Instructor: Asset and change management. 2 2
In this lesson, we're going to focus 3 3
on asset and change management, 4 4
and why this is important to the security of your networks. 5 5
Now, if you're like most people, 6 6
you might go, "Jason, why does asset and change management 7 7
affect the security of my networks? 8 8
After all, that's something 9 9
that those service management folks do. 10 10
I'm an information security, I'm a cybersecurity person. 11 11
I don't have to worry about that." 12 12
Well, it is really important for us 13 13
to know what is on our network 14 14
because if we don't know what's on our network, 15 15
how are we going to defend it? 16 16
And that's why asset and change management 17 17
is so important to us. 18 18
So we're going to briefly talk about these two topics. 19 19
We're going to talk about asset tagging 20 20
and we're going to talk about change management. 21 21
When I talk about asset tags, what are those? 22 22
Well, if you've ever worked in a large corporate network, 23 23
you've probably seen an asset tag. 24 24
This is the practice of assigning an ID to an asset, 25 25
and then associating that ID 26 26
with those entries inside an inventory database. 27 27
This way, I can know how many computers I have, 28 28
how many mins I have, how many desktops I have, 29 29
how many servers I have, 30 30
and they're all tracked in a database. 31 31
So if you go up to your computer at work 32 32
and you look under, 33 33
there might be a barcode and it just says Asset ID. 34 34
Now, this can be something that can be a barcode 35 35
that can be scanned, 36 36
or it can be something like a radio frequency ID tag 37 37
that's attached to the device. 38 38
Either way is acceptable. 39 39
It just depends on how your organization wants to do it. 40 40
Either of these methods will work, 41 41
and it just gives you a way to inventory those assets. 42 42
Because if I have a computer 43 43
and I downloaded a bunch of information to it, 44 44
and now that computer is missing, 45 45
that's an issue. 46 46
And that's really an inventory issue, 47 47
but it could have cybersecurity effects to us, 48 48
because somebody can now access that data 49 49
or use that lost laptop to connect to our network. 50 50
And so we want to make sure 51 51
we're tracking all of our things. 52 52
Now, when we have these asset tags, 53 53
they're going to correlate with the asset records 54 54
for that particular thing. 55 55
So if I have a laptop, 56 56
it might contain things like vendor documentation, 57 57
configuration information, and warranty information 58 58
for that asset. 59 59
And that's why these things are so important 60 60
and so helpful to us. 61 61
Now, we want to take it a step further though 62 62
because just knowing what is out there 63 63
and owned by the organization isn't enough. 64 64
We also want to make sure we control that information 65 65
and we control what those assets look like 66 66
and how they're configured. 67 67
And that's when we get into change management. 68 68
Now, change management is the process 69 69
through which changes to the configuration 70 70
of information systems are monitored and controlled 71 71
as part of your organization's 72 72
overall configuration management efforts. 73 73
Now, this is important because as you have a device 74 74
and you have a new laptop and you've scanned it in, 75 75
and you've tagged it, and you've put it on the network, 76 76
you now know what that state is. 77 77
That is the initial state of it. 78 78
But over time, we're going to change the status of that device 79 79
because we're going to install new software, 80 80
we're going to change configurations, 81 81
we're going to install patches and things like that. 82 82
And all of that needs to be documented. 83 83
Each individual component should have a separate document 84 84
or a database record that describes its initial state 85 85
and all of those subsequent changes. 86 86
This way, we know exactly 87 87
what any asset on the network looks like 88 88
and how it's properly configured. 89 89
Now, as you start looking at this information 90 90
in change management, what are we going to really focus on? 91 91
Well, we're going to focus 92 92
on a lot of different pieces of information, 93 93
including the configuration information, 94 94
the patches that are installed, 95 95
the backup records for that asset, 96 96
and any incident reports or issues 97 97
that may have been reported. 98 98
Because again, that could all be information that we can use 99 99
as part of our investigation 100 100
and to know the state of that particular asset. 101 101
Change management is going to ensure 102 102
that all of the changes that we do 103 103
are planned and controlled. 104 104
We do this because it helps us minimize risk 105 105
of causing a service disruption. 106 106
So if I know that this particular server 107 107
has two power supplies in it 108 108
and one of them has failed three months ago 109 109
and this server is four years old, what does that tell me? 110 110
It's possible that we might need to change 111 111
and replace that other power supply 112 112
because it could fail too. 113 113
And so we can keep track of this stuff 114 114
as part of our asset management and our change management. 115 115
In addition to that, anytime we want to do a change, 116 116
we need to schedule that change. 117 117
And that's why change management 118 118
helps us get the approvals we need. 119 119
Now, if we're going to deal with a change, 120 120
they have to be categorized in some way. 121 121
And normally, they're going to be categorized 122 122
according to the potential impact 123 123
and level of risk they could cause. 124 124
We have changes that are major changes, 125 125
or significant changes, or minor changes, 126 126
or even normal changes. 127 127
And based on which of these categories it is, 128 128
it's going to require a different level of approval. 129 129
For instance, if it's a normal change or a minor change, 130 130
you might just do that through a supervisory approval. 131 131
If you're going to do something 132 132
that's a significant or major change, 133 133
it might need to go higher up in the organization. 134 134
Now, how do you request a change? 135 135
Well, we have this thing called an RFC. 136 136
An RFC is a request for change. 137 137
Now, an RFC is essentially just a document, 138 138
and this document is going to list the reason for a change 139 139
and the procedures to implement that change. 140 140
So if I want to install Windows 2016 141 141
on this old Windows 2012 server, 142 142
I'm going to list that we need to do it 143 143
because 2012 is now end of life 144 144
and we want to move to something newer. 145 145
So we're going to move to Windows 2016 146 146
or even something newer than that. 147 147
We'll tell that's the reason for the change. 148 148
Then what are the procedures to implement that change? 149 149
Well, here are the 15 steps that we're going to take, 150 150
and this is the amount of downtime we're going to need, 151 151
and here's our plan that if something goes wrong, 152 152
how we're going to roll back. 153 153
And all of those things will be incorporated 154 154
into this request for change. 155 155
Now, again, if it's a small change, 156 156
that might be a normal or a minor change, 157 157
those can be approved 158 158
at very low levels in the organization. 159 159
But when you get up to a major or a significant change, 160 160
these are going to require approval 161 161
from your Change Advisory Board, known as the CAB. 162 162
Now, a Change Advisory Board 163 163
is essentially a group of leaders in the organization 164 164
that have the technical and management know-how 165 165
to look at these changes 166 166
and decide when they're going to occur, based on the schedule, 167 167
and if they should occur, based on the risk. 168 168
Now, the risk isn't just cybersecurity though, 169 169
the risk is also business. 170 170
And so we have to weigh the business impact 171 171
versus the risk to the systems. 172 172
And based on that, we'll determine when 173 173
and if those changes will get approved. 174 174
Now, this is all part of change management, 175 175
and that's what we're talking about here 176 176
because all of these things have to be coordinated. 177 177
When we have a change, 178 178
we want to engage with our stakeholders. 179 179
We want to talk with them and say, 180 180
"Why do you need this change?" 181 181
And see if there's a good reason for it. 182 182
If they have a good change reason, 183 183
then we're going to plan for that change. 184 184
We're going to make sure we're improving 185 185
that change process over time 186 186
to make it faster and more resilient. 187 187
We're also going to make sure we have the right team on board, 188 188
and we're going to execute those changes in a methodical way. 189 189
And as we do that, we're going to measure all of that. 190 190
Why? 191 191
Because we want to make sure 192 192
we're meeting the goals that we set out. 193 193
If we said this change 194 194
was going to take five minutes to implement 195 195
and it took us five hours, we need to know that 196 196
because that's going to affect our planning 197 197
for future iterations. 198 198
And so change management is crucial for us 199 199
to be able to have good security in our network. 200 200
Now, anytime you're going to submit a change like an RFC, 201 201
you need to accompany that 202 202
with a rollback or remediation plan. 203 203
Now, what are these? 204 204
Well, this says that if something goes wrong, 205 205
can we go back to the way we were 206 206
and get back to the old good state? 207 207
Because we know before we made the change, 208 208
things were working fine. 209 209
And so if I went and tried to upgrade something 210 210
or install a patch and it broke something, 211 211
can I roll back to the pre-patched state? 212 212
I can do that. 213 213
That means we can then get there, 214 214
think about how we're going to fix this problem, 215 215
and then we can move forward with the change again 216 216
during the next window. 217 217
Now, that brings another idea up, 218 218
which is called a maintenance window. 219 219
Now, many networks have scheduled maintenance windows 220 220
and they use these for authorized downtime. 221 221
So most companies will have something 222 222
that looks like a Saturday night window, 223 223
from midnight to 4:00 AM, 224 224
because most companies are closed on Saturdays, right? 225 225
And so if you're closed, 226 226
you're not going to affect the business 227 227
if you shut down that network. 228 228
So they'll use that as a maintenance window. 229 229
And that's the time that you're going to schedule 230 230
all of the changes that need to be done. 231 231
Now, this is great for the business folks, 232 232
but it kind of stinks for us IT folks, 233 233
'cause a lot of us end up having to work overnight shifts 234 234
to be as part of these maintenance windows. 235 235
But again, that's just part of the job. 236 236
So when you have these maintenance windows, 237 237
there's might be four hours that we know we have 238 238
that we can have downtime. 239 239
So part of the CAB's job is to schedule 240 240
what changes will happen during that four-hour window. 241 241
And that's why knowing how long something's going to take 242 242
is really important as well. 243 243
Now, for the exam, let me give you a couple of quick tips. 244 244
You need to think through how you might install a patch 245 245
or other type of change, 246 246
and this comes down to change management. 247 247
For example, if there's a brand new critical vulnerability 248 248
that just came out today at 11:00 AM, 249 249
are you going to cause a disruption to the network 250 250
if you stop everything and install it right now? 251 251
Or are you going to stop and analyze 252 252
the risk to your business and your network, 253 253
and then decide, "Hey, we should wait 254 254
for an emergency maintenance window, 255 255
that we might be able to get approved 256 256
for tonight at nine o'clock." 257 257
Or do you say, "You know what? Forget it. 258 258
We'll just wait till Saturday 259 259
for our regularly scheduled maintenance window." 260 260
Now, all three of these may be the right answer. 261 261
It really does depend though, 262 262
because this is all about risk management. 263 263
In general though, if you're dealing with a critical risk, 264 264
you're going to want to get that fixed sooner, 265 265
but you also don't want to cause business interruption. 266 266
So you're going to have to get approval 267 267
for something like a special emergency window. 268 268
Now, that's actually going to be probably the best plan here. 269 269
Why? 270 270
Because that's going to give you today to plan the change, 271 271
to get everybody on board, to get the team members together, 272 272
to have a rollback plan in case something goes wrong, 273 273
and even test that patch 274 274
in a staging or test environment first. 275 275
Then when people come in 276 276
for the emergency maintenance window, 277 277
we know we have the patch, we know it works, 278 278
and we know what our rollback plan is. 279 279
So that is balancing the risk versus reward. 280 280
Now, for the exam, 281 281
I always want you to think about measuring risk. 282 282
Don't jump to conclusions and immediately patch things 283 283
just because a critical patch was available from the vendor. 284 284
You have to weigh the benefits of a more secure network now 285 285
versus the loss of productivity that you might face 286 286
if you take down the network to patch it. 287 287
And so by balancing that and going, "You know what? 288 288
it's already 11 o'clock. 289 289
I can afford to wait till nine o'clock at night. 290 290
And in the meantime, 291 291
we're going to set up some additional monitoring 292 292
and we're going to make sure we're protecting the network 293 293
and see if anybody's trying to exploit 294 294
this particular vulnerability. 295 295
Then at nine o'clock when everybody's gone home, 296 296
that's a good time for us to take down the network, 297 297
run those patches, and bring it back up." 298 298
So these are the kind of things you have to think through. 299 299
It's not just clear cut and dry of, 300 300
"There's a critical vulnerability, let's patch it." 301 301
That's not always the right answer. 302 302
So keep that in mind for the exam 303 303
because these are the type of things 304 304
I see students get tripped up on on the exam 305 305
and lose points.