George Spafford

When IT is expressing the value or costs associated with its services, care must be taken to ensure proper categorization and that the right terms are used. To have strong numbers that are supportable, IT really needs access to a costing or financial specialist who can assist with building quantitative models and explain what is […]

The Configuration Management Database (CMDB) concept of ITIL seems to generate the most questions from readers and may stem from the relatively small amount of information on the Web regarding it. So let’s take a few moments to look at the seemingly arcane CMDB, and remove the needless cloak of mysticism around it. The CMDB […]

It’s curious how we incessantly need more. We always seem to need more processors, more storage, more memory, more people, more everything … Why? As the abundance of any given resource increases, so too, it seems, does the rate of inefficient use by the user, the customer and IT. There is a very real risk […]

In my first job out of college I worked in a small company where the IT department was essentially me and my boss. What was so great about it was that we had the opportunity to do everything ranging from pulling network lines, making cables, fixing computers, programming and so on. One of the challenges […]

During World War II, the United States was worried about German spies obtaining details about shipping routes and schedules to Europe. That’s when they came up with the security awareness campaign — ”Loose Lips May Sink Ship”. It was both a dramatic illustration and held an obvious truth: If you don’t watch what you say, […]

A notebook is the crucial companion of every business traveler. What would we do without them? Or more specifically… what would we do without the information on them? We’ve all seen ads or heard stories about notebooks being dropped, beverages being spilled on them, or, worse still, machines being stolen or left behind in a […]

When I visit organizations, I’m often asked what should be logged, how long the data should be retained, and how it should be reviewed. These are interesting questions, as logging is very important for security and process improvement reasons. A good starting point is the SP800-14 NIST special publication on securing computer systems. It covers audit […]

The basic intent of segregation of duties (SOD) controls are that no one person should have excessive control over one or more critical processes. When dealing with access controls for example, a person should not be able to grant himself/herself rights and then perform the action. Similarly, they should not be able to perform a […]

We all know that no matter what (or how) things are built in the IT world, bugs will quickly emerge to inhibit service levels, while countless other errors will lurk just below the surface in a latent state. The ITIL Problem Resolution domain provides some well thought-out guidance to deal with these issues. This article […]

There have been a number of reports stating concerns that IT’s focus on regulatory compliance may harm its security posture. While there may be many groups concerned about this, we need to step back and realize that regulatory compliance is a risk to be managed just like any other and that many regulations require varying […]