{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/it-operations","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/it-operations/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/it-operations/"},"term":{"en":"IT operations","da":"IT-drift"},"aka":{"en":["IT ops","IT department"],"da":["it-drift","IT-afdeling"]},"domain":["security"],"cluster":"fundamentals","layer":"host","status":"current","summary":{"en":"The team and daily work that keep an organisation's computers, systems and networks running.","da":"Det team og det daglige arbejde, der holder en organisations computere, systemer og netværk kørende."},"body":{"formal":{"en":"The function that installs, runs, updates and supports an organisation's IT systems day to day - the people who in practice carry out most security controls, such as patches, backups and account changes.","da":"Den funktion, der installerer, driver, opdaterer og supporterer organisationens IT-systemer i hverdagen - de folk, der i praksis udfører de fleste sikkerhedskontroller, fx patches, backup og ændringer af brugerkonti."},"plain":{"en":"Like the ground crew at an airport - they refuel, load and check the planes so flights leave on time; the pilots are the ones people notice, but nothing moves without the crew.","da":"Som jordpersonalet i en lufthavn - de tanker, læsser og tjekker flyene, så de letter til tiden; piloterne får opmærksomheden, men intet flytter sig uden personalet på jorden."},"inPractice":{"en":"At a Danish home-care provider, the security officer agrees with IT operations that critical updates go out within 14 days, and the IT department reports each month how many machines are still behind.","da":"Hos en dansk hjemmeplejeleverandør aftaler den sikkerhedsansvarlige med IT-driften, at kritiske opdateringer rulles ud inden for 14 dage, og IT-afdelingen melder hver måned, hvor mange maskiner der stadig mangler."},"whyItMatters":{"en":"A security plan only works if the people who run the systems can carry it out, so security roles must speak their language and fit their workload.","da":"En sikkerhedsplan virker kun, hvis de folk, der driver systemerne, kan føre den ud i livet, så sikkerhedsroller skal tale deres sprog og passe til deres arbejdsbyrde."}},"deepDive":{"en":"IT operations is usually organised around IT service management practices, most often from ITIL 4 (2019): incident management restores normal service as quickly as possible, problem management finds and removes root causes, change enablement assesses and authorises changes, service configuration management maintains the CMDB, and IT asset management tracks hardware, software and licences through their life cycle. Many teams now blend this with DevOps and site reliability engineering, where infrastructure is defined as code, changes flow through pipelines, and service level objectives with error budgets decide how much change risk is acceptable.\n\nMost technical security controls are operational tasks. In ISO/IEC 27002:2022 this includes 8.8 (management of technical vulnerabilities), 8.9 (configuration management), 8.13 (information backup), 8.15 and 8.16 (logging and monitoring activities), 8.32 (change management) and 5.18 (access rights). CIS Controls v8.1 makes the point even more directly: its first controls, inventory of enterprise and software assets, data protection, secure configuration, account and access control management and continuous vulnerability management, are day-to-day operations work, and safeguards 7.3 and 7.4 expect operating system and application patching to be automated on a monthly or more frequent basis. Patch service levels are typically tiered by severity and exploitation status, with actively exploited vulnerabilities such as those in CISA's KEV catalogue handled far faster than routine updates.\n\nThe relationship with security is a well-known source of friction. Operations is measured on uptime and change throughput, security on risk reduction, and a patch or hardening change can cause the outage operations is trying to avoid. Change management is where the two meet: a change advisory board or automated policy checks review risk, emergency changes follow a faster path with retrospective review, and maintenance windows are agreed per service. Privileged operations accounts are among the most valuable targets for attackers, so separate admin accounts, tiered administration, just-in-time access and logging of administrative sessions are central controls.\n\nIT operations differs from a security operations center: operations builds and runs the systems, while a SOC monitors them for threats, triages alerts and coordinates incident response, often with operations carrying out containment and recovery. Segregation of duties between those who administer systems and those who review their logs is itself a control. Outsourcing operations to a managed service provider does not move accountability; under NIS2 Art. 21(2)(d) supply chain security, including the security of such providers, is part of the entity's own risk-management measures, and managed service providers are themselves in scope of NIS2.","da":"IT-drift organiseres normalt efter praksisser for IT service management, oftest fra ITIL 4 (2019): incident management genopretter normal drift så hurtigt som muligt, problem management finder og fjerner grundårsager, change enablement vurderer og godkender ændringer, service configuration management vedligeholder CMDB'en, og IT asset management følger hardware, software og licenser gennem deres livscyklus. Mange teams kombinerer i dag dette med DevOps og site reliability engineering, hvor infrastruktur defineres som kode, ændringer løber gennem pipelines, og service level objectives med fejlbudgetter afgør, hvor megen ændringsrisiko der er acceptabel.\n\nDe fleste tekniske sikkerhedskontroller er driftsopgaver. I ISO/IEC 27002:2022 gælder det bl.a. 8.8 (håndtering af tekniske sårbarheder), 8.9 (konfigurationsstyring), 8.13 (backup af information), 8.15 og 8.16 (logning og overvågning), 8.32 (ændringsstyring) og 5.18 (adgangsrettigheder). CIS Controls v8.1 gør pointen endnu tydeligere: de første kontroller, fortegnelse over virksomhedens aktiver og software, databeskyttelse, sikker konfiguration, styring af konti og adgang og løbende sårbarhedsstyring, er almindeligt driftsarbejde, og safeguard 7.3 og 7.4 forventer, at patching af styresystemer og applikationer er automatiseret og sker månedligt eller oftere. Serviceniveauer for patching er typisk trinopdelt efter alvor og udnyttelsesstatus, så sårbarheder, der aktivt udnyttes, fx dem i CISA's KEV-katalog, håndteres langt hurtigere end rutineopdateringer.\n\nForholdet til sikkerhed er en velkendt kilde til gnidninger. Driften måles på oppetid og gennemførte ændringer, sikkerheden på reduceret risiko, og en patch eller en hærdning kan udløse netop det nedbrud, driften prøver at undgå. Ændringsstyringen er stedet, hvor de to mødes: et change advisory board eller automatiserede politiktjek vurderer risikoen, nødændringer følger et hurtigere spor med efterfølgende gennemgang, og servicevinduer aftales pr. tjeneste. Privilegerede driftskonti er blandt angribernes mest værdifulde mål, så separate administratorkonti, lagdelt administration, just-in-time-adgang og logning af administrative sessioner er centrale kontroller.\n\nIT-drift adskiller sig fra et security operations center: driften bygger og driver systemerne, mens et SOC overvåger dem for trusler, triagerer alarmer og koordinerer hændelseshåndtering, ofte med driften som den, der udfører inddæmning og genopretning. Funktionsadskillelse mellem dem, der administrerer systemerne, og dem, der gennemgår logfilerne, er i sig selv en kontrol. Outsourcing af driften til en leverandør af administrerede tjenester flytter ikke ansvaret; efter NIS2 art. 21, stk. 2, litra d, er sikkerhed i forsyningskæden, herunder hos sådanne leverandører, en del af enhedens egne risikostyringsforanstaltninger, og udbydere af administrerede tjenester er selv omfattet af NIS2."},"edges":[{"type":"requires","to":"security/asset","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/soc","why":{"en":"IT operations keeps systems running; a SOC watches the same systems for attacks.","da":"IT-driften holder systemerne kørende; et SOC holder øje med de samme systemer for angreb."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/monitoring","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/patch-management","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 1, 4 og 7","tier":"course-material"},{"title":"CIS Critical Security Controls v8.1","tier":"standard"}],"draft":true}