- [Instructor] Information technology is in
a constant state of change.
It's hard to find an organization that relies on technology
that doesn't go through changes every day,
ranging from simple software updates
to major system deployments.
Information security professionals must understand
the roles that change and configuration management play
in protecting an organization.
Change is a good thing.
Progress comes from change.
And organizations change on a daily basis.
When it comes to information technology,
organizations must take steps to ensure
that change achieves business objectives
without disrupting operations.
That's where change management comes into play.
Change management processes ensure
that organizations follow a standardized process
for requesting, reviewing, approving,
and implementing changes to information systems.
They have the goal of minimizing the probability
and impact of disruptions to normal IT services
because of change.
This includes an assessment
of the security impact of a proposed change.
The standard tool used for change management
is the request for change, or RFC.
In an organization practicing strong change management,
any individual who wants to change a system
writes the change in an RFC
that includes some standard elements.
The RFC should include a description of the change,
an explanation of the expected impact
that the change will have on the organization and systems,
an assessment of the risk involved with the change,
a plan for rolling back the change if it fails,
the identities of the individuals
and/or groups involved in the change,
a proposed schedule for implementing the change,
and a listing of the configuration
items affected by the change.
Once someone submits an RFC for review,
it must be approved by a relevant authority
before it is implemented.
For minor changes, this may simply be the person's manager.
In the case of major changes,
the organization's change advisory board, or CAB,
may review and approve the change.
Some routine changes may have pre-approved status.
These changes may be made as soon as the RFC is submitted.
For example, if storage engineers
replace backup tapes every month,
they might have a pre-approved change
in the change management system for that activity.
They would still submit an RFC,
but the RFC would be automatically
and immediately approved by the system
due to the fact that it is for a pre-approved change.
Work may then begin on schedule
with no other action required.
Configuration management is a related discipline
that tracks the way specific devices are set up.
Configuration management tracks
both operating system settings
and the inventory of software installed on a device.
Baselining is an important component
of configuration management.
A baseline is a snapshot of a system
or application at a given point in time.
Baselines may be used to asses whether a system has changed
outside of an approved change management process.
System administrators may compare
running system to the baseline
to identify all changes to the system
and then compare those changes to approved RFCs.
Versioning and version control
are also critical components of change management programs,
particular in the area of software and script development.
Versioning assigns each release of a piece of software
an incrementing version number
that may be used to identify any given copy.
These numbers are frequently written
as three-part decimals,
with the first number representing
the major version of the software,
the second number representing the major update,
and the third number representing minor updates.
Apple's iOS uses this scheme,
along with many other software products.
For example, iOS 9 is a major version
of the iPhone and iPad operating system.
When Apple periodically releases major updates to iOS,
they add a second number to the version string,
such as iOS 9.1.
Then, if they make small updates to iOS 9.1
prior to the release of iOS 9.2, they add a third digit,
such as iOS 9.1.1.
Change and configuration management
allow technology professionals
to track the status of hardware,
software, and firmware,
ensuring that change occurs when desired,
but in a controlled fashion
that minimizes risk to the organization.