Fundamentals of Information Systems Security, 4th Edition

Configuration Management

One constant you can always depend on in information system environments is change, because it is unusual for any component in a networked computer environment to remain unchanged for a long period. Organizations commonly modify the hardware, software, firmware, documentation, test plans, and test documentation of automated systems throughout the SLC. Because uncontrolled configuration changes often result in conflicts and even new security vulnerabilities, it’s important that all configuration changes occur only within a controlled process, which is called configuration management.

From the perspective of a security professional, configuration management evaluates the impact a modification might have on security. Will ...