Ruslan Rakhmetov, Security Vision
Historically, IT departments, information security services, and senior management have existed in parallel universes and spoken fundamentally different languages. When a system administrator reports a "node failure in a server cluster" and a security specialist reports an "exploitation of critical vulnerability CVE-2023-XXXX in a database", the CEO or investor hears only white noise. Businesses value entirely different metrics: process continuity, net profit, brand reputation, and customer churn.
The gap between technical logs and business metrics often leads to underinvestment in security. Business service management (BSM) is the bridge across this gap. This approach allows us to translate gigabytes of technical metrics into a clear management and financial framework.
1. Transparency architecture, how resource-service models work
2. About the methodology in general
3. Risk assessment and budget allocation
4. Justification for Investments in Automation and Artificial Intelligence
5. Practical steps: Where to start connecting IT, IS and Business
Transparency architecture, how resource-service models work
The concept of business service management is based on the resource-service model (RSM), a hierarchical map that clearly links every tiny cog in an IT system to the global business process. Imagine a tree whose roots are physical servers, data storage systems, and routers; its trunk and branches are operating systems, databases, and middleware; and its leaves and fruits are the end -use business services that generate revenue for the company (e.g., "Checking out a shopping cart in an online store" or "Issuing a loan in a banking app").
When a BSM solution is deeply integrated with information security platforms, true magic occurs, translating technical language into management language. Let's consider an example: hackers conduct a DDoS attack or attempt to brute-force passwords on a specific IP address. The security platform (SIEM) detects a flurry of abnormal traffic and the overload of a specific network node. The BSM system instantly checks this node against the resource-service model (using CMDB data) and understands that the attacked server serves an online payment gateway.
High CPU Load notification appears on the CEO or Information Security Manager dashboard. on Node 42, and a clear alert: "Critical risk: payment acceptance from retail customers is at risk of being interrupted." This transparency radically changes the approach to infrastructure protection. Specialists are no longer saving hardware; they're saving businesses.
About the methodology in general
A methodology in which the entire IT infrastructure and security systems are viewed not as a set of hardware and software, but as the foundation for delivering specific business services. Imagine, for example, that you can't see how exactly fuel is injected into the cylinders or what the pressure is in the brake line, but you can see clear and important results: the speedometer, the remaining range in kilometers, and the "Check Engine" light. BSM is the same panel that conveys the essence of processes, but for businesses such as "payment processing" or "call center operations from a service management perspective".
The dashboard's resource-service model allows other specialists to see details that are important to them: deadlines and statuses for response team engineers, vulnerability and incident details for cybersecurity personnel, and so on.
The CMDB system we mentioned above can be thought of as a detailed electrical plan for a house: if the breakers in the kitchen trip, you'll know exactly which circuit breaker controls the refrigerator and microwave, not the light in the kids' room. This plan will serve as the IT database.
But there's more than one service involved in managing processes. Imagine a contract with a nanny: you clearly agree that she will pick up your child from school at exactly 3:00 PM, feed them lunch at 3:30 PM, and help with homework until 6:00 PM. If the nanny is an hour late, it's a violation, which entails sanctions (a fine or termination of the contract). In process management, the SLA (Service Level Agreement) is responsible for such a contract with deadlines. SLA is a strict contract (internal or external) that describes the quality of service: system availability as a percentage (e.g., 99.9%), failure response time, and full recovery time.
From a security perspective, processes are built around specific actions and consequences. A burst hot water pipe or a burglar climbing through your open window are examples of critical situations that require immediate action. However, a rusty or cheap lock on your front door or a habit of leaving a ground-floor window slightly open doesn't necessarily mean you've been robbed, but it does create the perfect conditions for a thief.
In practice, an error in program code or network architecture that allows an attacker to penetrate the system acts as a lock on the door (a vulnerability), while an event that violates the confidentiality, integrity, or availability of data (an incident) requires the intervention of specialists as a priority.
Risk assessment and budget allocation
But information security faces one challenge in the eyes of businesses: its intangibility. Security is often perceived as a black hole consuming budgets. Combining SLAs and BSMs allows us to digitize risks and demonstrate damages in hard currency.
Financial risks are divided into two categories:
а) Direct losses, i.e., lost revenue during downtime, fines for violating external SLAs with clients, and overtime payments to engineers for system restoration.
б) Indirect losses, such as the loss of loyal customers to competitors, a drop in share prices, and reputational damage.
Thanks to the resource-service model, the business knows that the "Truck Routing" service generates 1,500,000 rubles in revenue per hour. The information security department discovers a critical vulnerability in the logistics database. TI Application shows that the probability of a successful attack on such a vulnerability is approximately 2 times a year, and statistics from SOAR or the internal SLA figures indicate the average time to restore a database after ransomware, for example, 6 hours.
Calculating the losses from a single incident: 1,500,000 rubles for 6 hours yields 9,000,000 rubles in direct losses, and the annual risk (2 incidents) amounts to 18,000,000 rubles per year. Now, the information security director approaches management not with a request to "buy a next-generation antivirus for 3 million," but with a justification: "We have a vulnerable business process, the risk of downtime for which costs us 18 million rubles per year. Installing security software for 3 million will reduce the likelihood of an incident to zero. The ROI (return on investment) will be 500% in the first year." This is language any CFO understands.
Justification for Investments in Automation and Artificial Intelligence
And with digitalized business models in hand, proving the need to implement advanced security systems like SOAR (security orchestration, automation, and response platforms) or AI solutions becomes a matter of pure mathematics. Why should businesses spend millions on artificial intelligence in security?
On the one hand, a human operator needs about 15-30 minutes to analyze an unusual log, and another hour to manually isolate the infected network segment. Artificial intelligence can detect anomalies (for example, an accountant downloading gigabytes of a client database at 2 a.m., which is unusual for an accountant) in milliseconds. Automated scripts will lock the user account and close the port on the switch before the data even leaves the company's network. If an hour of downtime costs millions, automation saves businesses enormous sums on each incident.
In a large corporation, thousands of minor anomalies can occur daily, raising a new question: what should the information security department respond to first? AI integrated with BSM acts like a smart triage system in an emergency room. It recognizes that an attack on a secondary internal portal for ordering office supplies can wait, but suspicious activity on the transaction server requires immediate intervention from the entire team, as it entails the highest financial risks and the strictest SLAs.
If the load on services gradually increases, or small, invisible precursors of an advanced threat actor (APT) appear, the AI of a machine learning system can analyze trends and alert before the SLA is breached. This represents a shift from reactive firefighting to proactive management.
Practical steps: Where to start connecting IT, IS and Business
Building a full-fledged Business system Service Management is a journey that can't be completed in a week. However, to begin translating IT into business-oriented thinking, several basic steps are necessary:
1) Asset Inventory. You can't protect what you don't know, so it's essential to create an up-to-date CMDB or Asset and Inventory Management.
2) Identifying critical services. Work with senior management to identify the 3-5 most critical business services whose downtime would be fatal to the company.
3) Mapping. Technical specialists must create a diagram of which specific servers, programs, and communication channels support the services identified in the previous step.
4) Monitoring setup. Information security systems (antivirus, SIEM, firewalls, email, and general communications) should be configured to link their alerts to the nodes in the created diagram.
5) Financial assessment. Work with the finance department to calculate the cost per hour of downtime for each critical service.
Deep integration of Business Service Management into the IT and cybersecurity framework is a sign of a company's maturity. Translating technical incidents and vulnerabilities into the language of business services, SLAs, and financial risks breaks down the wall of misunderstanding between technical staff and management. IT and information security departments cease to be "cost centers" and become equal business partners. When a company understands the precise cost of securing its processes, investments in modern technologies, automation, and artificial intelligence become not a blind pursuit of trends, but a measured and mathematically sound step toward protecting capital.
