You manage a large network and want to build it into a high quality network. So one of the things you decide on is having your network team come up with a Standard from the industry’s best practice and security compliances (like NIST, COBIT, FISMA, CIS, ISO 27001, etc). You tell your team that from now on all network devices will be deployed adhering to the Standard, and they agree. Your CIO and CISO are happy with your vision and praise you.
A few months pass by, team members change, new employees join, minor network outage occurs, customer tickets are resolved, vendors push out new softwares patches, and a few devices are added. All normal activities in a network, nothing unusual, you’ve seen all these as a veteran network manager.
When a day comes that the annual PCI audit (or whichever network audit) is due, you happily provide your network Standards to show how well the network is organized and controlled. The auditor is impressed at first, since not many companies have a network Standard in the first place. However, when they run some sample checks on your network, things are not working quite as well as the Standards described. Some devices have deviated from the Standards. In fact, some of them don’t even follow the Standards at all. Incorrect software versions, disabled filters, typos and human mistakes are found all over the place.
You are embarrassed and wonder why even with an established Standard, the network still looks like a mess. So you summon the team. It turns out that while everyone initially supported the Standardization effort, efforts were not kept up and old habits had returned. The engineer tweaked things, and made adhoc fixes. There are constantly vendors and contractors who just drop in to work on the network without understanding your Standards. And of course, there’s the new guy who still doesn’t understand the “rules”.
No wonder the network has returned to a mess after only a few months. No one has time (or has even bothered) to check the Standards and Quality Control of your network. This is all too typical for a network team that is already overwhelmed with their day to day tasks.
There are numerous articles that talk about the need for a Standardization compliance. But hardly anyone discuss how to conduct a low level Standard audit. There are so called Security compliance softwares today, but for some reason most of them (if not all) are too basic, only comparing matches in the configurations. This lack of a true and thorough Standard and Quality Control tool is precisely what we are resolving.
In upcoming blogs, we will describe what we believe Network Standards and Quality Control is all about and how you can truly ensure that ALL of your devices in the Data Center are adhering to your Standards, all the time.
Related Post:
How to Truly Standardize a Network – Part 1
How to Truly Standardize a Network – Part 2