cost reduction & resource optimisation2. Increased IT infrastructure & Service reliability3. Investment protection & risk reduction4. Encourage positive workplace behaviour & investment5. Improved customer experience & communication

Accountability/Governance/Evidence

increased business value of

IT

reduced IT cost

Clarification

1. Asset Management– Focused on the financial accounting of assets

within an organization

2. Inventory Management– Focused on the physical & quantitative tracking

of assets within an organization

3. Configuration Management– Focused on the relationships & dependencies

between physical assets components, software & Services within an organization

�������������� ���

���������������������

PeopleWho, Where, What Skills, Attributes,

Experience

DocumentationReports, Agreements, Contracts,

License details, Policies, Processes, Procedures, Service Improvement Plans, Service requests (Incidents

Problems Changes), Evidence

EnvironmentAccommodation, Light, Heat,

Power Utility Services (Electricity Gas Water Oil)

Office Equipment Furniture Plant & Machinery

HardwareComputer & network

components, cables (LAN, WAN) Telephones, Switches

ATMs

SoftwareBusiness & In-house applications,

Operating systems, Network management systems, Utilities

(scheduling, backup & recovery) Packages, Desktop support

Data FilesWhat, Where, How

important

ServicesPayroll InternetEmailATM

What is the IT Infrastructure?

Sample CI record

MaintainerOwner/user

Maintainer/supplier

Components& key attributes

Value

Maintenance costsLicenses/contracts

Location

� Parent/Child relationships & dependencies� Turns an asset register into a CMDB� Essential for good change mgt & risk assessment

Service

Question: What can we use a CMDB for?1. Managing the IT Infrastructure2. Standard asset & inventory tracking3. Customer support (service desk)4. Risk assessment for change evaluation5. Managing licence, maintenance & warranty contracts6. Business continuity & Maintaining a disaster recovery manifest7. Documenting who, what & where critical business systems &

services are.8. Dependencies & relationships between items9. Departmental costing & chargeback10. Reducing operational costs & purchases through improved control11. Supporting regulatory & corporate governance (e.g. ISO 20000/

ISO 9000)

The Goal of a Configuration Management Database (CMDB)

1. Account for all the IT assets & configurations & Services within the organization

2. To support change & risk assessment within the business3. Provide accurate information on configurations & their

documentation to support all the other Service Management processes

4. To assist in delivering a better service & more reliable IT infrastructure

5. Reduce dependency on individuals having all the knowledge

In summary

1. What have we got2. Where are they3. Who owns them4. How many have got5. How much are they worth6. What are the key dependencies & relationships7. What problems with them had we got/had/fixed

Benefits of Configuration Management

1. Control – Verifying & correcting configuration records gives you a greater degree of control over your infrastructure

2. Integration – Integrating all configuration-related IT processes can reduce errors & the number of staff needed to administer your environment

3. Decision Support – Making decisions & meeting commitments is easier when you have complete & accurate data, resulting in better resource & performance estimates

Tips & pitfalls

“Sorry Don is off today - where exactly is your PC located Mr. Smith”

The Business & customer already think we are in control of the IT Infrastructure

The Challenge1. No central CMDB available2. Different source of asset information,

maintained in various forms (databases, spreadsheets, text documents)

3. Auditing often difficult & time consuming4. Dependencies & relationships unclear or even

unknown5. Dependency on key personnel6. Information time consuming to maintain7. Contract renewals sometimes missed8. Governance controls not in place9. Documentation not always updated10. Don’t know where to start “The job is just to big”

CMDB Project Scope

DEFINE DESIGN DEPLOY DRIVE

� Where do we want to be

� Where are we now

� How do we get there?

� How do we know we have arrived?

� High level business Objectives

� Assessment � Implementation � Measurement

� Continuous Process Improvement

DISCOVER

� What is the Vision

� Policies, Process, Procedures, Guidelines.

Time

Common problems

1. Operational processes & procedures not in-place or followed

2. Poor data requirements & quality3. Underestimating the size of the

task4. Trying to please everyone

– trying to get every CI & attribute to meet everyone’s wish list

Common problems cont.

1. Not keeping the data up-to-date2. Not selling the benefits3. Assuming that discovery tools will

solve all your problems4. Not having the right people

available to identify relationships & dependencies between items

Some Practical Tips

1. Don’t expect 100% accuracy but aim towards it2. Audit the process as well as the data, control access3. When capturing initial data, don’t spend time trying to

get 100% attributes. Decide what you consider mandatory - value added data can be captured later

Getting started

FOCUS Managing an IT &

Service infrastructure

Is the same as managing a number of coke

machines

CMDB

High Level CMDB Process Framework

Start

End

Are weClassifyingCI/Assets correctly?

Are they easy to identify & report on?

Is the information accurate

Are weseeing the

benefits/value?

Operational & Financial Worth/value

Alignment to

industry best

practice & standards

Risk

The 4 “R’s”

Focus on these 4 simple questions

Level of Professionalism

ISO 17799

����������������� ����������

What do you want from your CMDB?

1. Should we buy X more of these computers?2. What equipment & applications is causing us problems?3. Should we renew this maintenance contract?4. Is the supplier meeting their agreements?5. What has been the performance of supplier X?6. How many of these items have we got?7. What services are running on server X?8. What other business services are effected/at risk if we turn this

server off?

Examples:

Configuration & Service Relationships

Payroll Service

HRHRPayrollPayroll

MarketingMarketing

1. Who do we keep informed/when2. What other services are effected3. Who needs to fix it/be involved4. How long will it take5. How long have we got6. What service needs to be restored first7. What is its business priority & impact?

If the Payroll Service fails

1. Who do we inform & when2. What computer is it on3. Who needs to fix it/be involved4. How long will it take5. How long have we got6. How do we do it7. What is its business priority &

impact?

If Server X fails

Accounts Department

Server X

Backup server

What are the maintenancefunctions & routine activities

Performed & by who?

Assigned tosupport team

for repair

CMDB Automation Uses

Infrastructureevent detected for

SERVER X

Major Incidentrecorded against Server X

in ITSM tool

Related Major Incidents recorded against

affected Service's running on Server X

Affected CI passed to

ITSM Tool

CI detail & RelatedServices

Obtained from CMDB(+SLAs, priority, impact etc)

Service Desk

Server X

Payroll Service

Affected Business usersautomatically notified

Billing Service

Server XRestored (1st)

BusinessService's restored

Requests auto-closed Business usersnotified

NOTE: 3 service incidents generated for this outage

e.g Your own scripts, Network/hardware Monitoring,Security, Operational Events

Each customer who reported an incident against any of the services receives an automatic receipt & closure notification

(Asset & Configuration Mgt. Database)

CMDB

Expectation mgt.

Identify & agree high level scope of CMDB

Scope & level of detail required(phase 1)

1. Phased approach recommended - Identifya) Critical servicesb) Underpinning services, critical servers & devicesc) Critical applicationsd) Licensed applicationse) VIP People & placesf) Devices & Services required for Business continuityg) Support for related Key ITSM processes (e.g. Change &

incident)

Phase 1 - Key Steps Required

1. Produce required ITSM policies, processes & procedures for maintaining CMDB

2. Collect information relating to IT products & services within key locations

3. Identify & collect critical servers & services for all locations

4. Provide phased collection for each site (e.g. Period1=Kettering, Period 2=London)

Team Questions*1. In order to obtain team buy-in & contribution, we need to

ensure there is a direct benefit for each team – “What’s in it for me”

– What decisions does the business want to make?– What does change & problem management need?– What do applications support need?– What does finance need?– What does the Service Desk need?– What does business continuity need?– What do the other teams need (e.g. networks, operations)?– Facilities & telecoms?

CMDB Data Population & Maintenance

Data availability/sources1. What have we got; where is it; who owns it?

– Master source of Supplier & Contact data– Asset databases– Spread sheets– LDAP databases may contain additional information– HR, Pat testing, facilities databases– Other tools

Data collection methods1. Manually - can be time consuming2. Semi-automatic - with Bar code scanners

– Resource intensive, but accurate3. Auto-discovery - Discovery tools can be expensive & resource

intensive. � You still have to manage the exceptions

4. Required Activities -– Obtain details from discovery supplier which components will be

identified & what will not be identified – We need to Identify what elements of the discovery data is required

(defining the filters)– Check mapping to ITSM tool is possible & at what level of integration will

be available– Discovery tools may not address bespoke applications identification

TOOLS(A fool with a tool is still a fool)

1. Standalone Asset/CMDB tool will limited its value

2. You will need an integrated IT Service management software tool to best exploit your CMDB investment

3. The tool will fail without underpinning policies, processes & procedures, which are

� available� followed

Process Reinforcement Statements

1. A process exists to produce quality products & services

2. A process which inhibits quality is a bad process

3. Process, whether defined or understood, always exists

4. Process must evolve to be successful

Marval Process Improvement process

Education

1. Hold awareness, benefits & training sessions before you start (not after)

2. Run usage scenarios for policies, processes, procedures & workflows

3. Understanding the processes, procedures & workflows required to support the CMDB

4. How to use the new processes, procedures & workflows from within your ITSM tool

Reporting & Governance Actions 1. Is there any Governance/regulatory requirements & evidence

required2. Identify who needs what information from the CMDB – e.g.

– Applications team– Service Desk– Finance department– Change management– Quality assurance– Contracts/license management– Others

Business Continuity Actions

1. Identify critical Hardware components (e.g.– Servers– Routers

2. Identify critical Services & Applications running on critical hardware

3. Identify critical applications/source which should be part of the Definitive Software Library

4. Assign Business impact & risk ratings to critical items 5. Identify required reporting & audit checks

Asset & configuration item life-cycleCMDB Process workflows

CMDB Process Requirements*1. Identify high level processes required

2. Define support process & procedures required to maintain the CMDB (e.g.• Take-on• Moves• Disposals• Ownership changes• Configuration & relationship changes• Audit• Loan• Contract /licence controls

Related CMDB Process Requirements

1. For all ITSM processes ensure they have an Update CMDB step before closure (e.g. Incident, Change)

SOLVEDNEW WIP UPDATECMDB CLOSED

CI Classification rules

1. Keep them simple2. Only maintain to the level of detail you need & have the

resource to keep it up-to-date3. Identify what you want to report on before you define the

classifications4. Decide who needs to know what & why5. You must be able to make a decision on the collected

data

Good classification allows you to group, search & report on your CMDB

Data & its classification is the Key

1. No matter which service management processes you implement, the data used will make them effective

a) Configurations are constantly changing, last week’s correct data could be obsolete this week

b) Your configuration data must be available to all of your ITSM processes, even the most accurate data is useless if you can’t get to it

ISO 17799

����������������� ����������

CMDB CI Categorisation*

1. High level grouping – Category (e.g. hardware, software, documentation)– Major type (computer, database) - *– Minor type (e.g. Backup-server), use for detailed

classification– Logical or physical CI

Hardware, computer, laptop

Logical configurations items

1. Is generally used a Grouping item2. Makes CMDB maintenance/searcing easier3. Used to identify a ‘Service’ or grouping CI’s

– FINANCIAL (LOGICAL)• Application 1• Application 2

– Training-room1• Location• PC 1• PC 2• Projector

Minor type consideration

1. Use a minor type to maintain the right level of detail needed

1. Backup-Server – 20 pieces of data2. PC – 10 pieces of data3. Printer – 3 pieces of data

HardwareComputer

Backup serverEmail serverDatabase server

Network

CategoryHardwareSoftwareApplicationDocumentationService

SoftwareApplication

PayrollSystem

Define CI Organisational Grouping activity*

1. Define organisational structure to support reporting & grouping – e.g.– Department– Division – Site– Location– Region

Define Misc. CI Attributes

1. System ID2. Cost centre3. DSL Item4. DHS item5. Business continuity item6. Last audit date7. Next audit date8. Last preventative maintenance9. Service state

– Under warranty– Under maintenance– None

For example:

CI Status Codes*

1. Describing the current operational state of a CI. E.g.

– Active– Disposed of– Damaged– Free– Under Change– Reserved– In Repair– In Test– Stock

SLA & OLA CI assignment*

1. Maintenance contracts– CI Exceptions

2. Asset/CI3. Services4. CI major types (e.g. web server, email servers)5. Locations6. People + suppliers7. Departments

ITIL CI Relationships1. Child of2. Concerns3. Connected with4. Depends upon*5. Is a copy of6. Is part of7. Runs on8. Uses

Conclusion

• Building an effective CMDB is NOT difficult, it just requires:

1. Attention to detail2. Having the right policies, processes & procedures in place3. People to follow process4. Demonstrable business & operational benefits5. Hard work6. Alternatively hire a “Storeman”

ICT’s role is to help the business do things

�Faster, �More Reliably �More Efficiently�More Cost effectively�With the evidence to prove it

Achieving Operational Excellence; balancing Risk, Service Quality & Cost

The EndThanks for listening

[email protected]

CMDB Work Packets

Breaking in down into smaller chucks really works

Objective

1. To Identify the required work packets that will contribute to the delivery of a phase 1 Project

2. Assign activities, roles & responsibilities– Project – Process– Technical– Data

5 days• Process: Identify related ITSM CMDB process, sub processes & activities. E.g. Change control, availability

CW4

1 day• Technical: If required,confirmfrom discovery tool supplier which components will be identified & what will NOT be identified for all required platforms.

CW3

2 days• Process: Define CMDB process activity owners, roles & responsibilities

CW2

5 days• Project: Define business case, & obtain management sponsorship

CW1

Estimate in man-days

Owner(s)DescriptionTask

30 days• Data: Collect information relating to Critical IT products & services

CW7

30 days• Process: Produce required ITSM policies, processes & procedures & workflows for maintaining the CMDB

CW6

5 days• Project: Agree CI scope & detail (Stage 1) – Business Critical & underpinning services

– Critical servers/devices– Critical services– Critical applications– VIP People & places– Devices & Services required for Business continuity– Support for related Key ITSM processes (e.g. Change & incident)

CW5

Estimate in man-days

Owner(s)DescriptionTask

5 days• Technical: Review requirements for data integration & maintenance with ITSM tool

CW12

60 days• Technical: Identify critical relationships of which applications & services run on which server for each site/location

CW11

3 days• Project: Define plan & time-lines for non-critical CI collection for remaining sites

CW10

5-240 days• Data: Identify & collect critical servers & services for remaining (locations/Sites)

CW9

Estimate in man-days

Owner(s)DescriptionTask

30 days• Data: Business continuity -Identify critical Hardware components (cross ref. with critical servers activity)

CW16

15 days• Project: Identify reporting & governance/evidence requirements for support teams & business

CW15

30 days• Project: Create CMDB training program for:-

• CMDB Awareness & benefits sessions• New Process & procedure training• Using new processes, procedures &

workflows from within ITSM tool• Sample usage scenarios for new processes,

procedures & workflows

CW14

5 days• Technical: Create a test system/environment for new CMDB database & test

CW13

Estimate in man-days

Owner(s)DescriptionTask

15 days• Data: Business continuity -Assign Business impact & risk ratings to critical items

CW20

10 days• Data: Business continuity -Identify critical applications which should be part of the Definitive Software Library (Master software source code)

CW19

30 days• Data: Business continuity -Identify critical Services & Applications running on critical hardware

CW18

15 days• Data: Business continuity -Identify critical Services & Applications

CW17

Estimate in man-days

Owner(s)DescriptionTask

2 days• Technical: Finalise & agree organisational structure to support reporting (e.g.. site, department, region etc)

CW24

2 days• Technical: Define & agree technical major type CI attributes. E.g. category, major & minor types

CW23

1 day• Technical: Finalise & agree CI Relationships

CW22

10 days• Process: Business continuity- Identify required CI reporting, audit checks & processes including DSL verification

CW21

Estimate in man-days

Owner(s)DescriptionTask

60 days• Project: Identify external, internal business services, Operational & Core Services

CW27

30 days• Project: Identify & agree what SLA/OLAs should be attached to which CI’s (service, people, places etc)

CW26

1 day• Technical: Finalise & agree CI Status codes

CW25

Estimate in man-days

Owner(s)DescriptionTask

3 days• Technical: Transfer re-configured CMDB to live environment & test

CW30

30 days• Project: SLAs: Identify business & supplier; related licences, contract & SLA details.

• Identify any contract conflicts & overlaps

CW29

90 days• Project/technical: Mapexternal, internal business services, Operational & Core services & relationships to Underpinning CIs (output=revised service catalogue & SLA Targets)

CW28

Estimate in man-days

Owner(s)DescriptionTask

10 days• Tool: Review CMDB exploitation –e.g. Emailing, Service desk, system mgt. & event mgt. tools

CW34

3 days• Technical: Review application support for CW32

CW33

90 days• Project: Review, document & confirm requirements for application management Identify for each application:- e.g.

• Underlying database version• Application interfaces• Developed with

CW32

10 days• Process: Important: Review & modify related ITSM workflows , processes & procedures to include a ‘Update CMDB step’

CW31

Estimate in man-days

Owner(s)DescriptionTask

Business Value Key Performance Indicators

What’s in a Configuration Item?

������������� ���� �������������

����������

���

�������������

���������

� ���

��������� !�"��

#��������$���

%�&���������

�����

����'����

(�)�������

(���������

#�'��&��������&

�����&� !�"��

�����

���*!������������

� ��������*!��������

+��!�����������&�'��&�

&����$�������,

���������

�����"!���������

������������

������������$�����

����

���������

�������'�$����������

'����&������&�$����

����!'��

&����$������

��������

������-���� �&&-�

������-�.�!����

/�����������&����������

��&����������� ���������

����������,

01���&���

���������

+������������

�����������

��&���������

����������

���"����'����������

&�'��&�'��!���

����������������

(������������&����

!�������

���� �������

��������"&��$�������

���������$�����,

"�����#

�!�����-���� ��

������2�������3

�������������"!���

�&&�����$��������

�����������!'��

����'��

(���'�����

���������

���������

������"!����

����'������

����&

Data is the Key

1. No matter which service management processes you implement, the data they use will make them effective

– Your configuration data must be accurate, which means it must be updated frequently

– Configurations are constantly changing, so last week’s correct data could be horribly obsolete this week

– Your configuration data must also be available to all of your IT processes, because even the most accurate data is useless if you can’t get to it

Understanding a CMDB Model1. Relationships between CIs

– Relationships make the CMDB a powerful decision support tool– Relationships allow you to understand the dependencies among CIs

2. Related Data– Includes information related to CIs, such as incidents, change requests, contracts,

Service Level Agreements (SLAs)– Contains information about your CIs & forms an important part of your IT

infrastructure

Value Proposition

1. Relationships between CIs bring it all together2. CMDB provides a single source of record that can be leveraged by

all ITSM processes3. Configuration Management provides better control, integration &

decision support across your organization4. It is critical to ensure the CMDB always provides accurate

information about your infrastructure

The CMDB Challenges1. To have the plan & processes in place to keep it up-to-date

• Start with a phased approach, critical servers & services first• If you find it difficult – hire a “STOREMAN” not an IT guy

2. To identify how to better exploit the CMDB to make informed decisions & risk assessments

3. Note: Discovery tools will help but are not a substitute for good change control

Start Agree on purpose

Agree on Standards/Process

for mgt.

Agree on Scope of

mgt.

Discovercomponents

Decide what Needs to managed

Build CMDB

End 1. Build Overview

DiscoverAssets

Identify CIRelationships &

dependencies

Add CI (s) to CMDB

Use it

End 2. Define CI

Yes

End

NO

Do you needTo manage it

Are CI’s for thisasset defined

Do you need to manage CI

The EndThanks for listening

[email protected]

www.itilics.com