Change Management - CompTIA Security+ SY0-701 - 1.3

Change management

• How to make a change

- Upgrade software, change firewall configuration,

modify switch ports

• One of the most common risks in the enterprise

- Occurs very frequently

• Often overlooked or ignored

- Did you feel that bite?

• Have clear policies

- Frequency, duration, installation process,

fallback procedures

• Sometimes extremely difficult to implement

- It's hard to change corporate culture

Change approval process

A formal process for managing change to avoid downtime, confusion, and mistakes.

A typical approval process

- Complete request forms\

A typical approval process

- Complete the request forms

- Determine the purpose of the change

- Identify the scope of the change

- Schedule the date and time of the change

- Determine affected systems and the impact

- Analyze the risk associated with the change

Ownership

An individual or entity needs to make a change.

- They own the process

- They don't (usually) perform the actual change

The owner manages the process

- Process updates are provided by the owner

- Ensures the process is followed and acceptable

Address label printers need to be upgraded

- Shipping and receiving owns the process

- IT Handles the actual changes

Stakeholders

Who is impacted by this change?

- They'll want to have input on the change management process

This may not be as obvious as you might think

- A single change can include one individual or the entire company

Upgrade software used for shipping labels

- Shipping/receiving

- Accounting reports

- Product delivery timeframes

- Revenue recognition - CEO visibility

Impact analysis

Determine a risk value

- IE: High, medium, low

The risks can be minor or far reaching

- The fix doesn't actually fix anything

- the fix breaks something else

- Operating system failures

- Data corruption

What's the risk with not making the change?

- Security vulnerability

- Application unavailability

- Unexpected downtime to other services

Test results

• Sandbox testing environment

- No connection to the real world or production

system

- A technological safe space

• Use before making a change to production

- Try the upgrade, apply the patch

- Test and confirm before deployment

• Confirm the backout plan

- Move everything back to the original

- A sandbox can't consider every possibility

Backout plan

The change will work perfectly and nothing will ever go bad

- Of course it will

You should always have a way to revert your changes

- Prepare for the worst, hope for the best

This isn't as easy as it sounds, some changes are difficult to revert

Always have backups

Maintenance Window

When is the change happening?

- This might be the most difficult part of the process

Furing the workday may not be the best option

- Potential downtime would affect a large part of production

Overnights are often a better choice

- Challenging for 24 hour production schedules

The time of year may be a consideration

- retail networks are frozen during the holiday season

Standard operating procedure

Change management is critical

- Affects everyone in the organzition

The process must be well documented

- Should be available on the intranet

- Along with all standard processes and procedures

Changes to the process are reflected in the standards

- A living document