People around the world are celebrating Argentina’s incredible, nail-biting, penalty-kick win—and that includes some truly dedicated fans here at BMC.

And what do enterprising fans do where when there’s a global soccer (futbol) event with national pride on the line? Put a for-entertainment-purposes-only pool together, of course. For a pair of BMCers, that meant quickly creating a site for their fellow Latin American colleagues using the BMC Helix Innovation Studio.

The site allows users to pick each match per round and assigns points for each correct guess. BMC Helix reporting capabilities let players see rankings by individual, country, and department. Bragging rights on multiple levels.

Low-code/no-code capabilities simplify the process of building a business or technical application.

BMC Helix Innovation Studio is a visual drag-and-drop environment for creating applications on top of the BMC Helix Platform. In this unique case, the application was built after hours in the employees’ spare time over the course of two months. While built for fun, the soccer app also served as a demonstration of the power and flexibility of the BMC Helix platform for employees.

Easily Create Lines-of-Business Applications

Naturally, BMC Helix Innovation Studio is designed for creating business-supporting applications.

At a recent BMC customer event, one of the attendees demonstrated an application their team built using Innovation Studio that manages the company’s marketing development funds (MDF) program. MDF money is given to partners to conduct joint marketing efforts. In larger enterprises, this can run in the tens of millions of dollars. And if you’ve ever had to deal with one, you know what a headache that can be.

After realizing that the accounting for funds was a bit loose, the customer contracted for a commercial application to support the effort. But lengthy delays and challenges cropped up. In the background, the customer and his small team built its own MDF management application using Innovation Studio. The low-code/no-code capabilities provided the flexibility and ease of use for non-developers to create a business application that solved a pressing problem. Once the higher ups saw it, the commercial project was discontinued and the in-house tool running on BMC Helix was adopted.

BMC Uses Innovation Studio, Too

One should drink their own champagne, no? We’re using Innovation Studio ourselves to extend the functionality of BMC Helix Service Management to various lines of business, including:

• HR Service Management: Empower employees with all the information they need, when they need it, to be highly self-sufficient and productive while optimizing HR operations, driving resolutions to Tier 0, assisting with accurate escalations, and freeing up valuable COE resources.
• Customer Service Management: Provides a 360-degree view of the customer by aggregating data from all customer touchpoints into a single source of truth; brings together sales, marketing, and other teams to collaborate with customer care teams; and allows customers to interact through their channel of choice: self-service, chat, email, phone, and social media.

We continue to work with customers and partners to develop more lines-of-business functionality using BMC Helix Innovation Studio. As our Latin American colleagues have shown, the possibilities are endless.

How important is AIOps to the future of IT Operations? The 2022 Gartner Market Guide for AIOps Platforms puts it succinctly: “There is no future of IT operations that does not include AIOps. This is due to the rapid growth in data volumes and pace of change (exemplified by rate of application delivery and event-driven business models) that cannot wait on humans to derive insights.”*

Gartner shares that, “Over the past 12 months, AIOps formed part of the conversation in 40% of all inquiries with Gartner clients on IT performance analysis.”*

What’s driving this growth? The report breaks it down into “three separate but ultimately related areas:

• Digital business transformation
• Transitioning from a reactive posture to a proactive approach
• The need to make digital business observable”*

At BMC, our customers are increasingly interested in how AIOps can address their growing complexity and volume of data, which are quickly outpacing humans’ ability to manage manually. As Gartner states, “It is simply impossible for humans to make sense of thousands of events per second being generated by their IT systems.”

If your organization is ready to move forward, or if you just want the tl;dr version, here are my top three takeaways and action items for businesses, gleaned from the report:

1. Focus on tangible outcomes with quantitative proof points.
2. AIOps is all about productivity, such as enhanced workflows and improved staff efficiency.
3. It’s more than just monitoring. “Leverage AIOps platforms for scenarios like adaptive anomaly detection or system-centric anomaly detection.”*

If you’re just beginning your AIOps journey, read on for key insights from the report and what to look for.

(And for anyone new to the concept, check out our introduction to AIOps.)

AIOps definition and characteristics

Gartner provides a straightforward market definition: “AIOps platforms analyze telemetry and events, and identify meaningful patterns that provide insights to support proactive responses.”*

Gartner defines AIOps platforms as having five characteristics:

1. “Cross-domain data ingestion and analytics
2. Topology assembly from implicit and explicit sources of asset relationship and dependency
3. Correlation between related and redundant events associated with an incident
4. Pattern recognition to detect incidents, their leading indicators or probable root cause
5. Association of probable remediation”*

It’s our belief that cross-domain data ingestion underlines the importance of being able to consume large volumes of diverse data sets and apply ML and analytics. Today, the data from many point tools is siloed and not available to complementary tools to help solve problems.

Based on the characteristics, another key requirement is the ability to engage other IT disciplines and act on the rich, impactful insights that deliver value to the business. While monitoring and observability are the essential foundation of a successful AIOps strategy, the true game-changing value comes from engaging and acting on the data. Finding a problem is great; fixing it is the endgame.

AIOps and IT Service Management

Gartner continues its guidance that IT Service Management (ITSM) integration is an important part of an AIOps strategy and is one of three key tenets: Observe (Monitor), Engage (ITSM), and Act (Automation).  The latest report observes that “AIOps platforms enhance a broad range of IT practices, including I&O, DevOps, SRE, security and service management.”* The application of AI to service management is known as AISM and, unlike traditional ITSM, opens the door to proactive prevention, faster MTTR, rapid innovation, and a greatly improved employee and customer experience.

As the IT disciplines of ITSM and IT operations management (ITOM) overlap more and more (we refer to this as ServiceOps), ML and analytics can be an essential enabler of that convergence. With a holistic AIOps strategy that observes, engages, and acts, effective integrated use cases can be implemented across ITOM and ITSM for automated event remediation, incident and change management, and intelligent ticketing and routing.

We believe ServiceOps is critical to true proactive service resolution: the ability to discover, monitor, service, and remediate events as they occur. Proactive service resolution is one of a number of capabilities enabled by the BMC Helix Platform, which is a unified, open platform that connects service and operations teams and provides visibility across BMC Helix and third-party solutions.

Deriving actionable insights from ML and data analytics that support intelligent automation will deliver real value to ITOps teams. Successful execution will require robust integrations to orchestration tools as well as the CMDB for service impact mapping. The visibility, intelligence, speed, and insights that AIOps brings can revolutionize these latter stages of monitoring and drive significant benefits.

Requirements of AIOps software

Based on the five characteristics defined in the report and outlined above, an AIOps platform should be able to support the full spectrum of Observe, Engage, and Act through:

• Cross-domain discovery, data ingestion, and analytics. All organizations are operating in highly complex environments and need to be able to discover and assemble a unified topology and ingest data, events, and metrics from many different sources.
• Machine learning and analytics. These approaches are used for event correlation, pattern discovery and prediction, anomaly detection, and root cause isolation. The most important aspect of this is how ML and analytics support required use cases.
• Remediation. Leverage prescriptive advice to take automated action to resolve events and bridge ITOM and ITSM processes.

The way forward for ITOps teams is to leverage a single AIOps solution that:

• Unifies data from many sources into a single view
• Identifies hardware, software, and service dependencies across multi-cloud, hybrid, and on-premises environments with dynamic service modeling
• Automates event correlation to intelligently reduce event noise
• Enables pattern identification, analysis, and contextualization
• Delivers actionable ways of applying ML and analytics to event management challenges

In this age of private and public cloud and hybrid infrastructures, digital initiatives, and rapidly changing technology landscapes, the ITOps function is integral to IT’s ability to support the business. The most successful ITOps teams will be able to leverage new AI capabilities in a strategic and tactical way to drive efficiencies, cost reduction, and speed throughout IT processes.

AIOps use cases

Based on shifting priorities revealed during the pandemic, Gartner now advises that organizations should “focus on tangible and incremental business outcomes with quantitative value-based proof points, leverage AIOps platforms for scenarios like adaptive anomaly detection or system-centric anomaly detection,” and “create an operations model to provide metadata and insights as a service to different departments such as finance, sales and marketing.”*

Using ML and analytics to identify patterns can help predict events and automate event resolution. Once these essential patterns are identified, AIOps use cases can be prioritized based on business needs, including:

• Dynamic (instead of static) threshold-based data to cut down on event noise and surface the most important events
• Anomaly detection to predictively alert on potential events and triage them before they impact the business
• Event correlation and log analytics to quickly perform root cause analysis and reduce mean-time-to-repair (MTTR)
• Orchestrated workflows for automated event remediation of commonly recurring events, linked to ITSM for incident and change management

A top-down AIOps framework

According to Gartner, “AIOps lends itself to use cases spanning the hierarchy from the IT operator up to a line of business (LOB) owner or even a CIO.”* In practice, these platforms only provide event correlation capabilities as an out-of-the-box use case, making them initially relevant for IT operators. Platform users are tasked with creating outcomes relevant to other roles, such as I&O leaders, system administrators, architects and LOB owners.” *

“Gartner recommends starting by creating a roadmap with an end-goal objective to be achieved through the use of AIOps platforms. For example, within a monitoring strategy, determine how AIOps can transform data for relevance to the target persona and how it helps address the purpose for the respective persona. Follow this by mapping out the steps leading up to the objective, starting with the current state of visibility within IT operations (e.g., noisy events, static-threshold-based alerts or leveraging dynamic thresholds).”*

“Select the AIOps platform best-suited to deliver out-of-the-box capabilities for the first step on the roadmap. The selected vendor should have capabilities or a roadmap aligned to the organization’s roadmap (for example, helping the organization to advance from event correlation to dynamic thresholds to behavior analysis with minimal effort). Watch for portability challenges in these platforms as use cases mature.”*

Insights over actions

Gartner also highlights the importance of using automation to yield valuable insights versus simply automating actions, saying, “IT organizations with a high level of maturity prefer automated insights over automated actions as a tangible goal.”* I&O leaders should prioritize tools that “reduce the visual overload for IT operators by identifying interesting data instead of treating the display screen as a dumping ground.”* For example, instead of visually analyzing multiple graphs, the AIOps platform should highlight areas that require human intervention.

Relevance for diverse personas

AIOps platforms are ideal for helping cross-functional digital business teams or “fusion teams” innovate and implement across the business. Gartner recommends the following use cases for each persona:

• DevOps: “As the DevOps practice matures, AIOps use cases broaden from a focus on preproduction to include production metrics like user engagement, quality and business relevance. This creates a need for new KPIs, comparison across multiple versions, and a product and platform focus. Considering this scenario, select platforms that can ingest instrumented data (traces, metrics and logs) and ease the effort to provide platform and product views for DevOps.”
• IT Operations: “Metric and log ingestion, followed by analytics are the primary requirements for I&O teams. The journey starts with event correlation and, as the team matures, broadens to analysis of metrics and logs followed by behavior analytics of systems and users. The primary goal here is anomaly detection, diagnostic information and root cause analysis.”
• Business: “User engagement, efficiency, productivity, and behavior analysis to help drive better decisions are the key requirements for business leaders. AIOps insights are progressively expanded, starting with correlation of user impact based on IT and broadened to include qualitative KPIs like the efficiency and productivity of technology, people and existing processes.”
• SRE: “For SRE use cases, select platforms that provide real-time topological and dependency insights for the IT architecture as one of the primary use cases and offer ease of comparative temporal and spatial analysis for multiple scenarios.”*

BMC for AIOps success

BMC’s AIOps solutions span cloud to mainframe and can help your organization proactively prevent issues before they impact service and quickly fix the problems that do occur.

BMC Helix Operations Management with AIOps is an open and scalable platform that can ingest data from hundreds of third-party tools and sources to provide cross-domain visibility, observability, and AI-driven automated actions and workflows. It combines service-centric monitoring, advanced event management, root cause isolation, and intelligent automation to effectively manage operations across complex IT environments and proactively improve performance and availability.

BMC AMI Ops is a forward-looking tool that helps mitigate issues on the mainframe before they become business problems. It uses ML to learn what normal is, detect anomalies, diagnose the probable cause, and minimize time to remediate.

BMC Helix Operations Management and BMC AMI Ops are integrated to provide end-to-end observability of the most complex applications and services.

Additional resources

To learn more about BMC’s AIOps offerings:

• Free trial: BMC Helix Operations Management
• BMC AIOps Blog
• IT Operations Trends and AIOps Adoption: Feedback from the Frontline
• Want a Unified Approach to Monitoring and Event Management? You’re Not Alone

* Gartner, Market Guide for AIOps Platforms, Pankaj Prasad, Padraig Byrne, and Gregg Siegfried, May 30, 2022.↩

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from BMC at the link provided.

Gartner^® published its “Hype Cycle for ITSM, 2022,” showing what’s hitting peak inflated expectation (e.g., XLA), what’s in the Trough of Disillusionment (e.g., IT Service Catalogs), and where productivity is plateauing (e.g., Cloud Management Platforms). But what’s that at the very beginning of the Innovation Trigger category?* Take a look:

Is that ServiceOps? Yes, it is. Gartner spells it out as “Service Operations,” which is primed to reach a plateau in two to five short years based on the chart above.

What is ServiceOps?

The Gartner definition: “Service Operations is the convergence of the infrastructure and application monitoring environments with the ITSM incident management practice to create a quicker and more effective mechanism for diagnosing and resolving incidents. The combination of the two environments with the context of AI can lead to a significant reduction in both the number and impact of incidents.”

Why is it important?

According to Gartner, “The ability to quickly diagnose and resolve incidents is becoming paramount for many organizations as they develop and implement digital services.”

No one likes downtime or poor application/service performance, so being able to sort out problems or potential issues quickly is of utmost importance. Organizations have been doing this for years, but in a service management silo or an operations management silo.

A recent survey conducted by Hanover Research on BMC’s behalf shows that 73 percent of large enterprises are combining operations and service management teams into one. This has trended upward over the last three years since the survey was first commissioned. Now, from a technology perspective, these two historically distinct functions are truly coming together.

What’s the business impact?

Gartner states it well: “The convergence of ITSM and the various monitoring environments results in a more productive and seamless incident management practice. The contextual analysis of alerts with recent activity associated with the CI can result in fewer incidents and improved mean time to repair (MTTR) for those that do occur. Products and services are more available and less likely to suffer from poor performance or outages and disruption, and costs are reduced, and overall productivity is improved.”

BMC’s approach to ServiceOps

A number of years ago, when we launched the Helix brand that brought our service management and operations management offerings together under one name, the aim was to bring the data and information from these tools together to help our customers solve problems faster. When this became a technical reality about a year ago, we termed it ServiceOps.

We believe that managing large, increasingly complex, and heterogeneous environments requires a holistic approach to service and operations management. BMC’s unique ServiceOps solution unifies the data from Operations Management, Service Management, and third-party tools with dynamic service models, using AI and machine learning to help find and solve problems faster, support high-velocity DevOps teams better, and connect the lines of business.

Considered separately, our BMC Helix ITSM, BMC Helix Operations Management, and BMC Helix Discovery solutions offer great value and capabilities to customers, but the real magic occurs when they come together to power ServiceOps.

We’ve built BMC Helix to natively bring together the power of these solutions, enabling them to share service models, performance data, service metrics, third-party data, and more to better ensure services perform the way they were designed at all times for optimized user and employee experiences. The ServiceOps capabilities of BMC Helix are unmatched, helping organizations reduce risk, lower costs, and increase efficiency and productivity.

It’s all about the AI and service models

The core of our ServiceOps approach is embedded AI and dynamic service modeling capabilities. In its explanation of Service Operations, Gartner warns of two things:

• “AI-based monitoring systems can take a long time to understand the context of the environment.
• Accurate service mapping and comprehensive CMDBs are necessary to support the end-to-end incident process.”

We agree these are important cautions and something we’re actively helping customers avoid.

Our AI models are pre-trained on extensive real-world customer data (all opt-in and anonymized, of course) so that they come ready to go out of the proverbial box. This allows customers to immediately see value with no manual steps or domain knowledge needed, and find problems quicker from the start, without having to get through a break-in period.

And our dynamic service modeling capabilities provide a complete and up-to-date view of your IT assets and relationships. To make it more useful, it provides a business service perspective instead of individual assets, tiers, applications, et al. This gives customers a holistic view of the business service environment so they can visualize business health, understand the impact of problems on the business, and enable root cause isolation to fix those problems fast.

It’s an exciting time for the BMC Helix portfolio and our approach to ServiceOps. And we believe the rest of the industry is starting to take notice.

* Gartner, Hype Cycle for ITSM, 2022, Siddharth Shetty, July 13, 2022.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from BMC at the link provided.

Gartner and Hype Cycle are registered trademarks and service marks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved

When more than 100 million personal data records are exposed, it’s bound to spark questions and concerns – rightfully so. In the recent cloud security breach involving Capital One, U.S. Senator Rod Wyden of Oregon is asking, does Amazon Web Services share responsibility for the data exposure? And, if so, is there more that can be done to protect other AWS customers from the same issues? His letter is here.

One may think this issue is not worth Senate attention, but the Senator does point out that if it’s one company involved, then it’s likely on that organization. However, in this case a well-known “vulnerability” in the way certain AWS services are configured led to the data exposure. The Wall Street Journal says it found an additional 800 AWS customers potentially at risk from the same configuration error.

The Shared Responsibility Model

When it comes to security in the cloud, Amazon tries to limit the gray area via its Shared Responsibility Model. In short, Amazon says it is responsible for security OF the cloud – the infrastructure and software that run it. The customer is responsible for securing what’s IN the cloud.

It states: “This shared model can help relieve the customer’s operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates. The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall.”

Why Does This Keep Happening?

Simply stated, the cause of the cloud security failure is, once again, a misconfigured cloud service. If it has a configuration switch, the enterprise is responsible for configuring that service so that it is secure.

This is somewhat easy and manageable in a simple environment, but how many of today’s enterprise applications are simple? This gets more complicated by velocity of change and scale of change. Dozens (or more) of scrum teams continuously update their microservices, and with each update comes the risk of a simple misconfiguration. Security and compliance checks must be run with each release, but manual and/or ad-hoc checks create bottlenecks and lack of consistent governance can introduce risk.

This type of error can happen to ANYONE; the scale and speed of change which the cloud enables leads to just such a risk. Publicly disclosed exposures due to misconfigured cloud resources are up 20 percent year-over-year¹, and misconfigured cloud resources remain the #1 cause of cloud security failures². Either through misunderstanding – 53% of organizations mistakenly believe their CSP is wholly or majority responsible for securing their data³ – or negligence, these misconfigurations prove time and again that getting cloud security right is a monumental undertaking.

Why Has This Specific Breach Captured Our Attention?

Consumers are highly protective – rightly so – of their personal and financial data. Whether it’s because the brand is well-known, or that this is yet another financial breach, or that instead of a nameless, faceless actor of a hostile foreign power we have the name and face of a suspect who documented her exploits on social media, the Capital One breach, more so than any since Equifax (which was an on-prem breach), has captured the attention of the media.

Far too much has been made of the fact that the hacker was a former AWS employee. True, she was employed there some number of years ago, but her employment history with AWS is entirely irrelevant. More precisely, it is her familiarity and expertise in using AWS cloud services which is key. One does not have to ever have been an employee of Amazon to develop these skills. There is no public evidence available thus far to warrant an insider threat.

So, what did happen? Simply stated, the suspect allegedly found and exploited a misconfigured WAF (web application firewall, a type of cloud service) to access Capital One’s VPC (virtual private cloud). Once inside, she launched an EC2 instance to trick the AWS Metadata Service into trusting it, thereby receiving credentials to access and decrypt data stored in an S3 bucket. An excellent detail of the hack can be found at Krebs on Security. See Server-Side Request Forgery for an explanation of how an SSRF works. In lay terms, a misconfigured cloud resource (WAF) caused the cloud security failure.

How Do We Prevent This from Happening Over and Over?

Thanks to the suspect having left extensive breadcrumbs on her social media, we have a very clear view of how she exploited the cloud security of Capital One. Beyond the “how” it happened, what can we – the collective “we,” the enterprise “we” – do to prevent recurrence? Fortunately, the answer is plenty.

A solution for effectively managing the enterprise’s cloud security posture must include:

• Automation. Automation is the key, because manual checks are a fool’s errand: the cloud footprint changes too fast. Multiple, self-organizing scrum teams push updates to PROD asynchronously and multiple times daily. With each update comes the risk of a single cloud resource being misconfigured. As such, you cannot solve the problem of cloud security posture management (CSPM) by throwing bodies at it. The speed and scale of change outstrips human ability to keep pace. Automation eliminates human error and delays caused by manpower bottlenecks, making cloud security and governance as agile as the developers who use the cloud. It also enables your high-cost security professionals to rise above the noise of repetitive ditch-digging so that they can focus on higher value work. In sum, you get better staff productivity, higher quality, better security, and higher customer satisfaction.
  • Recommendation: Use automated security checks against policy-based best practices such as those published by the Center for Internet Security.
  • Recommendation: Use automated remediation, working programmatically to reconfigure those cloud resources which violate security and compliance policy. Automation removes the element of human error and dramatically diminishes the window of vulnerability.
  • The difference between automatic and automated remediation sometimes causes confusion. Automated action runs a remediation script triggered by some human intervention, such as clicking a button. Automatic remediation takes the same action, but without any human intervention, so that the moment a vulnerability is found, it is automatically fixed – consistently, securely, and with a documented audit trail according to the organization’s change management workflow. Both automated and automatic remediation offer profound advantages above manual security and compliance checks.
• Policy-based security, compliance, and governance. The enterprise’s Infosec Team codifies security and compliance mandates into a library of security policies, which are applied uniformly throughout the enterprise. Because security checks are run comparing all cloud resources automatically against these policies, real-time security is achieved because there is no manpower bottleneck at the security checkpoint in the process. These security checks are automated, as the fixes should be as well. Exceptions to any security violations are managed according to whatever process the organization puts in place.
  • Recommendation: use the security frameworks published by the Center for Internet Security as the foundation of your security policy library, to speed your time-to-value and achieve consistent configurations across your cloud footprint. Extend those policies as you see fit.
• Multi-cloud. Although the Capital One breach was on AWS, AWS is not the only cloud service provider (CSP). AWS, Azure, and Google Cloud dominate the CSP market, and each have hundreds of similar, but not identical, cloud services, every instance of which must be correctly configured. AWS have a laundry list of security tools available for purchase. The trouble is, (1) naturally they focus on AWS services, (2) do not provide for remediation (which is the customer’s responsibility), and (3) numerous tools complicate security and make it difficult for developers to secure their microservices. Most enterprises are multi-cloud, and, as already discussed, it is imperative that the organization consistently apply security and compliance policies across its scrum teams, accounts, and cloud platforms. The flexibility which the cloud provides is powerful, though it is a razor-sharp, double-edged sword.
  • Recommendation: enable business agility by making security easy on the developers. Choose a cloud security solution which supports the “Big 3” CSPs IaaS and PaaS services, so that you get more cooperation from your internal customers (*cough* developers *cough*).
• Integrate to incident and change management workflows. As previously mentioned, the speed of change in the cloud from numerous, self-organizing scrum teams challenges the organization’s change management. As security professionals, our goal should be to enable agility, and not hamstring it. Once a violation is identified, we should automatically open an incident and change request at the service desk, and kickoff our change management workflow. Once approved, the configuration change is automatically made, thereby closing the vulnerability and the incident closed. The CMDB is updated and an audit trail documented.

Conclusion

Capital One is a leader and expert in the use of cloud technology. While this type of cloud security failure could happen to anyone, there is plenty we can do to prevent these types of failures. The cloud itself is not inherently insecure, but we (the collective “we,” users of the public cloud) continue to struggle with securing our ever-changing footprint in the public cloud. Just like when AWS changed the default configuration of its S3 (Simplified Storage Service) bucket so that it is private, not public, it is worthwhile to have a rational, non-politicized discussion of what actions AWS and all CSPs can take.

At the same time, all organizations are encouraged to take stock of their current methods, skills, and technology for securing their public cloud estate. Waiting for a regulation to fix the problem might invite more trouble. The better course is to take action on your own to make sure the data you store and the services you offer are secure, regardless of where they reside.

¹ 2019 IBM X-Force Threat Intelligence Index Report ↩
² i.b.i.d. ↩
³ EMA Security Megatrends 2019 ↩

Even after a decade of trying, apparently IT still isn’t on the same page with other teams, often working around or at odds with one another on digital transformation initiatives. BMC offers fresh insights into how IT teams can improve collaboration and alignment across business operations. But what about teamwork and alignment within IT teams?

After all, it’s hard to convince other stakeholders of the value of collaboration if your own team isn’t in good working order. Here are five questions you can ask to evaluate whether your IT team operations are in sync or the source of problems.

(This tutorial is part of our IT Leadership & Best Practices Guide. Use the right-hand menu to navigate.)

1. Are team roles integrated or siloed?

If you answered “siloed”, this is your starting point. Silos are a root cause of out-of-sync IT departments. They hinder more agile decision-making and processes, which are must-haves in an era when IT and the business as a whole are constantly under pressure to do more, faster.

The functions these silos typically represent—development, operations, QA, security, and so forth—are still critically important. But these roles need to be more explicitly comingled to improve internal communication and collaboration. Invisible walls must be torn down: developers handing off their code to operations and never thinking about it again; operations existing as a separate team in a different part of the building; security only as a final check before a deployment.

2. Are team members’ performance metrics at odds with one another?

Align your teams with shared incentives. You can direct developers and infrastructure engineers and security analysts to work together more closely than before, for example, but that will only go so far if their job performance is measured in conflicting ways. If devs are given incentives to ship code as frequently as possible, but ops or security pros are only measured by uptime or production incidents, they’re less likely to be in sync. Give people shared responsibility for your overall goals that are measured in standardized ways, regardless of job title or functional role.

3. Does friction exist in one or more key processes?

Out-of-whack performance metrics can be a source of conflict among teams, but there are plenty of other places to look for friction. Consider your software development and delivery pipeline, for example: Which stages and processes cause the most headaches? Where do things get bogged down by inefficiencies? Odds are that any pain points you discover in asking this question will lead to opportunities to reduce inefficiencies and bring the broader team into closer alignment.

4. Do people point fingers when things go wrong?

When things don’t go as planned, do people start playing the blame game? This is a sure-fire sign of an out-of-sync team. Instead of allowing blame to take root, opt for blameless postmortems to capture learning after an IT incident or failure. This practice can also be productive after any significant deployment or project phase, even when things are going well.

5. Above all, are you fostering a healthy team culture?

Out-of-sync IT teams often boil down to a dysfunctional culture born from all of the above issues and more: Too many silos, too much friction between people and processes, and so on. This is why DevOps culture has flourished. Its iterative focus on people, process, and tools aligns well with the demands placed on modern IT, and research shows it correlates with higher-performing teams.

Whether you label it “DevOps” or not, you can take cues from the culture the term represents. Key questions (and their answers) above speak to this, such as eliminating functional silos and encouraging shared responsibility across roles with better-aligned performance incentives and metrics. Also consider processes and technologies commonly associated with DevOps, such as continuous integration/continuous delivery (CI/CD) and a “shift left” mindset for areas like testing and security.

Wrestling with these five questions is a great start to improving your IT team’s internal collaboration. When you can resolve these process, structural, and cultural issues, your team will perform better work, make greater contributions to business goals, and employee satisfaction will get a boost along the way.

Earlier this year a bit of sobering news came to light about how the priorities of IT teams relate to larger company goals. IT teams, in the eyes of other departments, are way out of sync with business priorities.

A report, sponsored by BMC and conducted by The Economist Intelligence Unit (EIU), revealed that 31% of non-IT survey respondents view IT decision-making as misaligned with their company’s digital transformation goals. Think about that: The department with the most digital expertise is perceived as not actually driving the company’s most important digital initiatives.

That needs to change. IT must embrace a shift from being function-driven and reactive—the classic technology gatekeeper role—to being proactive, business-driven, and strategic. IT must set the tone by ensuring it is pursuing goals and outcomes that are clearly tied to the company’s overall business vision. Here are three key steps to make that happen.

1. Work with executives and senior management to establish a shared vision.

A lack of alignment between IT and other business units is often rooted in disconnected goals. CIOs and other IT leaders must lead the charge by working across departments to create a shared strategic vision and work collaboratively toward realizing it. IT leaders and their staff can reach out and act as IT ambassadors. By listening to and understanding other departments’ needs and strategies, they can capture these inputs in the IT roadmaps and decision making. Look for allies who support this shift toward a more collaborative approach to digital transformation and business outcomes.

2. Reevaluate IT strategy against that shared vision.

With a shared vision in place, it’s time to re-evaluate your existing IT roadmap and decision-making against the company’s overall mission. Too often, siloed IT departments have priorities that are misaligned with other business units. For example, the EIU researchers found that both IT and other departments rank greater efficiency as a key outcome, but the priorities of the two groups diverge after that: IT respondents placed a high value on integration with legacy systems and system resilience, while non-IT survey participants give higher ranking to revenue growth and cost reductions.

Work closely with the leadership team to define clear goals and a vision for achieving them. What needs to change? Moreover, what new technologies or strategies will you need to adopt so that IT can drive the company’s critical goals? Remember that statements like “this is how we’ve always done things” will not serve you in this alignment process. Finally, deprioritize or eliminate work that you can’t connect to business goals.

3. Connect your IT metrics to business goals.

One of your greatest challenges will be to align and contextualize all IT metrics with business goals. As you reevaluate IT goals in the broader context of the company’s overall vision, it’s also important to reconsider how you measure IT performance in pursuit of those goals. Traditional metrics such as uptime or project completion deadlines are insufficient by themselves. By moving to metrics that are more explicitly linked to business value—ROI and revenue are two basic examples—you can help better align how different teams across the company are measured.

Connect your modern IT metrics to specific business goals, creating a loop with that shared vision at the outset and enabling ongoing review and optimization. IT should stop caring only about technical indicators such as uptime; rather, it should connect uptime targets to business value and goals. For example, what does 99.9% uptime mean in terms of revenue or reduced call-center volume? How will a multi-cloud strategy enable the company to hit its goal of launching in three new markets this year?

The days of IT as reactionary gatekeeper may be numbered, but its future as a collaborative partner adding value across the business is bright. Aligning IT strategy and business goals is the foundation for that future.

At countless enterprises, digital transformation (DX) success depends on something far less flashy than breakthrough technology: their IT team’s ability to collaborate with other teams. A recent survey and research report sponsored by BMC and conducted by The Economist Intelligence Unit (EIU) identified several DX roadblocks caused by out-of-sync IT:

• Slow decision-making
• Difficulty integrating new technologies
• Organizational resistance to change

But the EIU research also revealed reasons for optimism: 89% of respondents who identified as collaborators were confident they would overcome these challenges, compared with just 55% of non-collaborators.

How to improve IT/Business collaboration

Improving cross-departmental collaboration is crucial as IT evolves from gatekeeper to strategic business partner. Here are six tactics to follow.

1. Reach out and resolve to collaborate.

Becoming a more collaborative, strategic IT department begins with relationship-building. That effort can begin with IT executives seeking organizational buy-in for IT to work more collaboratively with other departments. But IT team members at any level can also participate, identifying and reaching out to key allies in other departments, then learning their needs and strategies and how IT can support them.

2. Find strategic wins and evangelize them.

Don’t expect IT to turn into a strategic partner overnight. After identifying key allies in other departments, work together to secure small wins. It might be automating a manual process or identifying a new revenue opportunity. Create an action plan for achieving these small wins and promote them widely. You want to build momentum for future collaboration by bringing skeptics into the fold.

3. Focus on internal processes first.

Since both IT and non-IT teams value improved efficiency as a DX outcome, continue those small wins by focusing on internal processes. Any process that is hampered by repetitive manual effort, bloated spending, or other inefficiencies is worth considering. Look at updating processes such as employee onboarding, expense reporting, and other necessary day-to-day tasks.

4. Create new pathways for learning.

Create opportunities for your IT teams to improve their business acumen and learn what people in other parts of the company do. There are many ways to go about this, such as “ride-along” programs in which a developer shadows a marketing manager, or a systems engineer participates in customer focus groups. This is a two-way opportunity: Invite business unit employees to IT lunch-and-learns on technical topics or do a “roadshow” to visit other departments and educate them on how technology drives the business day-to-day.

5. Experiment with new team models.

Explore new team models that can help spark new ideas and broaden perspectives. These can include:

• Creating temporary project teams
• Embedding IT pros into other departments or product teams

The fundamental idea is to redesign monolithic team structures and processes that perpetuate the outdated model of IT working in isolation from the business.

6. Have fun!

A little fun goes a long way when it comes to team-building. Plan offsites or social events to help build connections between IT and business teams. Consider at least semi-regular opportunities for team-building, such as monthly or quarterly events.

For more IT leadership, explore our IT Leadership & Best Practices Guide.

It’s said there is no “i” in team, but when it comes to digital transformation, there is definitely an “i” in IT. And it might stand for ignored. A new survey on digital transformation from the Economist Intelligence Unit shows that business leaders routinely bypass IT when buying technology to support digital transformation initiatives.

A whopping two-thirds of business respondents said they never or seldom involve their IT departments when acquiring IT systems for digital transformation initiatives. Concerningly, 31 percent of non-IT respondents say IT decisions are not aligned with their digital transformation goals. They cite long procurement times and IT decisions not being flexible enough to support the business side’s goals of increased revenue and reduced costs.

Given the explosion of apps and services, organizations are obviously good at connecting systems through APIs, data warehouses, and other technologies. Where they tend to fall down is in connecting people. Both systems and people need to collaborate to successfully and efficiently drive digital transformation.

Collaboration is not a buzzword

Collaboration is about listening and building shared goals. It’s not: “You’re collaborating with me by doing what I say.” We’re probably all guilty of that sort of non-collaborating collaboration. Everyone likes things done their way (guilty!), but the Economist survey shows that those who do collaborate have better results.

Clearly this survey shows that the collaborators cohort is far more confident it can overcome challenges than the non-collaborators. Ironically, the two groups seem to agree on the top challenges: lengthy decision making, integrating new technologies, and, everyone’s favorite, internal resistance to change.

Change is hard, but possible

“We have transformed into an agile organization, with teams in cross-functional squads,” says Kalman Tiboldi, chief business innovation officer at spare parts supply-chain company TVH, in an interview with the Economist. “The product owner and delivery manager are from the business, these work with software engineers, data engineers, all with the same remit.”

Wholesale shifts in team structures like the one Tiboldi describes probably won’t happen overnight, but there are areas where business and IT should be able to get on the same page quickly:

Naturally, everyone in an organization should be concerned about security. A breach can be far costlier—to both the bottom line and reputation—than overpaying for cloud services. Security is an area that IT can add value, helping secure cloud configurations, managing privileged user access, and ensuring policy and regulation compliance.

As Henry Ford said, “If everyone is moving forward together, then success takes care of itself.” For digital transformation efforts to succeed, teams across an organization must work together.

A new survey by the Economist Intelligence Unit on the current state of digital transformation in the enterprise contains a few eye-opening results about the success of such projects, who’s involved, and who gets the blame when something goes wrong.

The Economist Intelligence Unit polled more than 300 enterprise IT and line of business executives to get their thoughts on digital transformation within their organizations. Here’s what they had to say:

The Good: Organizations are doing it and seeing some success

With all that’s been written about the need for businesses of all stripes to undergo digital transformation or be left in the dust, it’s heartening to learn that 73 percent of organizations have had digital transformation initiatives for two years or longer. None of the respondents had initiatives in place for less than a year. Even better, 58 percent of them say they are achieving some or all of their digital transformation goals.

Naturally, these types of business-altering initiatives take time to start bearing fruit. Nearly two-thirds of respondents that have digital transformation initiatives in place for three or more years strongly agree their organizations are realizing benefits. That number dips to 42 percent for those projects that a couple years old or less.

Almost all of the organizations surveyed cited greater operational efficiency as the main priority for digital transformation, but as their initiatives matured, the priorities of the IT and business sides of the house diverged.

The Bad: IT’s purchasing involvement seems to be plummeting

Gone are the days when all technology purchasing goes through IT. In the survey, a whopping 66 percent of respondents say they never or seldom involve their IT departments when acquiring IT solutions for digital transformation initiatives.

There are a few factors at work here. First, business leaders say the IT procurement process takes too long (37 percent of respondents) and that IT decisions are not flexible enough (30 percent). Second, the divergence in priorities after better operational efficiency is causing friction. The business wants to grow revenues and reduce costs, while IT is more focused on reliability and getting the most out of existing systems. It’s also worrisome when 31 percent of non-IT respondents say IT decisions are not aligned with their digital transformation goals.

“Digital technologies are trivial to purchase,” says Emer Coleman, technology engagement director for Co-op Digital. “Why would you go through all the pain of procurement? Digital makes it possible for departments to say, ‘We’ll just pay for it.’”

I’ve witnessed this as a marketer during my career. The growing MarTech arena contains a bunch of interesting tools and technologies for helping make us better marketers. But at times, IT teams at organizations I’ve worked at balked at potential purchases, even if our budget was paying for it.

The Ugly: IT is still on the hook

While the business side of the house is happy to buy and implement its own technology, guess who they blame when things go wrong? Yep, the IT department. When something goes wrong with an application or service, 43 percent blame IT, 29 percent blame the CIO, and only 15 percent blame it on the relevant division head.

This feels a lot like when less technical family members make technology decisions, then expect you to fix the mess when they muck something up.

How can IT overcome this? According to the Economist, “IT departments of the future should be much more collaborative with other functions in their organizations and take into account the priorities of the rest of the enterprise before setting their own. In short, IT departments should become less of a gatekeeper and more of an enabler of their organizations.”

More than a third of survey respondents with a higher degree of collaboration between IT and business are extremely confident they can overcome digital transformation challenges that arise. For the non-collaborators, the extreme confidence level is only 12 percent.