Study of Service Desk for NEdNet Using Incident
Management (Service Operation) of ITIL V.3
Jiraporn Punyateera*, Adisorn Leelasantitham*, Supaporn Kiattitsin* and Werachart Muttitanon†
*
Technology of Information System Management, Faculty of Engineering, Mahidol University, Salaya, Nakhon Pathom, Thailand
E-mail: supaporn.kia@mahidol.ac.th Tel: +662-889-2138 Ext. 6300
†
Rajamangala University of Technology Tawan-ok,Chakrabongse Bhuvanarth Campus, Bangkok , Thailand.
E-mail: werachart@cpc.ac.th Tel: +662-692-2360-4
Abstract— This paper aims to study the customer service desk
at National Education Network (NEdNet) using incident
management. It is conducted in order to identify the difficulty of
using the NEdNet system properly, to reduce the time of incident
analysis and operation time of restoring services to the normal
condition as well as to support a large number of members in the
future. This research proposes the IT Infrastructure Library v.3
(ITIL v.3) which is a best practice for IT management
framework based on the incident management (Service
Operation). The results indicated that if managers used incident
management with the ITIL approach at the customer service
desk of NEdNet, decisions could be made more efficiently
regarding resource management.
I. INTRODUCTION
Initiated in 1996, the Office of Information Technology
Administration for Educational Development under the
operation of the Office of Higher Education Commission in
Thailand was primary set up the Inter-University Network
(UniNet) in order to provide the broadband technology in
education to major universities in Thailand.
UniNet designed and developed its network by using fiber
optic cable and bring in the Dense Wavelength Division
Multiplexing (DWDM) technology aiming to provide better
service to all participating users. Uni-Net was successfully
operated over the past 15 year so that the board committees of
the Office of Information Technology Administration for
Educational Development would like to expand the service to
other learning communities across the country, including
schools, junior high school, high schools and universities
under the Office of the Basic Education Commission and
Vocational Education Commission.
To align with the new objective, the National Education
Network (NEdNet) was first introduced in 2010 to replace
UniNet. NedNet aims to provide more cost effective,
exchange information and coordinate more efficient
connectivity across all schools, universties and internet in
Thailand. From 200 UniNet’s users in 2006, NedNet aims to
reach up to 3,000 users in 2010 and 10,000 users in 2014 and
ideally up to 40,000 users across Thailand.
Numbers of participating educational institutions are
increasing to use UniNet and NEdNet service from 1996 to
2014. As digital technologies are increasingly used in schools,
‹$36,3$
the improvement of service that are fit for current numbers of
customers becomes increasingly important. NEdNet hires
technical staffs to answer all inquiries via its call center or
Network Operation Center (NOC) at 02-3545678 extension
4004. Users can also report their incidents via email or social
network (www.facebook.com/NEdNet). While NEdNet
believes they provide enough resources, yet, problems still
rise as most customers prefer to report their incidents at call-
center in order to get an immediate response.
In 2013, a survey reports that there is only 10 technical
staffs work for NEdNet call center, giving the responsibility
to each staff for up to 1,000 users. Lacking knowledgeable
staffs to match up number of users becomes the concerned
issue. Example of this case can be seen here. NEdNet has set
up its connection structure by node–back bone and
distribution. One node can be linked to many educational
institutions. They have been set up by local, regional, or
educational district area. If backbone or distribution node
occurs problem, there is a high possibility that at least one to
all users connecting from the same node will be affected.
The problem could make the connection unstable or unable to
connect. If all users report the same problem to NEdNet call
center, it would create a duplicate incident report to call-
center staffs, making them waste more time to investigate the
same issue. On the other hand, incident reports from other
channel sometimes have not been recorded in the database so
that NEdNet is not aware of issues.
The difficulty of using NEdNet system made NEdNet
calls for examination and immediate execution plan to
improve the effectiveness of incident management analysis
and its operating time. This research paper will then be
focusing on how to effectively operate customer service desk
of NEdNet using the proposed incident management process.
II. RELATED WORKS
IT services is a major topic in the IT service management
organizations. Currently many organizations / agencies adopt
IT Infrastructure Library (ITIL) to use in the IT service
management. The framework has been recognized as a good
framework (Best Practice) for the IT services. Since in the
past it never have a clear process so it difficult to evaluate.
The implementation of such a framework in the processing /
$36,3$
application of each project will make benefits to manage
projects effectively. Currently there are several research
groups that have seen the benefits of adopting ITIL for the IT
services due to the IT service processes that were not clear so
it is impossible to evaluate the service.
In this research, we have designed an evaluation
framework for process-oriented IT Service Management with
ITIL based framework to support the work of the organization
/ agency. And proposing the perspectives in the evaluation of
the four sections, namely Management, Technology, IT User
and IT Employee and evaluation framework that will help in
the Performance assessment, Benefits realization, finding
areas for IT service improvement and Directing Resource. [1].
Many companies that do business in IT such as in Egypt
was aware of the problem of IT services. With market
competition increases, customers or users are important to
drive more business. So researchers interested in studying the
impact and how to Implement an IT services. It will focus on
the part of the incident as a service to the users or customers
directly.
In many research, the design process Implement according
to the framework of ITIL which offers stage six steps as
follows: Initialize the Project, Assess the current situation,
Define the process, Implement tools, Implement process, and
Assess and Evolve. The core process to improve the quality of
IT services will need monitor, control, monitoring and
responding to the incident. However, to implement a process
to ensure compliance with the ITIL framework will require a
management team with a high commitment to the same
purpose, such as cooperation from authorities, etc. [2, 3, 4].
In the process of receiving notification according to
Incident Management, the primary objective is to reduce the
time to interrupt the operation of the business activity or to
make things happen without unexpected return to normal soon
and Impact on small entities of the State. One of the
mechanisms to achieve that objective is to provide the Service
Desk, which is the center of communication between the user
and technical staff.
Service Desk is responsible to receiving the cause of the
problem from user in order to send a message, gallery at the
beginning of the process and also including the recording data
(e.g. type, description, reporter information
and responsible person for the incident, and so on). The
problem classification and incident responding, whether it is
to contact with technical staff to resolve cases that occur if
more than Service Level Agreement (SLA) or confirming
with the user that the problem has been completely resolved
or not including a various reports that useful for management
decisions in the future, such as a specific type of device
that have a problem, the number of hours it takes to resolve
each case.
These reports will be used to analyze for the management
decided how to fix the problem and develop a better system to
have. However, the turnover of staff, which is the repeated
problem, is a common problem in the IT industry. And what
happens is that knowledge, specialization, how to fix the
problem are disappears with the officer, which will impact on
the service to the users, due to the lack of knowledge and
specialization. As a result, the duration of service increases.
Of such problems is a research study designed to provide
knowledge management systems as a middleware to link to
relevant information, which can improve the better
performance of the Helpdesk’s Services. [4, 5, 6].
This research study aims to provide a notification process
solution by applying the framework of the implementation of
ITIL v.3. Service operation in a portion of the Incident
Management Services for the design process of a proper
network failure alert the NEdNet Network and simulate the
receiving processes of failure notification to analysis and
evaluate the new framework. (Based on the framework of
ITIL v.3).
III. METHODOLOGY
A. Studying the currently incident management model and
its resolution method.
To complete this objective, researcher has been collecting
the distributed documentations, information from website and
the result from interviewees’ interview from the September
2012 to November 2012. During this period, two of the
networking engineer staffs have been assigned to work on a
daily basis of incidents reporting. Users can report their
incidents through one of the four NEdNet’s given
communication channels.
- NEdNet call-center at 02-354-5678 extension 4004 from
8.30a.m. to 16.30p.m.
- Email at noc@uni.net.th
- Social network at www.facebook.com/NEdNet.
- NEdNet’s web browser at http://noc.uni.net.th.
The information provided from all channels will be stored
at NEdNet’s database, http://noc.uni.net.th.
In the event that incidents caused by the devices or
hardware and/or the networking communication, the
outsource company will be a main contact and resolver of
such problems.
Figs. 1 and 2 show the current workflow of NEdNet’s
external and internal incident management process model.
Fig. 1 The current workflow of NEdNet’s external incident management
process model.
 Present process
Sub contact
User/Member Technical staff
(Outsource)
Start
Diagnosis incident
incident
Configuration/
No (H/W,Fiber)
hardware/fiber
Yes (configuration)
Resolve and
Recovery
Logging
End
Fig. 2 The current workflow of NEdNet’s internal incident management
process model.
B. Analyzing the cause of each incident and evaluate the
correlation among causes.
In this step, 609 cases have been reported and been broken
down into five categories based on type of problem as follow;
- 91.62% caused by major issues such as Internet
connection problem, Fiber link down and patch fiber
problems
- 5.25% caused by hardware problems
- 1.8% caused by personal configuration issues
- Less than 1% caused by personal request and
- Less than 1% caused by power shortage
In addition to 609 cases, there are still some missing
numbers that have not been recorded in the system.
- Some users reported that they could not report their
incidents due to busy line or there was no customer service
available at that time
- Some users have been sent directly to outsources
companies without any written reports
- Some users reported via social network channels
but no record was found in the database
On the other hand, researcher finds a correlation among
609 cases here. A closure to 50%, incidents share cause
similarities among each other. Fig. 3 shows the relationship
between sequence of incidents and numbers of incidents
reporting at that time. Researcher finds the correlation ratio of
3.4 out of 1. This means from 1 root cause, there will be 3.4
incidents counted to be duplicated major incidents via
NEdNet’s database.
In most cases, the technical staffs could be able to examine
and solve the problem right away. Statistics shown in Fig. 4
show that 248 cases out of 609 cases could be solved within
24 hours after reporting, and maximum to 43 days resolution
time in some rare cases. And the average of 9.5 hours
resolution time per incident.
Outsource
process
Fig. 3 Numbers of incidents in relation to possible correlating causes.
Fig. 4 Number of days to resolve incidents.
The workflow of how service desk is to diagnose each
incident and to identify the root cause when users report
issues. It is the service desk’s job to identify the right cause
so that they could send the case to the right person to fix it.
For example, a user reports on Internet connection problem,
service desk would ask a user to test the system by asking
him/her to enter their regular visit website address such as
www.google.co.th or www.uni.net.th. If the problem solves,
the root cause might be a specific user’s preference setting.
On the other hand if problem insists, the root cause might be
originated from the gateway and further investigations are
needed.
C. Enhancing the current incident management process by
utilizing the best practices of ITIL v.3.
Currently there are some recommendations from other
research studies that can be useful and able to adapt with
NEdNet’s service operation. Examples are “Mobile Operator
Service” study and “Call Center Service” study. Both service
industries have organized staffs based on their knowledge and
professionalism into different levels. The entry-level staffs
will be trained basic system knowledge and quick resolution
method guided by their organization. They will work as call
center agents who examine and explain basic resolution.
They can give advice of the most frequently found root cause
to users, as well as report and record incidents into their
database. In case technical staffs are not available, they will
ask user’s contact information and will contact users back
once service agent becomes available. If the incidents
consider to be severe cases, call center agents can transfer line
directly to the second-level staffs where users could get the
immediate experts’ advice or be able to spend more time
interacting with the technical staff to solve the issues.
According to the similarities of NEdNet’s service operation
to mobile operator and call center service, researcher has
proposed the new incident management process by breaking
staffs down into four service-levels, as shown in Fig. 5.
- First level or agents
- Second level or senior agents
- Third level or technical staffs and
- Forth level or specialists
model, researcher proposes to add a step of customer
relationship management (CRM) at service desk level to track
result from users, ensuring issues have been solved properly
before ticket can be closed (Fig.6).
Fig. 7 indicates how incident works through current
channel while Fig. 8 shows the proposed model by adding
number of service desk to the current channel. In order to
prove the effectiveness of the proposed model from the
current model, researcher will apply the SimEvent function
from the MATLAB program to simulate how incidents will
be solved. Details how appropriate program and practices
work will be described in Section IV.

Fig. 5 The proposed incident management process from user to different

service level staffs.

Based on the study of information technology service

standard, Information Technology Infrastructure Library
(ITIL) v.3 has been designed to be the service operation
framework of incident management. ITIL v.3 not only helps
manage the networking connection reporting system, record
system modification, request additional service requirement,
but also monitor network traffic system. ITIL v.3 will be
working as a one-stop service place. It could be the only one
database to segregate information using to identify, analyze
and solve incidents. Researcher believes if modifying some Fig. 6: The new workflow of NEdNet’s incident management process
of ITIL v.3 processes to allies with current NEdNet incident based on ITIL v.3 and the shading boxes indicating new modifications.
management, ITIL v.3 could be the best practices to NEdNet
after all. Fig. 6 shows the working process of incident
management based on ITIL v.3 service framework. The
shading boxes indicate the new modification adding to ITIL
v.3. Fig. 7 The currently Model of incident management.

D. Simulating a new incident management process model

and comparing the effectiveness with the old model by
using MATLAB program.
Fig. 8 The Proposed Model of incident management.
The previous step has highlighted the important roles of
ITIL v.3 and it is believed to be the best practices to
NEdNet’s incident management. To enable a high quality
service to NEdNet’s current incident management process
 IV. SIMULATION RESULTS
As mentioned earlier in Fig. 7, Fig. 9 shows currently
incident process model of queue following FIFO (First In
First Out) scheme using MATLAB simulation.
Fig. 9 Currently incident process model.
Table I shows the information analysis comparison of 9
cases (1.0 – 1.8) (adjusting parameters e.g. numbers of entity,
major or minor etc.) for FIFO Queue from the case study. It
can then analyze the data. As follows:
1) The number of generated entities is more at period time
set at 1.33 times.
2) As this case study is FIFO Queue type. And there are no
major and minor screening case which entity put to the
Process server in order from the First in First out queue only.
And only one has been identified with a single server. Entity
has determined that all the N-Server Switch to the same.
3) The case study 1.0 and 1.1 is to initialize the
parameters while the case study 1.2 has only different period
time. In the other hand, average of processing time is likely
decreasing by given the period time = 100. However by
increasing period time to process to 1000, the average time is
increasing just similar to the case study 1.1 and 1.2.
4) From case study 1.3, if the service time in the process is
equal to period time as reported incidents (with ratio 1:1) then
all can be solved ( the rest is the exceeded from 1)).
5) From case study 1.4 and 1.5 the parameter of service
time is to 19. (Average of solving time for case is 9.5 hours.
And we are set 0.5 hours = 1 Period time. Therefore, the
service time is 9.5 hours = 19 period time (9.5/0.5)). The
incident can be finished by 32 incidents (33 incidents out of
FIFO Queue which is one in process on the N-server) and
non-affected to output when reduced the capacity to 12. But it
has affected to waiting time.
6) From case study 1.6. Find such information. When
checking on the facts found. The Organization has to
outsource 4 company for operate 4 zones and each zone has 2
staff teams for solve incident process (Total is 8 staff teams)
thus we can prove the model, it can instead currently incident
process.
7) From case study 1.7 and 1.8. Found that if you want to
be able to fix the incident problem, all the entire in FIFO
queue and it has not someone incident wait in the queue. It
must have the staff team more to 30 staff teams to solve
incident process and capacity is not affected of output.
TABLE I
COMPARISONS OF SIMULATION RESULTS FOR CURRENTLY INCIDENT PROCESS
MODEL
As mentioned earlier in Fig. 8, Fig. 10 shows incident
process proposed model of queue following Priority scheme
using MATLAB simulation.
Fig. 10 Incident process proposed model.
Table II shows the analysis comparison of 11 cases
(adjusting parameters e.g. numbers of entity, major or minor
etc.) for Priority Queue from the case study.
1) The number of generated entities is more at period time
set at 1.33 times.
2) As this case study is Priority Queue type with the
attribute set to switch attribute for minor case and major case.
When priority Queue, any Switch Attribute being set to 2
(major case) will be sent to N-server1 immediately (as if
Technician) and any Switch Attribute being set to 1 will be
sent to N-server (as if service desk officer to diagnose and
acknowledge to minor case).
3) The case study 2.1 is to initialize the parameters while
the case study 2.2 has only different period time. In the other
hand, average of processing time is likely decreasing by given
the period time = 100. However by increasing period time to
process to 1000, the average time is increasing just similar to
the case study 1.1 and 1.2.
4) From case study 2.3, if the service time in the process is
equal to period time as reported incidents (with ratio 1:1) then
all can be solved ( the rest is the exceeded from 1)) similar to
the case study 1.3.
5) From case study 2.4 and 2.5 the parameter of service
time in the minor case is to 1 and 19 for major case which
satisfy the hypothesis that distinguishing minor case and
major case allows minor case to be closed up at the period of
reporting incident. Average of solving time for major case is
9.5 hours. With the different capacities, the incident can be
finished by 37 incidents and 68 incidents accordingly.
Decreasing the capacity to 12 affects to the product which
opposite to case 1.4 and 1.5. The difference is occurred in the
number of Minor case that can be solved as the number of
major case cannot be in the queue by smaller capacity.
6) From case study 2.6 compared to 1.6, the effeteness can
be increased by reducing number of technician from 8 servers
to 5 servers and adding only one service desk.
7) From case study 2.7 compared to 2.6, reducing capacity
in case study 2.6 to Inf and to 12 in case study 2.7. It can
increase the number of entity success from 235 incidents to
556 incidents. Most of the entity success is minor case and
they are similar to case study 2.4 and 2.5.
8) From case study 2.8, it will adjust servers in both minor
and major for maximum entity success by minimal number of
server. It results the most effective adjusting server for minor
case is 2 and 7 for major case. The process can finish up to
792 incidents and case study 2.9 is to reduce capacity to 12
which reduce number of incidents opposite to item 7.
9) Case study 2.10 is the forecasting analysis. Given 1000
academic institutes, there will be 1800 incidents expected.
The number of the generated incidents should be relevant to
the previous case study therefore time = 1800 period time
(equal to 2400 entities). All entities can be finished or almost
by using 5 servers for minor case and 10 servers for major
case which can support all the connecting academic institutes.
10) Case study 2.11 is to reduce the capacity to 12 which
reduces the number of entities to be process to finish similar
to item 8
TABLE II
COMPARISONS OF SIMULATION RESULTS FOR INCIDENT PROCESS PROPOSED
MODEL
V. CONCLUSIONS
The study of current NEdNet incident management process
made it clear that NEdNet needs better improvement in their
service to maintain its customers. By bringing in the best
practices of ITIL v.3, NEdNet enables to effectively examine,
record and follow up all incidents reported by customers.
The currently management process shows that there is only
8 teams of technical staffs work as a service desk of
NEdNet’s operation to fix all the problems and fiber optic
cable problem considers to be the main issue of NEdNet’s
network based on the case study of 1.6. Due to high volume
of customers’ reports, NEdNet finds it difficult to response all
customers’ need. The number of 1.7 case study shows that in
order to maintain its efficiency, NEdNet needs a minimum of
30 technical staff teams to cover all customers’ need.
From the simulation model, the new incident management
(ITIL v.3) could make the better improvement of NEdNet’s
current service. The new process could prioritize the severity
of each problem and allocate the work to proper staffs (The
Right Man on The Right Job). Technical staffs would not
work at the first level anymore. The new process is replacing
them with new hires less skill trainees in the service desk
level (first level). Technical staffs are now assigned to work
on skillful problems only while service desk will be the first
person recording all reports from customers instead. The 2.6-
2.11 case study shows that by increasing 1-2 more service
teams, NEdNet is enable to support the forecast up to 10,000
customers. It means that by increasing 0.5 times of service
team could support 3 more times of customers.
REFERENCES
[1] B. McNaughton, P. Ray and L Lewis, “Designing an evaluation
framework for IT service management” Information &
Management, vol. 47, pp. 219–225, 2010.
[2] M. M. AlShamy, E. Elfakharany and M. A. ElAziem,
“Information Technology Service Management (ITSM)
Implementation Methodology Based on Information
Technology Infrastructure Library Ver.3 (ITIL V3)”
International Journal of Business Research and Management,
vol. 3(3), pp. 113-132, 2012.
[3] S. Sebaaoui1 and M. Lamrini, “Implementation of ITIL in a
Moroccan company: the case of incident management process.”
International Journal of Computer Science, vol. 9(4), no. 3 pp.
30-36, July 2012.
[4] C. Bartolini ,C. Stefanelli and M. Tortonesi, “Business-impact
analysis and simulation of critical incidents in IT service
management”, The 2009 IFIP/IEEE International Symposium
on Integrated Network Management, pp. 9-16, 2009.
[5] L. M. Gonza´lez, R. E. Giachetti and G. Ramirez, “Knowledge
management-centric help desk: specification and performance
evaluation” Decision Support Systems, vol. 40, pp. 389– 405,
2005.
[6] D. Forte. “Security standardization in incident management: the
ITIL approach” Network Security, pp. 14-16, January 2007.