Another imperative to have implemented in your cloud consumption
program is the incident and problem management.
It's good for us to think about incidents in relationship to
other terms that sometimes get conflated.
An event is going to be a change in a system state that has a
significant enough impact on the management of a service or other
configuration item that it shows up inside of a log.
It could obviously be an innocuous thing that's taken place as well.
Whereas an incident is an unplanned interruption or
degradation in the quality of a service.
A breach is proof that a system has been accessed without authorization.
And a disclosure is proof that confidential information has been
shared outside of owner‑defined clearance levels.
Upon further investigation,
an event may contain a symptom of what led to an incident,
and an incident may be as grievous as a breach or a disclosure,
but an incident begins with the basic premise of an unplanned outage
or degradation or disruption of service quality.
When we think about incident management, there are three essentials.
First, you need to minimize the negative impact of the incident.
This is something that's stated in ITIL version 4.
It defines it as the primary purpose of incident management.
Being certain that you have logging of the actual problem,
and once it's resolved in the time frame that meets customer agreements,
that it also has documentation.
In order to do this effectively,
an organization needs to have a prioritization of incidents
based upon classification of service impact levels agreed
to by provider and customer.
That's something that needs to take place before there is an incident.
So, when we look at incident classification and prioritization,
it involves understanding what the impact is before
there is some kind of disruption.
So, this is a key understanding of critical services,
what the effect upon the business would include if that was disrupted.
Then you have to consider the urgency.
That's the extent to which the resolution can bear delay.
That would include response requirement incident management
processes from detection to resolution.
And it's really the urgency by the impact that gives you your priority.
By combining impact and urgency into a matrix,
an organization could have a powerful tool to help the business
understand incidents and prioritize the management of them.
When we look at ISO 20000, it has five parts that it understands.
Incident management related to recording the incident,
prioritizing it, escalating it, if necessary,
resolving it, and then closing it officially.
If you were to use the Software Engineering Institute at
Carnegie Mellon University's Incident Management Capability
Assessment that was released in 2018,
you would see that it also has these five elements.
The first element of prepare says to establish your
incident management function.
What are the core processes?
What are the core tools?
You then seek to protect against incidents.
So, here we have key activities that include risk assessment,
prevention, operational exercises for incident management,
training guidance, awareness, and vulnerability management.
The detection capability has to do with network and system security monitoring.
Threat and situational awareness would be part of this as well.
The response would be the incident reporting,
the analysis, and the incident response capability the organization has set up.
And then you would do this continuous process improvement
capability that says that there should be ongoing evaluation and
implementation of the proper personnel,
along with security administration and incident management
information systems that you've set up.