1.3-1.4 Flashcards
change approval process
need clear policies on making changes.
typical change process
- complete request
- determine purpose of change
- identify scope of the change
- schedule date and time
- determine impact of change
- analyze risk associated with the change
7.get approval from change control board - get end user acceptance after change is complete
ownership in change management
the owner is the person who manages the process. receives process updates. does not perform change
stakeholders
whoever is affected by the change.
will want input on change mgmt process
impact analysis of change
determine risk value(high, medium,low)
risk of not making change (vulnerability, downtime)
how to test results
sand box testing environment. test change before deploying.
backout plan
always have a way to revert your changes
(SOP)
standard operating procedure outlines the way that things need to happen(ex: change mgmt process). A living document, constantly being updated or changing.
technical change mgmt
putting the change mgmt process into action
allow/deny list
allow is strict can ONLY run apps on list
deny is not can run any app EXCEPT the ones on deny list
restricted activities during change management process
since you got approved for a change u can make ONLY that change and nothing else. If additional things need to be changed during that change you refer to the change mgmt process for those steps.
legacy apps
apps that no longer have patch support, create specific processes and procedures for them
dependencies
to complete A you must complete B
documentation
have to constantly update diagrams and policies/procedures
version control
track changes to a file or configuration data over time
public key vs private key
anyone can have public key and send data to you with that. only you can decrypt it with your private key. also known as asymmetric encryption
symmetric encryption
a single shared key, not scalable because if stolen they can encrypt and decrypt all ur data.
key escrow
someone else holds our private keys
encryption full disk/parition
full disk is entire storage. Partition is a specific set of data on that storage.
EFS
Encrypting File System, method used to encrypt files
volume
a mounted partition.example: Windows does this automatically by assigning a drive letter to the partition, like “C drive, D drive, etc”
database encryption
protecting stored data
transparent- encrypt all database info with a symmetric key
record level encryption
encrypt individual columns
use separate symmetric keys for each column
transport encryption
protect data traversing network using vpn.
encryption algorithms
many ways to encrypt data. we know the algorithms but dont know the keys. both sides decide on the algorithm before encrypting.
key lengths
longer are more secure.
symmetric 128 bit or larger
asymmetric 3072 bit or larger
key stretching
make a weak key strong by hashing the passwords, then hashing that hash and so on..
key exchange
out of band- dont send key over the net.
in band- on the network, put additional encryption, deliver it with an asymmetric encryption
session key
encryption and decryption key that is randomly generated to ensure the security of a communications session.
needs to be constantly updated so it doesnt get compromised
