CoreQ Academy1.3 Explain the importance of change management processes and the impact to security.
Many outages and breaches start with an unreviewed change: a firewall rule opened "temporarily", a patch pushed without testing, an undocumented service. Change management makes every change deliberate, reviewed, reversible and recorded.
Business processes impacting security operations
- Approval process
- A formal review, often by a change advisory board (CAB), before a change is made. Prevents risky or unnecessary changes.
- Ownership
- A named person is accountable for the change and its outcome.
- Stakeholders
- Everyone affected by the change (application owners, users, security, support) is identified and consulted.
- Impact analysis
- Assessing what could break, what risk is introduced and who is affected before approving.
- Test results
- Evidence that the change was tested in a non-production environment and behaved as expected.
- Backout plan
- A documented, tested way to roll back if the change fails.
- Maintenance window
- An agreed time with low business impact when changes are allowed.
- Standard operating procedure
- Step-by-step instructions for routine changes so they are done the same safe way every time.
Technical implications
- Allow lists/deny lists
- Changes may require updating which applications, IPs or ports are allowed or blocked; forgetting this breaks the change or opens a hole.
- Restricted activities
- Some actions are limited to certain roles or windows (for example production database changes).
- Downtime
- Planned unavailability must be scheduled and communicated.
- Service restart
- Many changes need a service restart, which can interrupt users and must be planned.
- Application restart
- Restarting an application can drop sessions or lose in-memory state.
- Legacy applications
- Older apps may be fragile, poorly documented or impossible to test fully, so changes carry extra risk.
- Dependencies
- Services that rely on each other; changing one can break another. Map them before changing.
Documentation
- Updating diagrams
- Network and data-flow diagrams must reflect the change so future responders are not misled.
- Updating policies/procedures
- If the change alters how something is done, the written process must match.
Version control
- Version control
- Tracking every revision of code, configuration and documentation (for example with Git) so you know what changed, who changed it, and can roll back.
An engineer applies an urgent firewall change at 2 p.m. without a ticket. A payment service fails because it depended on the blocked port. Which change-management elements were skipped?
Show answer
Approval, impact analysis (dependency mapping), maintenance window, testing and a backout plan. Documentation was also not updated.
Check your understanding
- Which consideration addresses the fact that changing one service can break another?
- Version control is only relevant for application source code.
- Put these change steps in a sensible order.
- Test in non-production
- Implement in maintenance window
- Approval
- Request and impact analysis
- Update documentation
- Which are technical implications of a change? (choose all)
- What should exist before a change is made so it can be reversed if it fails?
Original CoreQ Academy material, mapped to objective 1.3 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.