Auditing and Logging of Changes
Change management and control must first decide at what level of granularity will the elements of the system be defined, enumerated, managed, and controlled.
6 slides · 2 min read · Domain 8
This establishes the set of configuration items (or Cls) which are formally subjected to CM decision-making and CC enforcement and audit. This whole process fundamentally depends upon other systems security processes to zealously prevent tampering with the contents of a Cl.
A software Cl, for example, must be identifiable in a unique way, and that identifier is linked to the version control processes used during systems integration and delivery. Enumeration of the system should thus reveal the precise Cls and their version identification that are part of the environment being enumerated.
Without this level of specificity and granularity, enumeration loses its ability to produce audit-worthy findings.
Configuration Management Terms:
M.M.
Configuration Identification
Setting and maintaining the information system Configuration Items (CI) that are divided into four categories: hardware, software, interfaces and documentation. The Cls comprise the baseline and the System Owner determines the level of granularity deemed necessary for tracking and reporting.
Configuration Control
An important function of configuration management, its purpose is to ensure all changes to the baseline of an information system are performed with the knowledge, evaluation and consent of management
Configuration Status Accounting
Configuration Status Accounting is the process of recording and reporting configuration item descriptions (e.g. hardware, software, firmware, etc.) and all changes made since the baseline was established. In the event of a suspected problem, the verification of the baseline configuration and approved changes can be quickly determined.
Configuration Audit
An assessment (internal audit) is a systematic process of collecting and analyzing artifacts and activities to determine the current, historical, or projected status of a system. Through a physical viewing and evaluation of these artifacts, along with the aid of checklists, interviews, and observation, audit team will provide the System Owner with an insight into areas of improvement for CM processes and procedures documented in CM Plans.
Configuration control traditionally depends on the creation and use of change logs; these may be driven by file systems and other applications logs kept by the operating system(s), by CM/CC system agents, or other means. Audits would then step through the change logs to see if the results of all the logged changes matched the current systems enumerated baseline.