Hello everyone .. We all work with different customers and each one has their specific process and culture to be followed. Banks and for that matter PSU banks have very stringent processes. We (from project delivery side) must understand those processes for efficient project management.
I’m noting down a few pointers I have picked up from my engagement with a big PSU and the lessons learnt !!
There are different phases that needs to be followed in the complete lifecycle:
• Requirement gathering
• Design
• Deploy
• Validate
• Audit
• Operations
Design Phase
Phase 1
• Kick off meeting – to discuss about the product and its design structure
• Requirements gathering – gather info about platform (Sites – DC/DR, environment – UAT/Production, Zones – DC/DMZ, Firewall, Ports
• Prepare High level design document – clearly mention the design decisions & justifications, constraints, assumptions, network diagram etc
• Prepare Low level design document – detailed explanation of all the design points
Phase 2
• EA meeting – Need to present v1 design for approval, EA consists of banks architects team so be ready to answer a lot of queries mostly on security.
Note – EA meeting happens twice a month so if you need approval you need to prepare the necessary documents before the meet.
Phase 3
• CAB meeting – Need to present v2 design for approval, CAB consists of banks business teams & queries focus on use cases & business process which will be improved.
Note – CAB meeting happens twice a month so if you need approval you need to prepare the necessary documents before the meet.
Deploy Phase
Prerequisites for deployment
• CR needs to be raised for any component which needs to be created or modified or deleted (consider approval hierarchy & timelines) e.g. VM creation
• CR needs to be raised for any firewall, port requirements (consider approval hierarchy & timelines which are more as multiple departments are involved) e.g. firewalls needs to be opened up between different components which are placed in different zones
Note:
• Firewall is pushed at night on a particular day of the week. So you have to be mindful of this timeframe.
• If any modification in the CR, then approval process has to be repeated so it is very important to give data right first time.
• Define a process to copy necessary files to the environment. e.g. deployment packages from OEM. Most banks have dark sites and hence this activity may take some time.
Deployment and Sign off (UAT environment)
• Once CR are approved from test vms check if firewalls are working as needed
• If firewall is ok then proceed with necessary vm deployment
• It is important to integrate VM with PAM, SIEM, DAM, AV etc as per banks process
• Install & Configure the necessary software as per OEM documentation
• It is important to perform planned DC to DR drill for the deployed components and verify if the environment run well from DR site
• Collect the evidence of the successful deployment and proceed to take Deployment signoff at platform level.
Deployment and Sign off (Production environment)
• Once CR are approved from test vms check if firewalls are working as needed
• If firewall is ok then proceed with necessary vm deployment
• It is important to integrate VM with PAM, SIEM, DAM, AV etc as per banks process
• Install & Configure the necessary software as per OEM documentation
• It is important to perform planned DC to DR drill for the deployed components and verify if the environment run well from DR site
• Collect the evidence of the successful deployment and proceed to take Deployment signoff at platform level
Design/Implement Use cases
• Design use cases as per the functional specifications
• Requirements for use cases needs to be collected from different teams.
e.g. CISO team, Cloud team, SIEM team, Different applications team
• The use cases needs to be thought based on their reach e.g. some which can be applied at a scale and some which will be specific to any particular team with limited reach.
• Design and test use cases first in UAT environment.
Note: It is important to get approval from the respective teams on the successful execution of the use case.
• Submit the evidence of the successful use case implementation & proceed to take use case signoff at UAT level.
• Once the use case is validated repeatedly on the UAT environment then it can be released on the production environment to be implemented on production VMs.
Note: It is important to get approval from the respective teams on the successful execution of the use case.
• Submit evidence of the successful use case implementation & proceed to take use case signoff at Production level
Operations Phase
• After the project is moved into operations phase the use cases needs to be executed as per the work orders raised by different teams. It is important to have a work order for any use case execution.
• Platform level upgrades should also be performed as per the updated received from the OEM after raising a change request.
Audit Phase
Successful audit is an important aspect of completing any project in a bank
Below are few of the points needed for audit:
• Evidence of servers integration with PAM, SIEM, DAM
• User access review
• Password policy & procedures
• SOP documents (Platform, Use cases)
• Last 2 quarters of VAPT reports and closure status
• Last 2 quarters of SCD reports and closure status
etc
Timeline factors
It is important to consider below pointers while defining/revising project timelines
• Coordination between multiple teams
• Acquiring successful execution evidence from teams
• Coordination with OEM for platform updates, feature updates, GSS cases with support timelines
• Approval timelines for CR, WO
• Information movement between different hierarchies
• Processes that needs to be followed
• Freeze duration – during audit time, during financial year end
• Daily, Weekly, Monthly reports
• Latest 2 quarters of DR Drill reports for the current financial year
etc
Hoping this data will give you some idea and benefit in your planning for a project and a timely Signoff !!
Cheers 🙂