TyscorpaWhy Change Management Matters
Uncontrolled changes are a leading cause of security incidents. A misconfigured firewall rule, an unpatched server left in production, or a software update that breaks authentication — all of these are change management failures.
Change Advisory Board (CAB)
A cross-functional group that reviews and approves significant changes. Membership typically includes:
- IT security representative
- System owners affected by the change
- Operations and business stakeholders
Change Types
| Type | Description | Example |
|---|---|---|
| Standard | Pre-approved, low-risk, repeatable | Monthly patch deployment |
| Normal | Requires full CAB review; not pre-approved | Migrating a production database |
| Emergency | Urgent change to fix a critical issue; expedited approval | Zero-day patch rollout |
Change Process Steps
- Request: Document the proposed change, business justification, and risk
- Review: CAB evaluates impact, rollback plan, and resource needs
- Approval: Authorized stakeholders approve or deny
- Testing: Changes tested in non-production (dev/staging)
- Implementation: Applied during a scheduled maintenance window
- Documentation: Record what was changed, when, and by whom
- Review: Post-change review to confirm success and close the ticket
Technical Implications
- Allow/Deny Lists: Changes to allow/deny lists (firewall, application whitelisting) must be reviewed carefully — overly permissive rules introduce risk
- Downtime: Changes should minimize downtime; maintenance windows must be communicated
- Restarts: Some changes (kernel updates, config changes) require service/system restarts
- Dependencies: A change to one component may break another — dependency mapping is critical
- Version Control: All configuration files and code should be version-controlled (e.g., Git)
Documentation Requirements
- Runbook / Playbook: Step-by-step procedure for implementing and rolling back the change
- Rollback Plan: Clear steps to undo the change if something goes wrong
- Change Log: Immutable record of all changes made to a system
Exam Tip: Change management is a managerial + preventive control. Exam scenarios often describe a system failure after an update and ask what process failure allowed it. The answer is almost always inadequate change management (no testing, no rollback plan, no CAB approval).
Version Control
Version control systems (VCS) like Git track every modification to code and configuration files, providing:
- Audit trail of who changed what and when
- Ability to roll back to a known-good state
- Branching for testing changes before production deployment