#TFT12: Robert Falkowitz

beyond firefighting
techniques for advanced
incident management
Robert s. falkowitz

Beyond Firefighting

Techniques for Advanced Incident Management

Robert S. Falkowitz
Director, Concentric Circle Consulting
robert@3cs.ch
obert@3cs.ch
@R_Falkowitz
www.3cs.ch / blog.3cs.ch
1
2012.12.05 © Copyright 2012 Concentric Circle Consulting. All rights reserved. Version 1

To whom is this presentation addressed?
● People who want to learn the basics of incident
resolution

2

resolution
● People who want to apply a service management
framework

3

resolution
● People who want to apply a service management
framework
● People who want to be world class incident resolvers 

4

Goals of Incident Management
● Restore normal service
● Restore it as rapidly as possible

● Minimize the impact of incidents on the business

5

Main Issue in Incident Management

No matter what we do, we can prevent only some
incidents from happening. There will always be
incidents.

6

Other Issues in Incident Management
● We learn by doing. We learn how to resolve a certain
type of incident by resolving those incidents.
● We make mistakes in resolving incidents, even when

we supposedly know how.
● We don't know for sure who can resolve an incident

until we have succeeded in resolving it.
● We learn only generic troubleshooting techniques;

we do not learn resolution techniques

7

Incident Models
A defined series of steps to manage an incident,
including :
What symptoms to collect How to classify How to resolve

Error Diagnosed Repaired Error

Detected Logistics Recovered
Ended
To whom to assign How to recover
Predictable, shortened duration
8

Resolution Time
The duration from detection to resolution (not the
same as “repair time”)


Ended
Resolution Time

9

Agreed Resolution Time based on Priority
Priority = f(impact, urgency)
Urgency
Deadline

Ended
Best Resolution Time
(as fast as possible)

10

Agreed Resolution Time based on
Incident Type
Every incident type is potentially different
Incident type Estimated date/time
identified of recovery published

Ended
Estimated Estimated
resolution time resolution
retrieved time tuned
11

Using Failure Mode and Effects Analysis
(FMEA)
●
MIL-STD-1629 “Procedures for Performing a Failure
Mode, Effects and Criticality Analysis” (out of date)
●
SAE J-1739 200901 “Potential Failure Mode and
Effects Analysis in Design (Design FMEA), Potential
Failure Mode and Effects Analysis in Manufacturing
and Assembly Processes (Process FMEA)”
(http://standards.sae.org/j1739_200901)

12

FMEA Approach (adapted)
Output to Model Output to Model
Normal service What should How likely is it
definition happen? to occur?

Incident Model What could go How likely is Definition of
Type wrong? detection? symptoms

What would be What is the
the effects? priority?

What is the
Default What controls Resolution
impact
incident impact (severity)?
are needed? steps
13

Practice makes Perfect
● Schools have fire drills
● In California and Japan, they have earthquake drills

● Continuity plans are (should be) tested

Why don't we test and practice incident resolution?

14

Summary of Techniques
Commit to high Identify and
performance build incident
incident resolution Design models

Implement
Improve Build models in
Practice Strategy tools
and tune

Test process
Use models to Operate Test & models
resolve incidents
15

Beyond Firefighting

For more information, contact:

Robert S. Falkowitz
Director, Concentric Circle Consulting
robert@3cs.ch
@R_Falkowitz
www.3cs.ch / blog.3cs.ch
16

aae

WITH THANKS TO OUR SPONSOR
bmc Itsm Software

#TFT returns may 2013

#TFT12: Robert Falkowitz

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (10)

En vedette

En vedette (7)

Similaire à #TFT12: Robert Falkowitz

Similaire à #TFT12: Robert Falkowitz (20)

Plus de TFT presentations Tomorrow's IT Service Future Today

Plus de TFT presentations Tomorrow's IT Service Future Today (20)

#TFT12: Robert Falkowitz