Incident Consequence Analysis

Incident Consequence Analysis

• 1.
  Incident Consequence AnalysisServicedesk references: ######This is reported as a Incident. affected in . minutes unavailable and/or minutes degraded. . affected by . further root cause analysis required. Escalated to .This incident affected the company usual. The outage was normal. The risk is average. Prepared by: Rolling Incident averages:Classification – , Outage analysis – , Risk management – This incident was less than the norm using the Incident User Metric.ResourcesService affectedDescription of incident>ResolutionDiagnosishhmmEscalations: Problem management: dd/mmNotification / Report:dd/mmTime analysisIncident BreakdownsTime unavailable/degraded minutes unavailable, minutes degradedMTTR= minutes, MTBF= days, MTBSI= days.Incident User Metric Cost of downtime analysisClassification (%)Outage analysis (%)Risk Management (%)SCROPUPITBIVCMClassificationScope (S)Credibility (CR)Operations (OP)Urgency (U)Prioritization (P)Outage analysisIT service outage analysis (IT)Business service outage analysis (B)Risk managementRisk impact (I) Best practice CIA analysis (CRAMM) – Confidentiality (unauthorized disclosure), Integrity (unauthorized modification or misuse), Availability (destruction or loss).Risk vulnerability (M) What are the chances of the outage occurring considering loss, error or failure?Countermeasures (CM) What is being done to prevent this from happening again?ClosureEscalations Please note that if no comments or questions are received within 5 working days this reported is classed as AcceptedExampleIncident Consequence AnalysisEmail outage in PofadderService desk references: 555772This is reported as a Minor Incident.All Business units affected in Pofadder. 12 minutes unavailable and 238 minutes degraded. Mail server recycled. Messaging affected by bug. No further root cause analysis required. Escalated to Infrastructure Manager.This incident affected the company less than usual. The outage was normal. The risk is less than average. Prepared by: Ronald BartelsRolling Incident averages:Classification – 69%, Outage analysis – 49%, Risk management – 54%This incident was 66% less than the norm using the Incident User Metric.ResourcesService Level Manager (M Mouse), Regional Infrastructure team leader (D Duck).Service affectedMessagingDescription of incidentIT customers located in the Pofadder office experienced slow delivery of mail messages to other regions and business units. IT Customers unable to confirm instructions or send credit minutes via email. The inbound and outbound queues on the Exchange server were not flowing. Documents scanned and emailed via multi-function devices where the size of the document was over 1.5mb where largely affected. Log file gave specific error code which suggested several resolutions from the knowledge base. (http://support.microsoft.com/kb/329617). The bad mail folder was cleared and the SMTP service was restarted. However, this did not clear the issue and it was only when the mail server was power cycled that normal operations resumed.ResolutionMail server recycled.Timelines& detailsIncident9/10 09h30Detected11h25Repair13h15Recover13h17Restore13h35Resolution13h35ServerrestartedWorkaroundFailed - Bad mail folder cleared and SMTP service restarted.Diagnosis13h06Escalations: Problem management: 9/10Notification / Report:9/10Time analysisIncident BreakdownsIncident breakdown by Service(affected messaging)EcommerceMonitoringPrintingThird partyOperationsBackupsService deskStorageADDocumentsSecurityIntranetHostingPaymentsVoice MessagingData networksIncident breakdown by Cause(caused by bug)ChangeCapacityProcessVendorHardwareBugEnvironmentalService ProviderCarrierConfigurationComponent FailureTime unavailable/degraded12 minutes unavailable, 238 minutes degradedMTTR=238 minutes, MTBF=8 days, MTBSI=7 days.Incident User Metric Cost of downtime analysis347Classification (60%)Outage analysis (50%)Risk Management (41%)SCROPUPITBIVCM2214331221ClassificationScope (S)Less than 25% of customers affected*Credibility (CR)Multiple business units affected negativelyOperations (OP)Some interference with normal completion of workUrgency (U)Underway and could not be stoppedPrioritization (P)High - Technicians respond immediately, assess the situation, and may interrupt other staff working low or medium priority jobs for assistance.Outage analysisIT service outage analysis (IT)Major - App, server, link (network or voice) unavailable for greater than 1 hour or degraded for greater than 4 hoursBusiness service outage analysis (B)Minor -Financial loss with a visible impact on profitability but no real effect, greater than $10k or some embarrassment or rule or process breaches or medical treatmentRisk managementRisk impact (I) Best practice CIA analysis (CRAMM) – Confidentiality (unauthorized disclosure), Integrity (unauthorized modification or misuse), Availability (destruction or loss).Confidentiality=Confidential, Integrity=High, Availability=ModerateRisk vulnerability (M) What are the chances of the outage occurring considering loss, error or failure?Low loss probabilityModerate error probabilityModerate failure probabilityCountermeasures (CM) What is being done to prevent this from happening again?Proactive monitoring of environment. Refer to the knowledge base at service desk. Antivirus service locks up SMTP Service when BadMail queue reaches a specific size. Add check to daily check list to monitor BadMail folder size.ClosureEscalations Please note that if no comments or questions are received within 5 working days this reported is classed as AcceptedNo further root cause analysis required. Escalated to Infrastructure Manager.