CompTIA Security+ Preparation · lesson 4 of 45 · 25 min
Change Management in Security
Change management controls how modifications are made to IT systems to prevent unauthorized changes and minimize security risk. Security+ tests both the process and the security implications.
Change Advisory Board (CAB) — reviews and approves change requests. Ensures changes are tested, documented, and scheduled appropriately.
Change request components: description of change, reason/business justification, risk assessment, rollback plan, test plan, implementation steps, change window.
Change types: Standard (pre-approved, low-risk, routine), Normal (requires CAB approval), Emergency (urgent, expedited approval process).
Security implications of poor change management: unauthorized changes can introduce vulnerabilities, disable security controls, or create backdoors. Change management provides an audit trail.
Configuration Management
Configuration management tracks and controls the configuration of IT systems throughout their lifecycle. Key concepts:
Configuration baseline — documented, approved configuration for a system type. All new systems are built to the baseline. Changes require formal approval.
Configuration Management Database (CMDB) — repository of configuration items (CIs) and their relationships. Supports change management, incident response, and asset tracking.
Version control — tracks changes to code and configuration files over time. Enables rollback. Git is the most common tool.
Infrastructure as Code (IaC) — managing infrastructure through code (Terraform, Ansible, CloudFormation). Enables consistent, repeatable deployments and version-controlled infrastructure.
Patch management — systematic process for testing and deploying security patches. Critical for vulnerability management. Includes: inventory → identify patches → test → deploy → verify → document.
Security+ Exam Tip
Change management and configuration management are tested in Domain 4 (Security Operations). Know the difference: change management controls WHEN and HOW changes are made; configuration management tracks WHAT the current state IS.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Security+ — Change & Configuration Management
The Change Advisory Board (CAB) is responsible for:
- Writing security policies
- Reviewing and approving change requests
- Responding to security incidents
- Managing user accounts
- Answer: Reviewing and approving change requests
The CAB reviews proposed changes, assesses risk, and approves or defers them to appropriate change windows. An emergency change differs from a normal change because:
- It does not require documentation
- It has an expedited approval process due to urgency
- It does not require a rollback plan
- It is approved by a single person
- Answer: It has an expedited approval process due to urgency
Emergency changes still require documentation and a rollback plan — they just have a faster approval path due to urgency. A CMDB tracks:
- Security incidents
- Configuration items and their relationships
- User authentication events
- Network traffic
- Answer: Configuration items and their relationships
The CMDB is the authoritative source for configuration items (hardware, software, services) and how they relate to each other.
Poor change management is a leading cause of network outages.
- True
- False
Answer: True
Studies show ~80% of outages are caused by changes. Formal change management with testing and rollback plans dramatically reduces this.
Patch management is primarily used to address:
- User training gaps
- Security vulnerabilities in software
- Network performance issues
- Physical security weaknesses
- Answer: Security vulnerabilities in software
Patch management deploys security patches to fix known vulnerabilities — a critical component of vulnerability management.
Infrastructure as Code (IaC) provides which security benefit?
- Faster network speeds
- Consistent, version-controlled, auditable infrastructure deployments
- Automatic vulnerability scanning
- Real-time threat detection
Answer: Consistent, version-controlled, auditable infrastructure deployments
IaC enables repeatable, consistent deployments with full version history — changes are tracked, reviewed, and auditable.
A configuration baseline is:
- A list of all security incidents
- The documented, approved configuration for a system type
- A network performance benchmark
- A backup of all system data
- Answer: The documented, approved configuration for a system type
Baselines define the standard configuration — all new systems are built to it, and deviations require formal approval.
Which change type is pre-approved and low-risk?
- Normal change
- Emergency change
- Standard change
- Major change
Answer: Standard change
Standard changes are pre-approved, well-understood, low-risk, and routine — they do not require individual CAB approval each time.
Version control in configuration management enables:
- Faster network speeds
- Rollback to previous configurations
- Automatic patch deployment
- User access management
- Answer: Rollback to previous configurations
Version control tracks all changes over time — if a change causes problems, you can roll back to the last known-good configuration.
Which is NOT a required component of a change request?
- Risk assessment
- Rollback plan
- Vendor invoice
- Implementation steps
Answer: Vendor invoice
Change requests require risk assessment, rollback plan, implementation steps, test plan, and business justification — not financial documents.
Configuration management differs from change management in that: Configuration management is optional Configuration management tracks current state; change management controls how changes are made
- Change management tracks current state
- They are identical processes
Answer: Configuration management tracks current state; change management controls how changes are made Config management = what is the current state? Change management = how do we safely modify that state?
The patch management process includes: inventory → identify patches → test → deploy → verify → _____.
Answer: document
Documentation is the final step — record what was patched, when, and the result. Supports audits and compliance.
Previous lesson: Security policies, standards, procedures, and guidelines
Back to CompTIA Security+ Preparation
Next lesson: Cryptography concepts: symmetric, asymmetric, hashing