Configuration Management (CM) has some key controls and processes concentrated in the middle of the SDLC where configuration settings and the configuration baseline are recorded, but the entire process has small pieces spread throughout the SDLC which must be considered.
Configuration management actually begins with the recording of inventory as new objects are brought into the organization. Inventory, at first glance may seem trivial to security, but many organizations struggle with keeping their inventory process dynamically updated and accurate. Many other processes that come later in the SDLC will depend for their accuracy on how well the inventory was done and how accurately it is maintained. These include:
- System characterization and boundary definition
- System categorization
- Impact assessment
- Risk assessment
- Patching
- Authorization
- Continuous monitoring
As security controls are implemented, it becomes necessary to adjust and document configuration settings to make sure the controls are working properly. Eventually, all the standard settings need to be collected into a configuration baseline.
In the continuous monitoring process, a lot of key elements of the information system and related controls are monitored. The results of this monitoring, when it detects any configuration changes must be fed into the configuration change control process. This process is designed to monitor and handle change, whether the change is planned or unplanned and simply detected by monitoring. The change control process involves the following steps:
- Monitoring for change
- Evaluating the change impact
- Make a decision (approve, deny, defer)
- Take action
- Notification
- Implementation
- Documentation
At the end of the SDLC, it may become important to pay attention to protecting configuration information as equipment reaches the end of life and is discarded. In any case, configuration management gets involved again as asset management/inventory needs to be updated when equipment is retired.
Here’s a simplified plan to use a configuration management process to lock down your key network components:
- Know everything on your network – having a good inventory is prerequisite to everything else. If you don’t know what’s on your network, you can’t defend it or fix it. If you don’t know what state it’s in, you can’t protect it. Automate the discovery process and updating of inventory where practical. Consider using 802.1X ethernet port control protocol to control what devices are allowed on your network.
- Use a standard configuration for your key components
- Select a securable configuration of hardware and software (consider not using Windows in key areas like the perimeter).
- Select secure configuration settings for each component – turn off all services and ports that are not being used and make sure those that are necessary are hardened.
- Collect your configurations in a baseline and apply it consistently. Consider using automation techniques such as imaging or cloning.
- Use a change control process
- Restrict access that allows change
- Set up a Change Control Board (CCB) that reviews and authorizes changes to be made.
- Perform an analysis of the impact on security that each change can create.
- When authorized, implement the changes in a standardized way and document the whole process.
- Monitor your infrastructure constantly – scan for devices, scan for ports and services, use intrusion detection monitoring to check network traffic, correlate all this information to create situational awareness reports that can pinpoint anomalies. Automate as much of this as possible.
- Monitor for security effectiveness – get reports from your security protection mechanisms that show how well they are working.
- Monitor for vulnerabilities – use a variety of scanning on a regular basis to check for weaknesses.
- Monitor for changes to configurations
- Use a Patch Management process to fix vulnerabilities.
- Use an Incident Response process to react to events.