As a security professional, IT service management can be your best friend. Service tickets indicate a regular, defined process that your organization’s IT team follows. As security officer, you need to work with your IT team to make sure they understand the security pitfalls of deviating from the intended purpose of the service tickets. One such practice is to create a single bulk ticket instead of multiple tickets. Here's why bulk tickets are fraught with risk and what you, as security officer, need to make sure your IT teams know about improving practices to mitigate risk.
The fastest route can be the riskiest
There may come a time when IT is looking at entering a large number of IT workflow tickets to perform actions across a large number of employees, or a large number of computers. When the urge hits to combine all those tickets into one “bulk” ticket, I hope your organization will resist. Let me give you an example. When it comes time for a layoff at a company, the HR person works out a deal with the IT manager. Rather than generating termination service requests for each of those terminated employees, they suggest, “let’s just create one bulk ticket with a list of all the employees.” Usually the IT manager has some reservation for allowing this, but when faced with the HR admin who must enter all the tickets, they bow to the pressure and allow the HR team to generate one king-sized ticket with all 200 laid-off employees in it. This is an example of misusing the IT automation systems and it has consequences. I’ll tell you why.