Have you ever tried to fill a colander with water? Of course not, that would be ridiculous given that it’s full of holes. So why would you try to implement a security program without ensuring that whatever you fix does not get broken behind you?
Do you give your IT administrators permission to change the setting on your personal phone? Again, of course not, so why would you allow them to make significant changes to corporate assets without proper oversight?
While these analogies are flippant and geared toward emphasising my point, I would not be writing this blog if the issue of change control was not an enormously important one. At best, poor change control can cause additional unnecessary work, at worst you could be out of business. It’s bad enough that bad guys want to break in, most organisations I have seen are making it easier for them from the inside.
The definition of change control is; “…a systematic approach to managing all changes made to a product or system.“, and it’s purpose is “…to ensure that no unnecessary changes are made, that all changes are documented, that services are not unnecessarily disrupted and that resources are used efficiently.” Sounds fair, right? No disruption? Efficient? Are these not good things?
The biggest issue is that change control requires not only planning, but extra effort. You have to fill out a form, send an email, or log into a GUI of some sort, all of which may take longer than making the change in the first place. Change control is time-consuming and can be seen as a bottleneck, both of which are no-nos in the rapid evolution towards more and more function. But what would you rather have; 1) an insecure service quickly, or 2) a secure service a very short time later?
Unfortunately, given that change control is a primary function of governance, few organisations have the oversight to implement change control well. so how can organisation perform this most critical of processes?
First, it has to be appropriate. There is little point in a 5 person company buying a change control software, but larger organisations should not be using email and spreadsheets. As long as the right people are involved in making the change decisions, this process can be as formal or informal as is sustainable. If this is ever seen as a burden, it will be either circumvented, or ignored altogether.
Often overlooked, but critical to change control success, are a few pre-requisites…
Change Control Pre-Requisites:
- Ensure that the asset register contains not only physical devices, but applications, CotS software, data stores, location, unique skill-sets etc.
- Assign business criticality and maximum data classification to all assets;
- Assign ownership to all assets;
- Map all assets to the business processes they support (note: these maps becomes assets in and of themselves); and
- Ensure that the change request form includes a list of the affected assets.
Change Control Form:
Every change request must, at a minimum, include these things.
- List of affected systems;
- Details related to affected users (if applicable);
- Criticality of change request;
- Indication of additional risk;
- Success criteria / test plan;
- Back-out or fix-forward plan; and
- Appropriate authorisation.
By mapping the affected asset to their corresponding business processes, their owners, and both their criticality and maximum data classification, you can automatically bring the right decision maker to bear to authorise the change.
Too often the business owners have little to no insight to technology changes, when in reality, they are the only ones who should be authorising the change. IT and IS are, and have always been, business enablers, nothing more. First and foremost, change control need to reflect the goals of the business. In the absence of governance, the above minimums are about the only way to see that this happens.
Of course, if you also link change control to your ticketing system and incident response processes you would have the Holy Grail, but baby steps…
[If you liked this article, please share! Want more like it, subscribe!]