4.2 - Change Management

Question 1

Change management

Answer 1

• How to make a change
  – Upgrade software, patch an application, change firewall
  configuration, modify switch ports
• One of the most common risks in the enterprise
  – Occurs very frequently
• Often overlooked or ignored
  – Did you feel that bite?
• Have clear policies
  – Frequency, duration, installation process, rollback
  procedures
• Sometimes extremely difficult to implement
  – It’s hard to change corporate culture

Question 2

Rollback plan

Answer 2

• The change will work perfectly and nothing will ever go bad
  – Of course it will
• You should always have a way to revert your changes
  – Prepare for the worst, hope for the best
• This isn’t as easy as it sounds
  – Some changes are difficult to revert
• Always have backups

Question 3

Sandbox testing

Answer 3

• Isolated testing environment
  – No connection to the real world or production system
  – A technological safe space
• Use before making a change to production
  – Try the upgrade, apply the patch
  – Test and confirm before deployment
• Confirm the rollback plan
  – Move everything back to the original
  – A sandbox can’t consider every possibility

Question 4

Responsible staff members

Answer 4

• A team effort - Many different parts of the organization
• IT team - Implements the change
• Business customer - The user of the technology or software
• Organization sponsor
  – Someone’s budget is responsible for the process
  – Or responsible for the profit

Question 5

Change management process

Answer 5

• A formal process for managing change
  – Avoid downtime, confusion, and mistakes
• Nothing changes without the process
  – Complete the request forms
  – Determine the purpose of the change
  – Identify the scope of the change
  – Schedule a date and time of the change
  – Determine affected systems and the impact
  – Analyze the risk associated with the change
  – Get approval from the change control board
  – Get end-user acceptance after the change is
  complete

Question 6

Change request forms

Answer 6

• A formal process always seems to include a bit of
  paperwork
  – This is usually an online system
• Nothing gets missed
  – Easy to manage
  – Create detailed reports and statistics
• Usually a transparent process
  – Many different groups and people are usually

Question 7

Purpose of the change

Answer 7

• Why are we doing this?
  – There needs to be a compelling reason
• Application upgrades
  – New features
  – Bug fixes
  – Performance enhancements
• Security fixes
  – Monthly patches and vulnerability fixes
• There needs to be a good reason
  – Changes are costly

Question 8

Scope of the change

Answer 8

• Determine the effect of the change
  – May be limited to a single server
  – Or an entire site
• A single change can be far reaching
  – Multiple applications, Internet connectivity,
  remote site access, external customer access
• How long will this take?
  – Specific date and time for the change
  – May have no impact, could have hours of downtime

Question 9

Risk analysis

Answer 9

• Determine a risk value - i.e., high, medium, low
• The risks can be minor or far-reaching
  – The “fix” doesn’t actually fix anything
  – The fix breaks something else
  – Operating system failures
  – Data corruption
• What’s the risk with NOT making the change?
  – Security or application vulnerability
  – Unexpected downtime to other services

Question 10

Change board and approvals

Answer 10

• Go or no go
  – Lots of discussion
• All important parts of the organization are represented
  – Potential changes can affect the entire company
• Some changes have priority
  – The change board makes the schedule
  – Some changes happen quickly, some take time
• This is the last step
  – The actual work comes next

Question 11

End-user acceptance

Answer 11

• Nothing happens without a sign-off
  – The end users of the application / network
• One of your jobs is to make them successful
  – They ultimately decide if a change is worth it to them
• Ideally, this is a formality
  – Of course, they have been involved
  throughout this entire process
  – There’s constant communication before and after