[ISM3 Users] Tuesday Insight: Environments

[Vicente Aceituno]

Hi,

Two observations:

- The real world normally changes faster than you can change your
model of the world. So they tend to stay out of synch.
- I will repeat the main message from my original post: A human being
can't be understood as a collection of cells. A company can't be
understood as a collection of information system components.

> IMHO the level of depth is something which the assessor has to decide from
> assessment to assessment. But I am having those thoughts:
Yes, you have to decide. The decision should aim for the lowest depth
level that will get the job done.

> - Everything in a company is an asset (cable, room, file cabinet, people).
I don't agree. Take me for an example. If you see Vicente as a set of
organs and let's say, you remove the lungs...oops Vicente is no more.
But scratch a few cells here and there, and Vicente is still sending
mail...

If you have a Company and remove a switch...hey the Company is still
there. A poor guy had to go get a less important switch and replace
that particular one. Now, you send the Production Environment to the
Mariana's trench...no more Company.

> The only question is how much worth is that asset to the company.
Complexity is bad. Complex models with complex analysis are very very
bad. They are not meaningful (cells versus organs) and they take a lot
of effort. Placing a value sticker to cables, swtiches and servers is
just not practical. And even if you do it, systems change and four
weeks down the line you have to start all over.

Simple modelling (environments) takes less effort, and the value of
the environment won't change wildly from one month to the next.

> - The depth of an assessment can vary depending on the tools and
> automatisms the assessor applies. And not only on the needs or
> requirements concerning the result of an assessment.
Tools are seconday. Good tools + poor ideas = poor results.

> True. But who or what is telling you that you need such a process? And is
> there a big picture where you can see if this process was successfull or
> not?
Yep, there is a big picture.

IT: Logs show we can squeeze 99,99% uptime from standalone servers.
That's 7 hours dowtime a month.
Management: The business can't afford more than one hour downtime a month.
IT: Ok, we will have to go for redundant systems then.

The process succeeds if dowtime goes below 1 hour 1 minute a month.

> know anything about network cables. But don't we need that information for
> the big picture?
The big picture is the picture with less, more significant detail, not
the picture with all the detail, including the details not wanted or
needed to take decisions.

> I strongly believe that it is possible to write tools which can abstract
> some level of detail without losing that information. IMHO we lack good
> and detailed data which allows us to decide on real facts.
Yes, you can make the tool, but the problems is not the lack of data,
the problem is excessive level of detail. Going for a high depth full
knowledge system takes just too much effort (money), which is valid
only for a short time. Tools are not the solution, better modelling
is.

> assessment or not. Adding them will add much "noise" to an assessment. Not
> adding them shows us a wrong image. Of course the management is not
> interested in every single network adaptor. But to get the full image we
> actually should have the information about those.
Again, no. A doctor doesn't want to know what goes on with every
single cell of yours. What he wants to know is how are you kidneys,
lungs, etc.

My best

Vicente