General Security Concepts part 2 Flashcards
Change management
Making sure changes to software or applications are completed properly.
- Upgrade software
-Patch an application
-Change firewall configuration
-Modify switch ports
Change approval process
- Complete the request forms
-Determine the purpose of the change
-Identify the scope of the change.
-Schedule a date and time of the change
-Determine affected systems and the impact
-Analyse the risk associated with the change
-Get approval from the change control board
-Get end-user acceptance after the change is complete
What is the role of an owner in the change control process.
Own the process
Don’t perform the change
Process updates are provided to the owner as they oversee/manage the process.
IT team handles the change
Importance of Stakeholders in the chance control process
Who will be impacted by the change
Might not be so obvious
Change control Impact Analysis
Determine a risk value
Fixes can potentially break something else
Operating system failures
Data corruptions
Risk of NOT making the change (Security vulnerability)
How can you rest the results of a change
Test before implementing change.
Sandbox testing environment (Technological safe space)
Sandbox we can load a duplicate of the software and try the upgrade, apply the patch, test and confirm before deployment.
Back out plan
Ability to revert your changes back to a configuration which was proven to have worked in the past.
Some changes are difficult to revert. Need good backups and ideas of how to revert back to original configuration.
Maintenance window (change control)
When is the change happening?
Potential downtime would affect a large part of production
Challenging for 24-hour productions schedules.
Technical Change management examples:
Change to allow/deny list
Allow list (Nothing runs unless it has been approved - very restrictive)
Deny list (Nothing on the deny list can be executed (Anti-virus, Anti-malware)
Downtime
Services will eventually be unavailable
-The change process can be disruptive
-Usually scheduled during non-production hours
-If Possible, prevent any downtime
Restarts
Some changes require physical restarts
Services - stop and restart the service
Application - close the application completely. Launch a new application instance.
Legacy Application (old)
Legacy applications run for very long time. No longer supported by the developer. Hard to make changes to to these systems.
Become the expert in this system as may not be as complicated as you may think
Dependancies
A service will not start without other active services.
Modifying one component may require changing or restarting other components
Dependencies may occur across systems.
Documentation
it can be challenging to keep up with changes. Documents required with the change management process
Updating diagrams (Modification to network configurations,
Version control
Track changes to a file or configuration date over time
Public Key Infrastructure
Policies, procedures, hardware, software responsible for creating distributing, managing, storing and revoking digital certificates.
Symmetric encryption
A single, shared key which is used for encryption and decryption. (A shared secret)
This does not scale very well.
Very fast to use, has less overhead than asymmetric encryption. Often combined with asymmetric encryption
Asymmetric Encryption
Two keys are mathematically related. One is the private key and one is the public key.
The private key is the only key that can decrypt data encrypted with the public key.
You cannot derive the publc key from the private key and vise versa. (Cannot reverse engineer)
