Page 1414 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Configuration Status Accounting Formalized procedures are used
to keep track of all authorized changes that take place.

Configuration Audit A periodic configuration audit should be

conducted to ensure that the actual production environment is
consistent with the accounting records and that no unauthorized
configuration changes have taken place.

Together, change and configuration management techniques form an
important part of the software engineer’s arsenal and protect the
organization from development-related security issues.

The DevOps Approach

Recently, many technology professionals recognized a disconnect
between the major IT functions of software development, quality
assurance, and technology operations. These functions, typically
staffed with very different types of individuals and located in separate
organizational silos, often conflicted with each other. This conflict

resulted in lengthy delays in creating code, testing it, and deploying it
onto production systems. When problems arose, instead of working
together to cooperatively solve the issue, teams often “threw problems
over the fence” at each other, resulting in bureaucratic back-and-forth.

The DevOps approach seeks to resolve these issues by bringing the
three functions together in a single operational model. The word
DevOps is a combination of Development and Operations, symbolizing

that these functions must merge and cooperate to meet business
requirements. The model in Figure 20.6 illustrates the overlapping
nature of software development, quality assurance, and IT operations.