In this section of the course,
we're going to be focused on asset and change management.
Now, asset management refers to the systematic process
of developing, operating, maintaining, and selling assets
in a cost-effective manner.
Now, change management, on the other hand,
is a structured approach to transitioning individuals,
teams, and organizations from a current state
to a desired future state.
Now, in cybersecurity, asset management
and change management are two of the critical pillars
that are used to safeguard
an organization's data and infrastructure.
Asset management is going to ensure
that all of our digital assets,
ranging from hardware devices to software applications,
have been identified, cataloged, and monitored,
and therefore this helps us
to reduce potential vulnerabilities
and to ensure that the security protocols
are consistently being applied across all of our assets.
Meanwhile, change management is used to guarantee
that any modifications to our systems,
whether they're to software updates
or to new technology implementations,
are being done in a controlled and secure manner,
and this prevents unforeseen security gaps
or misconfigurations from occurring.
Together, these practices provide us
with a structured framework to prevent, detect,
and respond to cyber threats
to ensure that an organization's digital resources
remain secure amidst an evolving threat landscape.
Now, in this section of the course,
we're going to be focused on Domain 1 and Domain 4,
and we'll specifically be looking at objectives 1.3,
4.1, and 4.2.
Objective 1.3 states that you must be able
to explain the importance of change management processes
and the impact to security.
Objective 4.1 states that given a scenario,
you must be able to apply common security techniques
to computing resources,
and Objective 4.2 states that you must be able
to explain security implications of proper hardware,
software, and data asset management.
Now, as we begin this section, we're going to start out
by covering the concepts of acquisition and procurement.
Now, acquisition and procurement in cybersecurity
involve the structured process of sourcing, vetting,
and obtaining security technologies and services
to bolster organizations' defenses against cyber threats.
Next, we're going to cover the concepts
of mobile asset deployments,
including BYOD, COPE, CYOD, and other deployment models
that are pivotal to cybersecurity,
as they determine how personal and company owned devices
will be managed and integrated
within your organization's networks
to ensure that the most suitable model
is being chosen based on your business's unique needs
and desired security posture.
Then, we're going to dive into the asset management world.
We're going to be talking about assignment and accounting
and monitoring and asset tracking inside of cybersecurity,
and how it revolves around a clear definition of ownership
and classification of each asset.
This will help us to ensure a rigorous system
of monitoring of our assets
is occurring through inventory checks, enumeration,
and leveraging tools like MDM
or mobile device management solutions in order to maintain
an organized and secure digital environment.
After that, we'll discuss asset disposal
and decommissioning.
This includes things like sanitization, destruction,
certification, and data retention policies
that will all play vital roles in ensuring that our assets,
that can range from data to hardware,
are all safely discarded or repurposed
at the end of their useful life
in order to minimize the risk of unauthorized access
or data breaches from occurring.
Next, we're going to focus on change management,
and we're going to be talking about the importance
of change management in cybersecurity
because this simply cannot be overstated.
Every change, whether it's a minor or major change,
should undergo a strict approval process
while considering a lot of different aspects,
including the change advisory board's insights,
the ownership of the change,
the stakeholder involvement of the change,
and a thorough impact analysis for the proposed change.
Then, we'll explore the intricate details
of the change management processes.
In the constantly evolving realm of cybersecurity,
it is imperative to schedule maintenance windows,
possess a well-thought-out backup plan,
and consistently test results
after implementing your changes.
This will ensure that all of your changes
are aligned with the standard operating procedures
while maintain the integrity and security of your systems.
After that, we're going to dive
into the technical implications of changes,
and it's essential to be aware of and to manage elements
like allow lists and deny lists,
understanding the nuances of restricted activities,
managing downtime efficiently,
and handling service or application restarts.
In addition to all of that, we also need to consider
the complexities of legacy applications
and their dependencies in order to be able
to avoid potential vulnerabilities
or system clashes that may occur.
Next, we'll address the importance of documenting changes.
Now, in the world of cybersecurity,
version controlling all of your changes
through documentation is considered a non-negotiable thing.
This involves regularly updating your diagrams,
revising your policies and procedures
if a change doesn't yield the desired result
that you expected, and updating change requests
or trouble tickets post-implementation,
as well as ensuring transparency and accountability
throughout the entire process.
Finally, we're going to take a short quiz
to see what you learned during this section of the course
and review each of those quiz questions fully
to ensure you can explain why each answer was right.
Now, let's jump into our coverage
of asset and change management
in this section of the course.