Management

00:01

Hey, guys, Welcome to another episode of the S S C P Exam prep series. I'm your host, Peter Simple in

00:08

This is the seventh lesson in the second. Do me

00:12

so far in the second don't mean we've looked at the code of ethics, which is the standard behavior for all practitioners the C I A triangle, which is the foundation of cybersecurity.

00:23

We're thinking a look at security architectures,

00:27

which is a framework for building security within systems and look how to control that architecture through managerial, operational and technical controls.

00:37

We've looked at system security plans which are detailed documents describing security into given system.

00:43

And we've looked at how to build systems securely through secure development.

00:47

We've looked at how secure development reduces system vulnerabilities and we looked at how to manage, encrypt and dispose off data and secure proper manner. We've also looked at data of leakage preventive strategy.

01:03

Finally, in the second demean in this lesson, we will take a look at management the process off

01:11

doing different steps and how to do them properly and security awareness and training. How the more aware you are to a particular security situation, the better off you and your organization will be.

01:23

Let's get started.

01:26

Management is the process of controlling actions of a system.

01:32

There are four main different types of management which will be looking at here. These are very important aspects of the system and it's very, very important that each one goose right and smooth

01:45

the same way every single time.

01:48

The most important kinds of management are released management, which is the release of software from the testing environment to the production

01:57

change control management, which determines whether or not controls are still effective and, if not updates the controls so that they are effective

02:06

configuration management.

02:07

This is the management of configuring software release changes from one version to another.

02:15

The last one is patch management, which is the process off handling vulnerabilities by downloading a patch and applying it to your system. For more security.

02:27

Management is implemented through the use of policies and procedures off which need to be updated regularly.

02:35

Let's take a closer look at release management

02:38

released management controls, the release of applications, updates and patches to the production and barb.

02:45

This seems to ensure timeliness goals, minimize disruption and issue all proper documentation.

02:52

The way. The Ruiz management worse is that it starts out in the testing environment.

02:58

Once of release is been configured and put together properly. It is then tested. It is tested to make sure that there are no problems, that all bugs have been found and just to make sure that it does not interfere with any other systems in production.

03:17

Once that has been tested, it is now ready for user acceptance. Certain users will get a special version off the release immediately to ensure that it's worth well to ensure that all of the requirements have been there and that it satisfies the problem.

03:37

Once that has been

03:38

accomplished, it is then packaged up.

03:42

Once it is packaged, it is released to the production environment, where it takes over and replaces the old system.

03:51

Change controlled management.

03:53

So talk about change control management. We need talk about system insurance.

03:58

System assurance is the process of validating that existing controls are functioning as expected.

04:06

If they are not, then change control comes into play. Change control is the form procedures

04:14

that are adopted by an organization to ensure all changes are subject to the appropriate level of management control

04:21

What this does is that once

04:25

controls are determined to be unsatisfactory, change control happens, which will then update the controls to make them satisfactory. Once again,

04:35

change control management seeks to eliminate unauthorized changes and any type of defects if a hacker or someone breaks into the system makes him authorize changes. Change control management will handle that.

04:48

If, for whatever reason, security controls are out of date because he system grows and expands, then change control Management can update the security controls to best help. This is the

05:02

These are the steps for change controlled management process.

05:06

The first step is request submission.

05:10

Once a problem has been noticed,

05:12

our request for change has been submitted.

05:15

Next step is the recording step. All the details are the recording are written down and so they're all in one central location.

05:25

After that,

05:26

the details of this change are analyzed.

05:30

They are looked at. They are decided, you know, How will this help or hurt the current system or the way it is now?

05:38

Once that want once that is done,

05:41

a decision is determined

05:43

based on all the information. Ah, yes or no is given

05:46

if the approval is through, then the change is granted.

05:51

Once the change is done, the changes tracked through completion to ensure that the request has been fulfilled and that the problem has been solved.

06:01

There's different operational aspects of the change management process. Now. These are not necessarily official steps in the change man can commit process, but rather these air different things which should be examined and looked at different things that the S s C P practitioner should be aware of.

06:20

The first, obviously is request

06:23

requests are proposed to a change committee or a group of people who decide the change.

06:30

After that, the impact has been assessed. The committee members talk amongst themselves and to determine how this will help or hurt thesis acuity system

06:41

and they give an approval or disapproval. So the committee comes together and they most likely take a boot

06:47

and that will determine whether or not the change goes through or not.

06:51

Once the change goes through, it needs to be built and tested

06:57

once it had built and tested.

06:59

All security impact assessment risks are determined. This is important step for the SS CP practitioner and that it is their responsibility to ensure that all the security risks

07:12

are handled or mitigated in such a way that is not a detriment to the system.

07:17

Once the impact assessment has been done, system used users are notified that a change is coming

07:26

once they have been notified. The change comes out and little steps the changes not all pushed into the production environment at once, but in a little steps in case there is a bug. Or if a part of the change doesn't work well with the current system configuration

07:44

after the change has been implemented, it is then validated. Does the change that has been pushed into production

07:51

fulfill the issue that I'll be that originally started the request?

07:58

If that is true, then dot and step goes to documentation.

08:01

Documentation is the written form a log of the outcome of the system change?

08:09

Who's involved in the change mansion process? Well, there's a lot of people involved. Actually, the first and foremost is the change manager.

08:16

This is the man who is in charge of updating all of the policies and procedure off change management.

08:24

Next is the change control port. This is the group of people who are responsible for approving or disapproving system changes. This is usually upper management.

08:37

Next is the project manager. This is the man who

08:41

is responsible for the change itself. He manages the budget. The resource is sets at the tasks and find the people who can implement the change.

08:50

People who could, in people who can implement the change. Our architects which build

08:58

thesis a curettage context and design, and then the engineers and security analysts who develop, build and test all of the system changes.

09:07

Once this is done, the change goes back to the customer or whoever is in charge of the system, and they approved the functional changes

09:16

that are about to be implemented.

09:20

But as person involved in the change controlled management process is the system security officer,

09:26

this man is insurers that changes do not have security impacts to the present level of security off the cyst.

09:35

In today's lecture, we looked at two different kinds of man released management, which is the process of releasing a new software into the production system

09:43

and change management how to update the controls of a security system when the controls are no longer effect.

09:54

With time,

09:56

the process of validating that existing security controls are configured and functioning as expected, both during initial implementation and on an ongoing basis are a system assurance

10:09

the validation.

10:11

See

10:11

verification

10:13

or D change management.

10:18

If you pick a, then you weren't correct. Remember, system assurance is the process that determines whether or not security controls are still effective.