IT Best Practices and Compliance Reporting Information

Energy Firms Feeling the Heat

Back in the spring, I brought to light a new regulatory compliance requirement that would affect the nation’s energy companies by the beginning of 2007. With the deadline just a few months away, it appears that energy companies are finally trying to come to grips with what they must do to achieve compliance.

To bring you up-to-speed a bit, back in August 2003, the Northeast was hit with a massive power blackout that left nearly one million people without water and 50 million without electricity, and closed down twelve airports. In response, in August 2005, Congress and the Bush administration enacted the Energy Policy Act, which mandated new security regulations for the industry.

Now, energy companies are scrambling because some of the new rules will become effective January 1, 2007.  Complicating matters is the fact that most energy companies rely on massive systems control and data acquisition (SCADA) programs, which weren’t really designed with security as a consideration, to manage their resources. These programs make it challenging to work with antivirus software and are tough to patch. And, increasingly, the SCADA systems reside in the same network as other business applications, increasing the percentage of the infrastructure that must meet regulatory controls.

Securing these systems is a serious matter. In a recent article, Jay White, global architect for information protection, policies, and standards in Chevron’s IT division, said, “SCADA systems manage valves and pressures. They’re mission-critical. If you lose control over them, you could have an irreversible environmental impact.”

The problem remains the same as other current regulatory compliance laws—acceptance. Too many companies are doing everything they can to avoid having to comply, rather than embracing the value setting IT controls will add in streamlining their IT services and providing improved security, performance, and availability for their business services.

Duke Energy, a diversified energy company with a portfolio of natural gas and electric businesses, both regulated and non-regulated, and an affiliated real estate company, acknowledged in the article that they’d fought the imposition of CIP (Critical Infrastructure Protection) rules, the nine rules created and enforced by the North American Electric Reliability Council (NERC). “There’s a lot of push-back from industry on this,” said Sharon Edwards, project manager for implementing cyber security guidelines at Duke Energy.

Given the significant risk if an energy company’s SCADA systems are exposed to hackers or terrorists, wouldn’t you think they’d be more proactive about this? I’d love to hear your thoughts on why organizations aren’t taking compliance issues more seriously.

Today’s CMDB Lacks Configuration Depth

The IT departments at top companies around the globe are actively engaged in implementing IT best practices to improve IT services.  Fundamental to the success of these efforts is establishing a configuration management database, or CMDB.

Major players like HP, BMC, CA and EMC all tout their version of a CMDB. But, when you really look at the type of configuration items they are populating their CMDBs with, you’ll find they’re woefully ineffective for truly meeting the objectives of IT best practice standards like ITIL and even more importantly they won’t improve security and performance in your IT environment. The reason is simple – the data in today’s CMDBs tends to be too “shallow”. It captures basic assets like computers, applications and some relationships among them, but this kind of a model is not going to help you understand the impact of a change to one or more systems. For example, can this CMDB really tell me how a patch I am about to apply will impact my system and other systems connected to it? I don’t think so.

Can this CMDB tell me if a configuration change I am about to apply will impact performance of some critical application that is involved in a key business process? Again the answer is - you guessed it – not.

Without a comprehensive model that captures all critical components of IT and  thousands of interrelated configuration settings that control security, performance and availability of systems, a CMDB is, you guessed it again, a toy.

The problem is exacerbated by the knowledge that adding data to these CMDBs is often a manual process, wrought with the potential for error. In a recent article, Dennis Deane, head of program management in Europe for Scottsdale, Ariz.-based delivery company DHL and uses Hewlett-Packard Co.'s OpenView, said "Chances are pretty good that someone somewhere has all the information that is needed to implement a CMDB on an Excel spreadsheet."

Can you imagine populating a CMDB the size of DHL from Excel spreadsheets? It’s almost impossible to believe anyone would have the meticulous attention to detail required to do that successfully. It’s almost harder to believe anyone has the time to collect the data and actually dedicate the time to importing it into the CMDB.

A better option to expedite this process is to federate other databases into the CMDB. This point was reinforced in comments by Richard Ptak, analyst for Ptak and Noel Associates. "If a team enters every CI individually, there is the chance for redundancy. A way to avoid this is to federate databases into the CMDB."

Ptak is not the only one calling for the leading CMDB vendors to improve their ability to federate data. Gartner analysts Ronni Colville and Cameron Haight made similar statements in a recent research paper. “While the good news is that seemingly almost daily a new vendor is claiming to offer a CMDB or CMDB strategy, the bad news is that very few of them offer comprehensive DMDB capability and none have proven multi-vendor federation capability,” write Colville and Haight.

The good news is, while leading CMDB vendors may not have the deep configuration information needed to populate their CMDB, you’re stuck importing Excel spreadsheets either. There is an automated tool for collecting deep configuration information that is perfectly capable of being federated into today’s leading CMDB products.

Stop wasting valuable staff time or risk manual data entry errors. This solution will accelerate you from a shallow, ineffective CMDB to a truly deep CMDB, full of the configuration detail required to accelerate your IT best practice implementation.