Automation of manual tasks

Improvement of operational activities

Documented policies and procedures

Training and awareness

Screening and vetting

Operational security control

For operational reasons, technical staff will often need to have privileged access to key technical areas (e.g. root system passwords, physical access to Data Centres or communications rooms etc). It is therefore essential that adequate controls and audit trails are kept of all such privileged activities so as to deter and detect any security event s.

Physical controls need to be in place for all secure areas with logging in-out of all staff. Where third party staff or visitors need access, it may be Service Operation staff that are responsible for escorting and managing the movement of such personnel.

In the case of privileged systems access, this needs to be restricted to only those people whose need to access the system has been verified – and withdrawn immediately when that need no longer exists. An audit trail must be maintained of who has had access and when, and of all activities performed using those access levels.

All Service Operation staff should be screened and vetted to a security level appropriate to the organization in question.

Supplier s and third-party contractors should also be screened and vetted – both the organizations and the specific personnel involved. Many organizations have started using police or government agency background checks, especially where contractors will be working with classified systems. Where necessary, appropriate non-disclosure and confidentiality agreement s must be agreed.

All Service Operation staff should be given regular and ongoing training and awareness of the organization’s security policy and procedure s. This should include details of disciplinary measures in place. In addition, any security requirement s should be specified in the employee’s contract of employment.

Service Operation documented procedures must include all relevant information relating to security issues – extracted from the organization’s overall security policy document s. Consideration should be given to the use of handbooks to assist in getting the security messages out to all relevant staff.

All Service Operation staff should be constantly looking for areas in which process improvements can be made to give higher IT service quality and/or performed in a more cost-effective way. This might include some of the following activities.

Any tasks which have to be carried out manually, particularly those that have to be regularly repeated, are likely to be more time consuming, costly and error prone than those that can be systemized and automated. All tasks should be examined for potential automation to reduce effort and cost s and to minimize potential errors.

A judgement must be made on the cost s of the automation and the likely benefits that will occur.

Дата добавления: 2014-12-23