A scalable SIEM correlation engine and its application to the Olympic Games IT infrastructure

The security event correlation scalability has become a major concern for security analysts and IT administrators when considering complex IT infrastructures that need to handle gargantuan amounts of events or wide correlation window spans. The current correlation capabilities of Security Information and Event Management (SIEM), based on a single node in centralized servers, have proved to be insufficient to process large event streams. This paper introduces a step forward in the current state of the art to address the aforementioned problems. The proposed model takes into account the two main aspects of this ?eld: distributed correlation and query parallelization. We present a case study of a multiple-step attack on the Olympic Games IT infrastructure to illustrate the applicability of our approach.

Development of IT Service Management in a Large International Company

The purpose of this Master’s thesis is to examine the IT Service Management (ITSM) capabilities of a large international company and develop a design for the IT Service Management of the company. The thesis consists of two parts: a literature review and a case study. The first part is the literature review. It examines different aspects of IT Service Management. The purpose of the literature review is to increase the credibility of the case study. In the case study, the IT Service Management of a large industrial company is assessed, and an improved design for IT Service Management is created. The services are limited to common IT services, and management is limited to operative management. To assess and develop the case company’s IT Service Management, the IT organization and its ITSM capabilities are analyzed, and on the basis of the analyses, an improved IT Service Management model is created. As a result of the analyses, it was found out that the management of the IT organization is function-oriented. Therefore, the organization needs a management model that breaks the functional borders and brings services to the center of management. The designed model aspires to achieve this by defining IT services and modeling management processes from the service perspective.

IT Financial Management In a Large Industrial Company

IT Service Management plays a key role in many IT organizations today. First IT Service Management principles founded in the early 1980s but the real adaption emerged in the end 2000s. IT Financial Management is one of IT Service Management’s processes. The main purpose of this thesis was study how IT Financial Management approach can be improved in a case company. Budgeting, accounting and charging are IT Financial Management functions. These functions are researched in this thesis. Thesis materials consist of both qualitative and quantitative material. The theoretical part consists mostly of IT Service Management literature while interviews and the case company’s information systems are researched in the empirical part. Thesis also reviews different kind of the systems which supports and automates IT Financial Management functions. The biggest challenge is the cost allocation with the current ERP system in the case company. It is worth to take group based system for allocation in use before there is a holistic system in a market. The case company should also develop its IT service processes forward.

De-escalation of commitment management strategy in IT project management methodology: case of ERP implementation project by IT consulting company

According to several surveys and observations, the percentage of successfully conducted IT projects without over-budgeting and delays in time schedule are extremely low. Many projects also are evaluated as failures in terms of delivered functionality. Nuldén (1996) compares IT projects with bad movies; after watching for 2 hours, one still tries to finish it even though one understands that it is a complete waste of time. The argument for that is 'I've already invested too much time to terminate it now'. The same happens with IT projects: sometimes the company continues wasting money on these projects for a long time, even though there are no expected benefits from these projects. Eventually these projects are terminated anyway, but until this moment, the company spends a lot. The situation described above is a consequence of “escalation of commitment” - project continuation even after a manager receives negative feedback of the project’s success probability. According to Keil and Mähring (2010), even though escalation can occur in any type of project, it is more common among complex technological projects, such as IT projects. Escalation of commitment very often results in runaway projects. In order to avoid it, managers use de-escalation strategies, which allow the resources to be used in more effective. These strategies lead to project termination or turning around, which stops the flow of wasted investments. Numbers of researches explore escalation of commitment phenomena based on experiments and business cases. Moreover, during the last decade several frameworks were proposed for de-escalation strategy. However, there is no evidence of successful implementation of the de-escalation of commitment strategy in the literature. In addition, despite that fact that IT project management methodologies are widely used in the companies, none of them cover the topic of escalation of commitment risks. At the same time, there are no researches proposing the way to implement de-escalation of commitment strategy into the existing project management methodology The research is focused on a single case of large ERP implementation project by the consulting company. Hence, the main deliverables of the study include suggestions of improvement in de-escalation methods and techniques in the project and in the company. Moreover, the way to implement these methods into existing project management methodology and into the company general policies is found.

Excelling in procurement : IT Contract Management with Lean and Six Sigma. Case study on legacy contract management at Philips Global IT.

Few people see both opportunities and threats coming from IT legacy in current world. On one hand, effective legacy management can bring substantial hard savings and smooth transition to the desired future state. On the other hand, its mismanagement contributes to serious operational business risks, as old systems are not as reliable as it is required by the business users. This thesis offers one perspective of dealing with IT legacy – through effective contract management, as a component towards achieving Procurement Excellence in IT, thus bridging IT delivery departments, IT procurement, business units, and suppliers. It developed a model for assessing the impact of improvements on contract management process and set of tools and advices with regards to analysis and improvement actions. The thesis conducted case study to present and justify the implementation of Lean Six Sigma in IT legacy contract management environment. Lean Six Sigma proved to be successful and this thesis presents and discusses all the steps necessary, and pitfalls to avoid, to achieve breakthrough improvement in IT contract management process performance. For the IT legacy contract management process two improvements require special attention and can be easily copied to any organization. First is the issue of diluted contract ownership that stops all the improvements, as people do not know who is responsible for performing those actions. Second is the contract management performance evaluation tool, which can be used for monitoring, identifying outlying contracts and opportunities for improvements in the process. The study resulted in a valuable insight on the benefits of applying Lean Six Sigma to improve IT legacy contract management, as well as on how Lean Six Sigma can be applied in IT environment. Managerial implications are discussed. It is concluded that the use of data-driven Lean Six Sigma methodology for improving the existing IT contract management processes is a significant addition to the existing best practices in contract management.

A Framework for IT Service Management Integration

The objective of this Master’s Thesis is to find out best practices for IT service management integration. Integration in this context means process integration between an IT organization and an integration partner. For observing the objective, two different perspectives are assigned: process and technology. The thesis consists of theory, framework, implementation, and analysis parts. The first part introduces common methodology of IT service management and enterprise integration. The second part presents an integration framework for ITSM integration. The third part illustrates how the framework is used and the last part analyses the framework. The major results of this thesis were the framework architecture, the framework tools, the implementation model, the testing model, and the deployment model for ITSM integration. As a fundamental best practice, the framework contained a four-division structure between architecture, process, data, and technology. This architecture provides a baseline for ITSM integration design, implementation and testing.

Applying software performance engineering methods to development of IT device management systems

Ohjelmiston suorituskyky on kokonaisvaltainen asia, johon kaikki ohjelmiston elinkaaren vaiheet vaikuttavat. Suorituskykyongelmat johtavat usein projektien viivästymisiin, kustannusten ylittymisiin sekä joissain tapauksissa projektin täydelliseen epäonnistumiseen. Software performance engineering (SPE) on ohjelmistolähtöinen lähestysmistapa, joka tarjoaa tekniikoita suorituskykyisen ohjelmiston kehittämiseen. Tämä diplomityö tutkii näitä tekniikoita ja valitsee niiden joukosta ne, jotka soveltuvat suorituskykyongelmien ratkaisemiseen kahden IT-laitehallintatuotteen kehityksessä. Työn lopputuloksena on päivitetty versio nykyisestä tuotekehitysprosessista, mikä huomioi sovellusten suorituskykyyn liittyvät haasteet tuotteiden elinkaaren eri vaiheissa.

Agile it project management professional

La gestión de las tecnologías de la información tiene cada vez más importancia dentro de un mundo totalmente digitalizado y donde la capacidad de respuesta al cambio puede marcar el devenir de una compañía, y resulta cada vez más evidente que los modelos de gestión tradicionales utilizados en la mayoría de las compañías no son capaces de dar respuesta por si solos a estas nuevas necesidades. Aun teniendo identificado este área de mejora, son muchas las empresas reacias a abordar estos cambios, principalmente por el cambio rupturista que significa a nivel interno. De cara a facilitar esta transformación, se propone en este documento un modelo de transición controlada donde las grandes compañías puedan incorporar nuevas alternativas y herramientas ágiles de forma paulatina y asegurando que el proceso de cambio es seguro y efectivo. Mediante una modificación del ciclo de vida de proyecto dentro de la compañía, se incorporan en las áreas, equipos o dominios de la empresa que se identifiquen los nuevos modelos de gestión ágil, permitiendo así una transición gradual y controlada, y pudiendo además analizar los detalles sobre todo en etapas tempranas de la transformación. Una vez seleccionada el área o dominio objeto de la transformación, se realiza un análisis a nivel de Portfolio de proyectos, identificando aquellos que cumplen una serie de condiciones que les permiten ser gestionados utilizando modelos de gestión ágil. Para ello, se plantea una matriz de decisión con las principales variables a tener en cuenta a la hora de tomar una decisión. Una vez seleccionado y consensuado con los interesados el modelo de gestión utilizando la matriz de decisión, se plantean una serie de herramientas y métricas asociadas para que la gestión ágil del proyecto dé una visibilidad completa y detallada del estado en cada momento, asegurando un correcto proceso de gestión de proyectos para proveer visibilidad regular del progreso, riesgos, planes de contingencia y problemas, con las alertas y escalaciones adecuadas. Además de proponerse una serie de herramientas y métricas para la gestión ágil del proyecto, se plantean las modificaciones necesarias sobre las tipologías habituales de contrato y se propone un nuevo modelo de contrato: el Contrato Agile. La principal diferencia entre este nuevo modelo de contrato y los habituales es que, al igual que las metodologías ágiles, es ejecutado en segmentos o iteraciones. En definitiva, el objetivo de este documento es proveer un mecanismo que facilite la inclusión de nuevos modelos ágiles de gestión en grandes organizaciones, llevando a cabo una transición controlada, con herramientas y métricas adaptadas para tener visibilidad completa sobre los proyectos en todo momento.---ABSTRACT---The information technology management is every time more important in a totally digitized world, where the capacity to response the change could mark the future of a company, and results every time more evident that the traditional management models used in the most of the companies are not able to respond by themselves to these new necessities. Even having identified this improvement area, many companies are reluctant to address these changes, mainly due to the disruptive change that it means internally in the companies. In order to facilitate this transformation, this document proposed a controlled transition model to help the big companies to incorporate new alternatives and agile tools gradually and ensuring that the change process is safe and effective. Through a modification the project life cycle inside the company, the new agile management models are incorporated in the selected areas, teams or domains, permitting a gradual and controlled transition, and enabling further analyze the details above all in the early phases of the transformation. Once is selected the area or domain object of the transformation, a portfolio level analysis is performed, identifying those projects that meet a some conditions that allow them to be managed using agile management models. For that, a decision matrix is proposed with the principal variables to have into account at the time of decision making. Once the management model is selected using the decision matrix and it is agreed with the different stakeholders, a group of tools and metrics associated with the agile management projects are proposed to provide a regular visibility of the project progress, risks, contingency plans and problems, with proper alerts and escalations. Besides the group of tools and metrics proposed for agile project management, the necessary modifications over the traditional contract models and a new contract model are proposed: the Agile Contract. The main difference between this new contract model and the traditional ones is that, as the agile methodologies, it is executed in segments or iterations. To sum up, the objective of this document is to provide a mechanism that facilitates the inclusion of new agile management models in big companies, with a controlled transition and proposing adapted tools and metrics to have a full visibility over the project in all the phases of the project life cycle.

Improving IT process management through value stream mapping approach: A case study

Value-Stream mapping (VSM) is a helpful tool to identify waste and improvement areas. It has emerged as a preferred way to support and implement the lean approach. While lean principles are well-established and have broad applicability in manufacturing, their extension to information technology is still limited. Based on a case study approach, this paper presents the implementation of VSM in an IT firm as a lean IT improvement initiative. It involves mapping the current activities of the firm and identifying opportunities for improvement. After several interviews with employees who are currently involved in the process, current state map is prepared to describe the existing problem areas. Future state map is prepared to show the proposed improvement action plans. The achievements of VSM implementation are reduction in lead time, cycle time and resources. Our finding indicates that, with the new process change, total lead time can be reduced from 20 days to 3 days – 92% reduction in overall lead time for database provisioning process.

Quality and analysis of administration processes in server operations

IT outsourcing refers to the way companies focus on their core competencies and buy the supporting functions from other companies specialized in that area. Service is the total outcome of numerous of activities by employees and other resources to provide solutions to customers' problems. Outsourcing and service business have their unique characteristics. Service Level Agreements quantify the minimum acceptable service to the user. The service quality has to be objectively quantified so that its achievement or non-achievement of it can be monitored. Usually offshoring refers to the transferring of tasks to low-cost nations. Offshoring presents a lot of challenges that require special attention and they need to be assessed thoroughly. IT Infrastructure management refers to installation and basic usability assistance of operating systems, network and server tools and utilities. ITIL defines the industry best practices for organizing IT processes. This thesis did an analysis of server operations service and the customers’ perception of the quality of daily operations. The agreed workflows and processes should be followed better. Service providers’ processes are thoroughly defined but both the customer and the service provider might disobey them. Service provider should review the workflows regarding customer functions. Customer facing functions require persistent skill development, as they communicate the quality to the customer. Service provider needs to provide better organized communication and knowledge exchange methods between the specialists in different geographical locations.

A representação social do cloud computing na visão dos profissionais de TI brasileiros

Este estudo visa desenvolver uma investigação exploratória e quali-quantitativa, a cerca da representação social do Cloud Computing, na visão dos profissionais de TI brasileiros. Objetiva expor quais as percepções dos usuários da área de TI a respeito do paradigma computacional Cloud Computing. Para suportar o estudo teórico, foram coletados dados empíricos, por meio de questionários online respondidos por 221 profissionais da área de TI. Com o uso da técnica de evocação de palavras e da teoria da representação social (TRS), os dados coletados foram sumarizados. Após o tratamento dos dados mediante o uso da técnica do quadro de quatro casas de Vergès, obteve-se como resultado, a identificação do núcleo central e do sistema periférico da representação social do Cloud Computing. Por fim, os dados foram analisados utilizando-se as análises implicativa e de conteúdo, de forma a que todas as informações fossem abstraídas para melhor interpretação do tema. Obteve-se como resultado, que o núcleo central da representação social do Cloud Computing é composto pelas seguintes palavras “Nuvem”, “Armazenamento”, “Disponibilidade”, “Internet”, “Virtualização” e “Segurança”. Por sua vez, as palavras identificadas como parte do sistema periférico da representação social do Cloud Computing foram: “Compartilhamento”, “Escalabilidade” e ”Facilidade”. Os resultados permitem compreender qual percepção dos profissionais de TI a respeito deste paradigma tecnológico e sua correlação com o referencial teórico abordado. Tais informações e percepções podem auxiliar a tornar o não familiar em familiar, ou seja, compreender como o Cloud Computing é representado, visto e, finalmente, reconhecido pelos profissionais da área de TI.

Developing A Knowledge Management Process Model for Internal IT Organization, Case: Stora Enso Oyj, Corporate IT

The objectives of this Master’s Thesis were to find out what kind of knowledge management strategy would fit best an IT organization that uses ITIL (Information Technology Infrastructure Library) framework for IT Service Management and to create a knowledge management process model to support chosen strategy. The empirical material for this research was collected through qualitative semi-structured interviews of a case organization Stora Enso Corporate IT. The results of the qualitative interviews indicate that codification knowledge management strategy would fit best for the case organization. The knowledge management process model was created based on earlier studies and a literature of knowledge management. The model was evaluated in the interview research and the results showed that the created process model is realistic, useful, and it responds to a real life phenomenon.

Definition of an it project portfolio management methodology for a pharmaceutical company

Con la creciente popularidad de las soluciones de IT como factor clave para aumentar la competitividad y la creación de valor para las empresas, la necesidad de invertir en proyectos de IT se incrementa considerablemente. La limitación de los recursos como un obstáculo para invertir ha obligado a las empresas a buscar metodologías para seleccionar y priorizar proyectos, asegurándose de que las decisiones que se toman son aquellas que van alineadas con las estrategias corporativas para asegurar la creación de valor y la maximización de los beneficios. Esta tesis proporciona los fundamentos para la implementación del Portafolio de dirección de Proyectos de IT (IT PPM) como una metodología eficaz para la gestión de proyectos basados en IT, y una herramienta para proporcionar criterios claros para los directores ejecutivos para la toma de decisiones. El documento proporciona la información acerca de cómo implementar el IT PPM en siete pasos, el análisis de los procesos y las funciones necesarias para su ejecución exitosa. Además, proporciona diferentes métodos y criterios para la selección y priorización de proyectos. Después de la parte teórica donde se describe el IT PPM, la tesis aporta un análisis del estudio de caso de una empresa farmacéutica. La empresa ya cuenta con un departamento de gestión de proyectos, pero se encontró la necesidad de implementar el IT PPM debido a su amplia cobertura de procesos End-to-End en Proyectos de IT, y la manera de asegurar la maximización de los beneficios. Con la investigación teórica y el análisis del estudio de caso, la tesis concluye con una definición práctica de un modelo aproximado IT PPM como una recomendación para su implementación en el Departamento de Gestión de Proyectos.

CloudMPL:a domain specific language for describing management policies for an autonomic cloud infrastructure

To benefit from the advantages that Cloud Computing brings to the IT industry, management policies must be implemented as a part of the operation of the Cloud. Among others, for example, the specification of policies can be used for the management of energy to reduce the cost of running the IT system or also for security policies while handling privacy issues of users. As cloud platforms are large, manual enforcement of policies is not scalable. Hence, autonomic approaches for management policies have recently received a considerable attention. These approaches allow specification of rules that are executed via rule-engines. The process of rules creation starts by the interpretation of the policies drafted by high-rank managers. Then, technical IT staff translate such policies to operational activities to implement them. Such process can start from a textual declarative description and after numerous steps terminates in a set of rules to be executed on a rule engine. To simplify the steps and to bridge the considerable gap between the declarative policies and executable rules, we propose a domain-specific language called CloudMPL. We also design a method of automated transformation of the rules captured in CloudMPL to the popular rule-engine Drools. As the policies are changed over time, code generation will reduce the time required for the implementation of the policies. In addition, using a declarative language for writing the specifications is expected to make the authoring of rules easier. We demonstrate the use of the CloudMPL language into a running example extracted from a management energy consumption case study.