Page 1158 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide
P. 1158
Managing Change
Deploying systems in a secure state is a good start. However, it’s also
important to ensure that systems retain that same level of security.
Change management helps reduce unanticipated outages caused by
unauthorized changes.
The primary goal of change management is to ensure that changes do
not cause outages. Change management processes ensure that
appropriate personnel review and approve changes before
implementation, and ensure that personnel test and document the
changes.
Changes often create unintended side effects that can cause outages.
An administrator can make a change to one system to resolve a
problem but unknowingly cause a problem in other systems. Consider
Figure 16.3. The web server is accessible from the internet and
accesses the database on the internal network. Administrators have
configured appropriate ports on Firewall 1 to allow internet traffic to
the web server and appropriate ports on Firewall 2 to allow the web
server to access the database server.
FIGURE 16.3 Web server and database server
A well-meaning firewall administrator may see an unrecognized open
port on Firewall 2 and decide to close it in the interest of security.
Unfortunately, the web server needs this port open to communicate
with the database server, so when the port is closed, the web server
