1.3 General Security Concepts

Approval Process

Ensures that any changes, especially those affecting IT systems and security infrastructure, are reviewed and approved by authorized personnel before implementation, which helps in mitigating risks associated with any unauthorized or poorly planned changes

Ownership

Refers to identifying who is responsible for overseeing the change processes, including responsibility for planning, executing, and follow up.

Stakeholders

Internal or external entities who may be affected by the change or who has influence over the process, and effective communication and involvement with these groups are key for successful implementation changes

Impact Analysis

Analyzing the potential impact of the change to the organization’s existing security posture by evaluating the risks and benefits of the change, how it might affect existing security controls, and what new risks it can produce

Test Results

Testing changes in a controlled environment before full implementation since it helps identify any unforeseen security issues

Backout Plan

A contingency plan that can be activated if the change introduces unacceptable risks or causes unforeseen issues by outlining the steps to revert the systems to their previous state, minimizing the impact on security operations

Maintenance Window

The predefined period during which the changes are implemented, reducing the impact on users and allows for a more controlled and secure implementation

Standard Operating Procedure

Detailed, written instructions to achieve uniformity in the performance of specific functions, ensuring that changes are implemented consistently and securely

Allow List

A list of software, applications, and other system components that are allowed to exist and run on a system

Deny List

A list of software or applications that cannot be installed or run on a system

Restricted Activities

New restrictions on user activities added due to changes in system configurations or polices, such as limited access to certain resources or disabling certain functions, and can impact user productivity and will need to be communicated despite increasing security

Downtime

The time in which the system being changed is rendered inoperable due to the ongoing changes, and it should be kept to a minimum in order to not negatively affect business operations

Service Restart

Ensuring that security controls are fully re-engaged once the service has been restarted

Application Restart

Ensuring that security controls are fully re-engaged once the application has been restarted

Legacy Application

Older applications that may not be compatible with new systems or security protocols, potentially creating security gaps

Dependencies

Understanding that changing one component can affect other dependent systems, and managing the dependencies is crucial to prevent security or operational issues due to system incompatibilities

Documentation

Keeping a clear record of all changes, their reasons, and their impacts on systems and security

Updating Diagrams

Changing current IT infrastructure diagrams in order to reflect the changes made in the environment, as the diagrams are crucial for assessing the potential impacts of changes on various parts of the system

Updating Policies and Procedures

Changing current security policies and procedures in order to reflect the changes made in the IT environment

Version Control

Ensures that developers and users have access to the latest versions of software and that changes are carefully managed throughout the release process, such as having a labeling or numbering system that differentiates between different software versions