I just wrote a paper on the value of information security. Please see the paper here. It is something I have thought about for a long time. Information security as a technical discipline but someone has to pay for all this fun we are having. My assumption is that as Willie Sutton is quoted as saying "Go where the money is...and go there often.” Today where organized crime and nation states are going is to information. It is amazingly easy to monetize certain kinds of information. There is a buyer for everything that hackers can steal. The impact to business has been debated for some time and we go to great lengths to perform risk assessments. What we don't do such a good job of is monetizing that risk. 

Consider this. If we can monetize the information asset, we should be able to monetize the risk to that asset. The key to monetizing risk is knowing the value of the asset at risk. Different systems for risk assessment have been in place for some time. They all seem to revolve around professional judgment. My argument is that using a combination of threat modeling (war planning) plus simple asset monetization will allow us to monetize risk. The results will not be perfect, but they should be directionally correct.  As Doug Hubbard says it is better to be directionally correct than specifically wrong[1].

In the spirit of the somewhat overstated movie advertisement: “If you only read one of my blogs this year, read this one”; although I prefer the version for The Naked Gun 2 1/2: “If you only see one movie this year... you should get out more often.”

Anyway, so many blogs, so little time; and what did I say that was important (if only in my own tiny mind)? Each bullet links through to the original blog.

IT service management

• IT support … is not about the IT, that it has to be about the people and the business.
• When it comes to the service desk, we should recruit “better” people, pay more, BUT also expect more.
• Top 10 IT Service Management Challenges For 2012: More Emphasis On The “Service” And The “Management”
• Mobile-device-driven change is inevitable and I&O organizations need to be ready.
• Bench marking information … is the sort of stuff that the ITSM community (see my previous blog) is crying out for.
• Surely the modern service-savvy customer, whether corporate or not, is not prepared to be treated in this way.

Is it a blog? Is it a musing (that’s not “amusing”)? Or is it just a cheap attempt to pick the brains of others smarter than myself? Does it matter? Can I do anything other than ask questions?

My point (or at least my line of thinking while I plan a couple of ITIL-related Forrester reports) is that we spend a lot of time talking about what to do (or more likely what not to do) when "adopting ITIL," but how often do we talk about whether we have been successful in applying the concepts of ITIL, the processes, and the enabling technology for business benefit?

Maybe it is because we quote the mantra that “ITIL is a journey” and we can’t see a point in time where we can stop and reflect on our achievements (or lack of)? Maybe we segue too quickly from the ITIL-technology adoption project into the firefighting realities of real-world IT service management? Whatever the potential barriers to taking stock, where is that statement that describes what we have achieved and our relative level of success?

Looking at this logically (fatal mistake, I know), assuming (potentially a big assumption) that there was a business case for the “ITIL adoption project” where is the post implementation review (PIR)? Where can we look to see the realization of business benefits (I deliberately didn’t say “IT benefits” BTW)? I’m trying not to be cynical but, even if we forget the formalities of a PIR, how many I&O organizations can quantify the benefits achieved through ITIL adoption? More importantly what has been achieved relative to the potential for achievement? Where did we get to in our desired-future-state?

Oscar Wilde once said that "The cynic knows the price of everything and the value of nothing." I shudder to think what young Oscar would have said about I&O organizations that don’t know what it costs to deliver individual IT services let alone the value they deliver to the business. Just knowing that it costs “x” annually to “run IT” is no longer enough.

This might appear a little random at first but I was reminded of something I wrote two years ago when informed last week of a CIO fired because they couldn't articulate the value their IT team delivered to the business.

So what did I remember? “It is often better to provide answers, however embarrassing they might be, before others start to ask awkward questions.” What were the “questions” I referred too? Nothing difficult, just what it costs to deliver IT services and the value that these services deliver to the business.

So ask yourself, “what value does IT deliver to the business?” Not in generic terms like business process-enablement and technology-supported efficiencies. What does the money we invest in IT each year actually deliver to the business in terms of value? More importantly, which IT services deliver the most value and which deliver little or no value?

Hold on a minute though. Do you actually know what “value” is from a business perspective? I’m not talking about the value I&O believes its IT services deliver; I’m talking about what the business thinks.

Am I moving too fast? Let’s take stock of the status quo.