1
00:00:06,570 --> 00:00:07,770
- In lesson 3.1,

2
00:00:07,770 --> 00:00:11,010
we're gonna focus in on
configuration management.

3
00:00:11,010 --> 00:00:14,670
And I hope to stress to
you the absolute importance

4
00:00:14,670 --> 00:00:16,950
of configuration management.

5
00:00:16,950 --> 00:00:18,060
A configuration management

6
00:00:18,060 --> 00:00:20,370
that you'll sometimes
see abbreviated as CM

7
00:00:20,370 --> 00:00:22,800
is a set of practices designed to ensure

8
00:00:22,800 --> 00:00:26,670
that configuration items,
by items we just mean items

9
00:00:26,670 --> 00:00:30,360
like our servers or our
routers, or our software,

10
00:00:30,360 --> 00:00:32,940
are deployed in a consistent state

11
00:00:32,940 --> 00:00:35,880
and stay that way
throughout their lifetime.

12
00:00:35,880 --> 00:00:38,280
In other words, we set them up,

13
00:00:38,280 --> 00:00:39,690
we know that they're working

14
00:00:39,690 --> 00:00:41,940
and we can trust that
they're always working

15
00:00:41,940 --> 00:00:43,563
the way we set them up.

16
00:00:45,660 --> 00:00:47,880
Now the goal of configuration management

17
00:00:47,880 --> 00:00:51,390
is absolutely to minimize risk.

18
00:00:51,390 --> 00:00:53,310
Configuration management is a form

19
00:00:53,310 --> 00:00:56,010
of IT service management that ensures

20
00:00:56,010 --> 00:01:00,090
that the configuration of
resources are always known,

21
00:01:00,090 --> 00:01:03,693
always good and can always be trusted.

22
00:01:05,730 --> 00:01:06,930
Now there are two primary

23
00:01:06,930 --> 00:01:08,910
configuration management elements.

24
00:01:08,910 --> 00:01:11,640
The first is a CI or configuration item.

25
00:01:11,640 --> 00:01:15,480
And that's an aggregation of
information system components

26
00:01:15,480 --> 00:01:17,760
that are treated as a single entity

27
00:01:17,760 --> 00:01:20,430
throughout the configuration
management process.

28
00:01:20,430 --> 00:01:22,440
So perhaps it's your domain controllers,

29
00:01:22,440 --> 00:01:24,240
perhaps it is your smartphones,

30
00:01:24,240 --> 00:01:26,040
perhaps it is your routers,

31
00:01:26,040 --> 00:01:28,770
perhaps it's your database servers.

32
00:01:28,770 --> 00:01:31,740
And then a baseline configuration.

33
00:01:31,740 --> 00:01:35,820
A baseline configuration or
BC is a set of specifications

34
00:01:35,820 --> 00:01:38,220
for that particular configuration item.

35
00:01:38,220 --> 00:01:42,150
How that item is going to be configured.

36
00:01:42,150 --> 00:01:46,800
Now those specifications are
researched, they're reviewed,

37
00:01:46,800 --> 00:01:50,790
they're agreed upon, and
then they can only be changed

38
00:01:50,790 --> 00:01:52,590
through the change management process.

39
00:01:52,590 --> 00:01:54,420
And we'll talk about the
change management process

40
00:01:54,420 --> 00:01:57,060
and change management
procedures in our next lesson.

41
00:01:57,060 --> 00:01:59,820
And once that baseline is established,

42
00:01:59,820 --> 00:02:03,450
it is used as a basis for all
future builds and releases.

43
00:02:03,450 --> 00:02:04,590
And that's really important,

44
00:02:04,590 --> 00:02:06,450
because let's say a server fails,

45
00:02:06,450 --> 00:02:07,920
it has to be rebuilt, right?

46
00:02:07,920 --> 00:02:10,260
We wanna make sure that
when it's rebuilt, right,

47
00:02:10,260 --> 00:02:13,200
it is rebuilt to this particular baseline,

48
00:02:13,200 --> 00:02:14,520
that someone's just not rebuilding it.

49
00:02:14,520 --> 00:02:15,570
Ah, I think it should have this

50
00:02:15,570 --> 00:02:16,890
I think it should have that, right?

51
00:02:16,890 --> 00:02:19,230
We don't wanna rely on
institutional knowledge.

52
00:02:19,230 --> 00:02:20,430
We don't wanna rely on the fact

53
00:02:20,430 --> 00:02:22,650
that someone says I think
I know how to do it.

54
00:02:22,650 --> 00:02:26,250
We wanna have the standard
baseline configurations,

55
00:02:26,250 --> 00:02:30,090
again, that have been researched,
reviewed, and agreed upon,

56
00:02:30,090 --> 00:02:33,933
and are only changed through
the change control procedures.

57
00:02:36,540 --> 00:02:37,590
So what does a configuration

58
00:02:37,590 --> 00:02:38,850
management workflow look like?

59
00:02:38,850 --> 00:02:41,000
Well, first, we're
defining our objectives.

60
00:02:41,970 --> 00:02:43,740
So what is it that we need to configure

61
00:02:43,740 --> 00:02:44,970
is really part of our objectives.

62
00:02:44,970 --> 00:02:46,420
Then we're gonna do research.

63
00:02:47,310 --> 00:02:49,470
We will then propose a configuration.

64
00:02:49,470 --> 00:02:50,970
So that's most of our job, right?

65
00:02:50,970 --> 00:02:52,470
We do the research and we propose,

66
00:02:52,470 --> 00:02:54,720
we say based on best practices

67
00:02:54,720 --> 00:02:58,170
or recommendations from
highly regarded sources,

68
00:02:58,170 --> 00:03:00,813
this is the configuration
that we are proposing.

69
00:03:02,070 --> 00:03:03,450
It will then be reviewed.

70
00:03:03,450 --> 00:03:06,390
Generally, there'll be a
committee that will review it.

71
00:03:06,390 --> 00:03:07,770
It will be approved.

72
00:03:07,770 --> 00:03:09,780
Again, that's often the responsibility

73
00:03:09,780 --> 00:03:12,693
of somebody in management
or a management committee.

74
00:03:13,530 --> 00:03:14,910
It will then be published,

75
00:03:14,910 --> 00:03:17,100
and if there have been multiple versions

76
00:03:17,100 --> 00:03:18,900
of that configuration, we'll make sure

77
00:03:18,900 --> 00:03:21,840
we have good version or version control.

78
00:03:21,840 --> 00:03:23,500
It will then be implemented

79
00:03:25,110 --> 00:03:27,240
and then it will be controlled.

80
00:03:27,240 --> 00:03:29,340
In this case, when we're
using the word control,

81
00:03:29,340 --> 00:03:30,690
we're not talking about a control

82
00:03:30,690 --> 00:03:32,250
like we've been talking
about in the other lessons.

83
00:03:32,250 --> 00:03:36,480
We're talking about that we manage it,

84
00:03:36,480 --> 00:03:38,163
that we say, okay, this
is what we're using,

85
00:03:38,163 --> 00:03:40,050
that it can't be changed

86
00:03:40,050 --> 00:03:42,750
unless we go through the
change control procedures.

87
00:03:42,750 --> 00:03:44,100
We have control over it.

88
00:03:44,100 --> 00:03:45,900
It's a better way to think about it.

89
00:03:46,800 --> 00:03:48,300
And then we'll monitor it, right?

90
00:03:48,300 --> 00:03:49,470
We wanna make sure that this

91
00:03:49,470 --> 00:03:51,360
is still the right configuration,

92
00:03:51,360 --> 00:03:52,680
because things change over time.

93
00:03:52,680 --> 00:03:55,350
And if there needs to be any changes

94
00:03:55,350 --> 00:03:57,330
in the the baseline configuration,

95
00:03:57,330 --> 00:03:58,320
well, then we're gonna go right

96
00:03:58,320 --> 00:03:59,940
through this process again.

97
00:03:59,940 --> 00:04:02,070
Are those, you know, changes necessary?

98
00:04:02,070 --> 00:04:03,330
We'll research, we'll propose,

99
00:04:03,330 --> 00:04:04,530
we'll review, we'll approve,

100
00:04:04,530 --> 00:04:06,783
we'll republish, we'll re-implement.

101
00:04:09,990 --> 00:04:11,970
Automated provisioning, which is really

102
00:04:11,970 --> 00:04:13,980
the wave of the future, is the ability

103
00:04:13,980 --> 00:04:16,440
to deploy information technology, IT

104
00:04:16,440 --> 00:04:19,140
or operational technology, OT systems

105
00:04:19,140 --> 00:04:23,460
and services using predefined,
automated procedures

106
00:04:23,460 --> 00:04:25,890
without requiring human intervention.

107
00:04:25,890 --> 00:04:27,270
And multiple times in this course,

108
00:04:27,270 --> 00:04:29,610
we're gonna come back to
this idea of automation

109
00:04:29,610 --> 00:04:32,043
and all of the benefits of automation.

110
00:04:33,030 --> 00:04:34,980
Now in this case, automation is used

111
00:04:34,980 --> 00:04:37,020
to ensure consistency in provisioning

112
00:04:37,020 --> 00:04:39,390
in the support of configuration management

113
00:04:39,390 --> 00:04:41,250
with the goal that automation will reduce

114
00:04:41,250 --> 00:04:45,063
or eliminate manual
dependencies and human error.

115
00:04:46,950 --> 00:04:49,170
So here are some provisioning processes

116
00:04:49,170 --> 00:04:52,440
that really tie in with
configuration management

117
00:04:52,440 --> 00:04:55,050
and with automation that
you wanna be familiar with.

118
00:04:55,050 --> 00:04:59,070
Demand-generated resource
allocation, idempotence,

119
00:04:59,070 --> 00:05:01,230
immutable systems or immutability,

120
00:05:01,230 --> 00:05:03,183
and infrastructure as code.

121
00:05:04,260 --> 00:05:06,150
Demand-generated resource allocation

122
00:05:06,150 --> 00:05:07,920
is just the automatic provisioning

123
00:05:07,920 --> 00:05:12,060
and de-provisioning of our
resources based upon demand.

124
00:05:12,060 --> 00:05:13,470
Now, of course, we're
gonna wanna make sure

125
00:05:13,470 --> 00:05:16,260
that we're always using
our baseline configurations

126
00:05:16,260 --> 00:05:18,183
when we're doing this provisioning.

127
00:05:19,590 --> 00:05:22,860
Idempotence is a principle
that says every time

128
00:05:22,860 --> 00:05:25,680
an automated configuration script is run,

129
00:05:25,680 --> 00:05:29,010
the same exact result should be produced.

130
00:05:29,010 --> 00:05:31,020
So we can depend on that script, right?

131
00:05:31,020 --> 00:05:33,030
That script is trustworthy and the systems

132
00:05:33,030 --> 00:05:35,673
that were produced are
trustworthy as well.

133
00:05:38,160 --> 00:05:41,220
Another principle is the
principle of immutability.

134
00:05:41,220 --> 00:05:42,840
Immutability is a principle

135
00:05:42,840 --> 00:05:45,780
that resources should not be changed,

136
00:05:45,780 --> 00:05:47,670
only created and destroyed.

137
00:05:47,670 --> 00:05:49,500
So instead of trying to fix something,

138
00:05:49,500 --> 00:05:51,840
we have a corruption
maybe in our database,

139
00:05:51,840 --> 00:05:55,050
or there's, you know, a problem
in a configuration file,

140
00:05:55,050 --> 00:05:57,000
in our domain controller.

141
00:05:57,000 --> 00:05:58,680
Instead of trying to fix it,

142
00:05:58,680 --> 00:06:01,650
what we're gonna do is
we're just gonna recreate.

143
00:06:01,650 --> 00:06:04,980
So we create or destroy,
but we don't try to fix.

144
00:06:04,980 --> 00:06:09,840
So it utilizes automation
to replace rather than fix.

145
00:06:09,840 --> 00:06:12,720
Again, because we know what
once we've replaced it,

146
00:06:12,720 --> 00:06:16,470
with that clean copy based on
our baseline configuration,

147
00:06:16,470 --> 00:06:19,680
that system will have be
approved and trustworthy.

148
00:06:19,680 --> 00:06:22,380
And then lastly, we have
infrastructure as code.

149
00:06:22,380 --> 00:06:24,360
Now, infrastructure as code is using code

150
00:06:24,360 --> 00:06:25,890
to manage configurations

151
00:06:25,890 --> 00:06:28,860
and to automate the provisioning
of the infrastructure.

152
00:06:28,860 --> 00:06:32,550
And that really supports the
principle of idempotence.

153
00:06:32,550 --> 00:06:35,640
Again, that every time a
configuration script is run,

154
00:06:35,640 --> 00:06:38,013
the same exact result should be produced.

155
00:06:39,540 --> 00:06:41,880
And that brings us to the end
of configuration management

156
00:06:41,880 --> 00:06:44,490
and to the start of our
three-second challenge.

157
00:06:44,490 --> 00:06:45,323
You ready?

158
00:06:45,323 --> 00:06:46,950
Five challenge questions,
three seconds each.

159
00:06:46,950 --> 00:06:47,783
Let's do it.

160
00:06:49,290 --> 00:06:51,660
An aggregation of
information system components

161
00:06:51,660 --> 00:06:54,330
treated as a single entity.

162
00:06:54,330 --> 00:06:56,643
One, two, three.

163
00:06:57,900 --> 00:06:59,763
That's a configuration item or a CI.

164
00:07:01,230 --> 00:07:03,630
Question two, agreed upon specification

165
00:07:03,630 --> 00:07:06,720
for a configuration item or a CI.

166
00:07:06,720 --> 00:07:09,690
One, two, three.

167
00:07:09,690 --> 00:07:12,903
That's gonna be our baseline
configuration or our BC.

168
00:07:14,190 --> 00:07:17,940
Question three, ability
to deploy IT or OT systems

169
00:07:17,940 --> 00:07:20,673
without requiring human intervention.

170
00:07:22,530 --> 00:07:24,780
One word, starts with the letter A.

171
00:07:24,780 --> 00:07:26,970
One, two, three.

172
00:07:26,970 --> 00:07:28,830
At the automated or automation,

173
00:07:28,830 --> 00:07:31,413
or actually two words here,
automated provisioning.

174
00:07:34,230 --> 00:07:36,840
Question four, the
principle that every time

175
00:07:36,840 --> 00:07:39,420
an automated configuration script is run

176
00:07:39,420 --> 00:07:43,203
the same exact results will be produced.

177
00:07:44,700 --> 00:07:46,653
One, two, three.

178
00:07:47,820 --> 00:07:49,143
That's idempotence.

179
00:07:51,510 --> 00:07:53,550
And lastly, number five.

180
00:07:53,550 --> 00:07:56,550
This is the principle that
resources should not be changed,

181
00:07:56,550 --> 00:07:58,620
only created and destroyed.

182
00:07:58,620 --> 00:08:00,210
In this case, we use automation

183
00:08:00,210 --> 00:08:02,760
to replace rather than fix.

184
00:08:02,760 --> 00:08:04,803
One, two, three.

185
00:08:05,880 --> 00:08:07,290
And that's immutability.

186
00:08:07,290 --> 00:08:09,690
Or sometimes you'll say
it as immutable systems.

187
00:08:11,160 --> 00:08:11,993
All right, that brings us

188
00:08:11,993 --> 00:08:14,070
to our security in action case study.

189
00:08:14,070 --> 00:08:15,990
This one's on configuration management

190
00:08:15,990 --> 00:08:17,100
and we're doing these case studies,

191
00:08:17,100 --> 00:08:19,230
so you can practically
apply your knowledge.

192
00:08:19,230 --> 00:08:20,610
We'll go through the case study together.

193
00:08:20,610 --> 00:08:21,780
I'll ask you a question.

194
00:08:21,780 --> 00:08:23,460
Great time to put me on pause

195
00:08:23,460 --> 00:08:25,110
while you jot down some answers.

196
00:08:25,110 --> 00:08:25,980
Then you'll come back

197
00:08:25,980 --> 00:08:28,740
and we'll talk through
the case study together.

198
00:08:28,740 --> 00:08:30,840
Your organization is rapidly growing,

199
00:08:30,840 --> 00:08:33,810
both organically and through acquisition.

200
00:08:33,810 --> 00:08:36,120
You're concerned that unmanaged growth

201
00:08:36,120 --> 00:08:39,090
will result in security
issues, and you're proposing

202
00:08:39,090 --> 00:08:42,120
the implementation of a
configuration management program

203
00:08:42,120 --> 00:08:43,533
supported by automation.

204
00:08:44,790 --> 00:08:46,050
Well, the IT manager,

205
00:08:46,050 --> 00:08:49,170
who I guess is probably maybe
a little skeptical of this,

206
00:08:49,170 --> 00:08:51,240
has asked you to come to
a departmental meeting

207
00:08:51,240 --> 00:08:56,240
to present to his or her
team why this is important.

208
00:08:56,400 --> 00:08:58,770
So what are you gonna tell them, right?

209
00:08:58,770 --> 00:09:01,140
So you're growing a
lot both by acquisition

210
00:09:01,140 --> 00:09:03,390
and organically, you're really concerned

211
00:09:03,390 --> 00:09:05,460
that all this growth, things
are gonna get out of control.

212
00:09:05,460 --> 00:09:06,840
We're gonna have security issues.

213
00:09:06,840 --> 00:09:08,130
And you say, you know what?

214
00:09:08,130 --> 00:09:09,660
It's really time that we have

215
00:09:09,660 --> 00:09:11,880
a good configuration management program

216
00:09:11,880 --> 00:09:14,823
and that we support it with automation.

217
00:09:16,050 --> 00:09:17,580
Now you're in security.

218
00:09:17,580 --> 00:09:20,070
It's really the IT folks who
are building all these systems,

219
00:09:20,070 --> 00:09:21,240
who are doing the provisioning.

220
00:09:21,240 --> 00:09:22,080
And they're saying, all right,

221
00:09:22,080 --> 00:09:24,600
well, come to one of our
meetings and convince us.

222
00:09:24,600 --> 00:09:26,400
Tell us why it's important.

223
00:09:26,400 --> 00:09:28,980
So my question to you is,
what are you gonna tell 'em?

224
00:09:28,980 --> 00:09:30,270
Great time to put me on pause.

225
00:09:30,270 --> 00:09:32,270
Think through this, jot down some notes.

226
00:09:33,630 --> 00:09:36,030
Well, here might be in your presentation.

227
00:09:36,030 --> 00:09:39,240
Configuration management ensures
that systems are deployed

228
00:09:39,240 --> 00:09:42,750
and maintained in a consistent state.

229
00:09:42,750 --> 00:09:45,600
I always think of this as sort
of making order out of chaos.

230
00:09:45,600 --> 00:09:49,260
I always know how my systems
are going to be configured.

231
00:09:49,260 --> 00:09:51,570
I'm not depending upon
institutional knowledge

232
00:09:51,570 --> 00:09:53,730
or what a vendor might come in and do.

233
00:09:53,730 --> 00:09:56,373
I know how they're set up all the time.

234
00:09:57,900 --> 00:09:59,190
Now, automated provisioning

235
00:09:59,190 --> 00:10:01,410
supports configuration management

236
00:10:01,410 --> 00:10:04,290
by using predefined automated procedures

237
00:10:04,290 --> 00:10:07,413
to ensure consistent configurations.

238
00:10:09,870 --> 00:10:12,900
And you really wanna stress
that configuration management

239
00:10:12,900 --> 00:10:16,020
will ultimately make IT's job easier.

240
00:10:16,020 --> 00:10:17,640
It'll make supporting many systems

241
00:10:17,640 --> 00:10:21,090
and devices easier and
more efficient, right?

242
00:10:21,090 --> 00:10:23,160
Because they're all set up the same way

243
00:10:23,160 --> 00:10:25,080
and it will reduce their workload.

244
00:10:25,080 --> 00:10:27,780
The many times when we
use the term automation,

245
00:10:27,780 --> 00:10:30,450
folks get really nervous
about losing their jobs.

246
00:10:30,450 --> 00:10:32,640
And when I always talk about

247
00:10:32,640 --> 00:10:35,490
when I talk to folks who
are nervous about automation

248
00:10:35,490 --> 00:10:37,980
is it's not about losing your job,

249
00:10:37,980 --> 00:10:40,380
it's about being able to use yourself,

250
00:10:40,380 --> 00:10:42,150
your own resources better,

251
00:10:42,150 --> 00:10:44,820
that you can apply your
human intelligence, right?

252
00:10:44,820 --> 00:10:46,290
Your decision making, right?

253
00:10:46,290 --> 00:10:47,220
Your thought process,

254
00:10:47,220 --> 00:10:49,560
the things that really need that opposed

255
00:10:49,560 --> 00:10:51,660
to some of these more rote tasks

256
00:10:51,660 --> 00:10:53,670
that can easily be automated.

257
00:10:53,670 --> 00:10:56,760
So having this conversation
with the IT team,

258
00:10:56,760 --> 00:10:58,950
helping them understand why
configuration management

259
00:10:58,950 --> 00:11:01,440
is so essential, so important
for an organization,

260
00:11:01,440 --> 00:11:03,960
and what the benefits are of automation.

261
00:11:03,960 --> 00:11:07,920
That my friends is
security in action, right?

262
00:11:07,920 --> 00:11:09,180
Brings you to a word cloud.

263
00:11:09,180 --> 00:11:10,950
There's a lot here, okay?

264
00:11:10,950 --> 00:11:13,080
Make sure that you understand everything

265
00:11:13,080 --> 00:11:14,160
that's on here, right?

266
00:11:14,160 --> 00:11:16,050
Don't move on until you can say,

267
00:11:16,050 --> 00:11:20,160
okay, yeah, I can speak to
each one of those items.

268
00:11:20,160 --> 00:11:22,230
If you can't, go back into the lesson.

269
00:11:22,230 --> 00:11:24,510
When we're covering all of
this, go back into the lesson,

270
00:11:24,510 --> 00:11:25,890
learn a little bit more about it,

271
00:11:25,890 --> 00:11:28,170
come back to your word
cloud, speak it again.

272
00:11:28,170 --> 00:11:30,060
And then when you're ready,
move on to the next lesson

273
00:11:30,060 --> 00:11:32,060
and I'll be waiting for you right there.