Introduction

This chapter covers the third objective in Domain 1.0 General Security Concepts of the CompTIA Security+ Exam. In this chapter, we will review the change management process and its impact on security. Change is a constant occurrence within the business sphere—encompassing organizational restructuring, technological advancements, and shifts in corporate culture—and these changes lead consequently to a continual introduction of new security risks.

The implementation of a structured change management process is imperative. Such a process ensures that changes remain under control, steering clear of any adverse repercussions and fostering coherence within the organization.

The Change Advisory Board (CAB) is responsible for evaluating, prioritizing, and sanctioning these changes. The CAB’s unwavering focus extends beyond organizational objectives; it is also keenly attuned to the necessary alignment of these changes with the company’s overarching...

Change Management

Change is an inevitable and constant part of life, both personally and professionally. In the business world, change can take many forms, from organizational restructuring and technology upgrades to shifts in company culture and market dynamics.

In information technology particularly, such changes could be a system upgrade, new software installation, or switching from one technology to another. Maintaining a structured process to ensure that such changes remain under control is, therefore, imperative to ensure that changes are carefully managed and their potential impacts are thoroughly assessed, preventing unforeseen consequences and ensuring a coordinated approach across different departments within your organization.

The CAB helps prioritize changes and evaluates their financial impact on a company. They decide whether to approve or reject proposed changes that can affect business processes and security operations. It starts with the approval process and...

Technical Implications

In the intricate world of technology, understanding technical implications is like deciphering a complex puzzle. There are several key technical aspects that hold the gears of modern operations together, each playing a unique role in maintaining digital harmony, described below:

• Allow lists/whitelists: An allow list grants access only to those on a list; this could be used on a firewall or by AppLocker that decides which applications and files can run. Whitelists ensure that only approved applications can be installed or run. Applications not on the allow list or whitelist will be denied. Once you set up a whitelist, malware will not be able to run. After all, you would never add it to the whitelist.
• Deny lists/block lists: A deny list/block list operates by preventing access to those on the list; this could be used on a firewall to deny access. A block list prevents applications that could cause harm, but you need to name the applications being...

Documentation

Thorough documentation of changes ensures transparency, accountability, and a clear understanding of the changes being made. Properly documented changes help track modifications, making it easier to identify who made a change and why. This enhances security by reducing the risk of unauthorized or unaccounted-for alterations. Maintaining proper documentation is important and should involve the following best practices:

• Updating diagrams: Keeping diagrams up to date (such as network topology or system architecture diagrams) supports a better understanding of the current environment. Accurate diagrams contribute to effective security management by avoiding any discrepancies that could lead to misunderstandings, misconfigurations, or even security gaps.
• Updating policies/procedures: Regularly updating policies and procedures to reflect changes is pivotal for maintaining a secure environment. Outdated documentation can result in employees following incorrect guidelines...

Version Control

Proper version control ensures that only authorized changes are implemented. It prevents unauthorized modifications and provides an audit trail, which is crucial for security. Unauthorized changes can introduce vulnerabilities, and without version control, it can be challenging to identify when and why such changes occurred. Version control is also important when writing code or developing applications so that the recent version can be identified.

Summary

In this chapter, we uncovered just how important a structured change management process is for changes to be implemented effectively. We discussed the role of the approval process in ensuring that any changes align with organizational policy, and we saw how impact analysis conducted before those changes enables organizations to anticipate potential security risks and the impact that proposed changes may have on users and the business.

The knowledge gained in this chapter will prepare you to answer any questions relating to Exam Objective 1.3 in your CompTIA Security+ certification exam.

The next chapter is Chapter 4, Explaining the importance of using appropriate cryptographic solutions.

Exam Objectives 1.3

Explain the importance of change management processes and the impact to security.

• Business processes impacting security operation:
  • Approval process: Having the project and budget authorized
  • Ownership: Someone who is responsible for a security task
• Stakeholders: People who own shares or invest money into the company
  • Impact analysis: Consider the implications of any change
  • Test results: Testing new security measures
  • Backout plan: Having a rollback option
  • Maintenance window: Where scheduled changes are implemented
  • Standard operating procedure: Rulebook on how to carry out tasks
• Technical implications:
  • Allow lists/deny lists: Allow or deny a user/device
  • Restricted activities: Activities that can cause harm
  • Downtime: Impacts a pause in activities
  • Service restart: Can cause disruption to a system
  • Application restart: Weakness that can emerge on restart
  • Legacy applications: Vulnerabilities on older applications no longer supported
  • Dependencies: Services, system drivers...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link.

1. What component of change management is essential for ensuring that security operations are not adversely affected by new implementations? Select the BEST option.
   1. Ownership
   2. Test results
   3. An approval process
   4. A backout plan
2. Which of the following is the BEST solution for a cybersecurity team to implement to prevent employees from installing video games on a company’s systems?
   1. Sandbox
   2. An allow list
   3. A block list
   4. Least privilege
3. When ensuring the accuracy of system representations, what practice is reflective of the actual network infrastructure?
   1. Regression testing
   2. Updating diagrams...