3.1 - Configuration Management

Configuration management

• The only constant is change

– Operating systems, patches, application updates,

network modifications, new application instances, etc.

• Identify and document hardware and software settings

– Manage the security when changes occur

• Rebuild those systems if a disaster occurs

– Documentation and processes will be critical

Production configuration

• The most current running configuration

– Everyone uses this config

• Covers all aspects of the configuration

– Hardware devices and firmware versions

– Device driver versions

– Application software updates

• Usually tested before installation

– This must work properly

– Not everything can be tested

– Plan for the unforeseen issues

Backup configuration

• There always needs to be a backup

– Not everything works as expected

• Create a backup before making a change

– Revert to the backup if problems occur

– Copy files, create a snapshot of a VM, etc.

• Problems during the change

– Easily go back to the previous

production configuration

• Problems after the change

– Future issues can be rolled back

Baseline/golden configuration

• An application environment should be well defined

– All application instances must follow this baseline

– Firewall settings, patch levels, OS file versions

– May require constant updates

• Integrity measurements check for the secure baseline

– These should be performed often

– Check against well-documented baselines

– Failure requires an immediate correction