The Visible Ops Handbook: Implementing ITIL in 4 Practical and Auditable Steps

The Core of Visible Ops Visible Ops is a methodology designed to jumpstart implementation of controls and process improvement in IT organizations needing to increase service levels, security, and auditability while managing costs. Visible Ops is comprised of four prescriptive and self-fueling steps that take an organization from any starting point to a continually improving process. Making ITIL Actionable Although the Information Technology Infrastructure Library (ITIL) provides a wealth of best practices, it lacks prescriptive guidance: What do you implement first, and how do you do it? Moreover, the ITIL books remain relatively expensive to distribute. Other information, publicly available from a variety of sources, is too general and vague to effectively aid organizations that need to start or enhance process improvement efforts. The Visible Ops booklet provides a prescriptive roadmap for organizations beginning or continuing their IT process improvement journey. Why Do You Need Visible Ops? The Visible Ops methodology was developed because there was not a satisfactory answer to the question: “I believe in the need for IT process improvement, but where do I start?” Since 2000, Gene Kim and Kevin Behr have met with hundreds of IT organizations and identified eight high-performing IT organizations with the highest service levels, best security, and best efficiencies. For years, they studied these high-performing organizations to figure out the secrets to their success. Visible Ops codifies how these organizations achieved their transformation from good to great, showing how interested organizations can replicate the key processes of these high-performing organizations in just four steps: 1. Stabilize Patient, Modify First Response – Almost 80% of outages are self-inflicted. The first step is to control risky changes and reduce MTTR by addressing how changes are managed and how problems are resolved. 2. Catch and Release, Find Fragile Artifacts – Often, infrastructure exists that cannot be repeatedly replicated. In this step, we inventory assets, configurations and services, to identify those with the lowest change success rates, highest MTTR and highest business downtime costs. 3. Establish Repeatable Build Library – The highest return on investment is implementing effective release management processes. This step creates repeatable builds for the most critical assets and services, to make it “cheaper to rebuild than to repair.” 4. Enable Continuous Improvement – The previous steps have progressively built a closed-loop between the Release, Control and Resolution processes. This step implements metrics to allow continuous improvement of all of these process areas, to best ensure that business objectives are met.

Kevin Behr is the president and founder of the ITPI, as well as the CTO of IP Services, Inc. Kevin’s 15 years experience in IT operations, security and field engineering spans environments ranging from financial services, manufacturing and technology sectors, allowing him to identify common problem domains and develop powerful solutions for IT Operations that span industry and scale. Kevin is working on development of IT operations management curriculum and research grants in conjunction with researchers from the Decision Sciences and MBA Programs at the University Of Oregon Lundquist College Of Business. Kevin is currently working with Gene Kim and Julia Allen, a senior member of the technical staff within the Networked Systems Survivability Program at the Software Engineering Institute at Carnegie Mellon University on prescriptive adoption methods that integrate best practices in IT operations, security, and audit. Kevin holds the CISA designation and is ITIL certified. Kevin is also a frequently invited speaker called on to address a broad range of technology and management framework topics by organizations such as The National Academies of Science, Hewlett Packard, The SANS Institute, AFCOM, The Palmer Group, The Software Engineering Institute at Carnegie Mellon University, CERT, Tripwire, and BetterManagement.com. Gene Kim is the CTO and co-founder of Tripwire, Inc. In 1992, he co-authored Tripwire while at Purdue University with Dr. Gene Spafford. Although Gene is widely published on computer security, operating systems and networking in SANS, ACM and IEEE publications, he is continually fixated on the problems of process integrity issues in Operations and Security. He is currently actively working on a series of projects with the Software Engineering Institute and Institute of Internal Auditors to capture how "best in class" organizations have Security, Operations, Audit, Management, and Governance working together to solve common objectives. Gene is certified on both IT management and audit processes, possessing both ITIL Foundations and CISA certifications. In 2004, he was named by InfoWorld as one of the “Four Up and Coming CTOs to Watch.” Gene holds an M.S. in computer science from University of Arizona and a B.S. in computer sciences from Purdue University. Gene co-chaired! the April 2003 SANS technical workshop called Auditable Security Controls That Work, hailed by SANS as one of their top five gifts back to the community. In October, Gene co-chaired the Best In Class Security And Operations Roundtable (BIC-SORT) with the Software Engineering Institute at Carnegie Mellon University. George Spafford is an IT process consultant interested in the intersection of human factors, security, and complexity in the world of information technology. George is a prolific author on a wide range of topics including project management, technology business, communication, and security. He is the Vice President of Publishing for the ITPI. George has held a number of positions in IT operations, development and management. He holds an MBA from Notre Dame, a BA in Materials and Logistics Management from Michigan State University and an honorary degree from Konan Daigaku of Japan. He's a member of the ISACA and ITPI.