Information Security management

Configuration Management

Presenter: Samuel Wagema

 Definition: Security configuration management is a process
that involves adjusting the default settings of an information
system in order to increase security and mitigate risk.

 The purpose of Security configuration management is to

identify misconfigurations of a system’s default settings.

 Misconfigurations can lead to a host of problems, including

poor system performance, noncompliance, inconsistencies
and security vulnerabilities.
 Example
• In routers for example, manufacturers often set the
default configurations with predefined passwords or
pre-installed applications.

• Accepting easily exploitable default settings can make

it easy for attackers to gain unauthorized access to an
organization’s data and has the potential to cause
catastrophic data loss.
 Why its important to take care of security
configurations- Scenario
 Security misconfigurations are a major cause of security
breaches. In 2019, for example, nearly half (45%) of all
breaches were caused by errors attributed to
misconfigurations.

 The impact of these breaches can be expensive: Each breach

caused by a cloud misconfiguration costs organizations an
average of $4.4 million.

 (Ponemon Institute and IBM Report-2022).
 Phases of Security configuration management

1. Planning.

This step involves developing policies and procedures for

incorporating security configuration management into
existing IT and other security programs, then
disseminating this guidance throughout the organization.
• 2. Identifying and implementing configurations. Creating,
reviewing, approving and implementing a secure baseline
configuration for the system is critical.

• This approach may help address configuration settings,

software loads, patch levels, the physical or logical
arrangement of data, security control implementation and
documentation.
3. Controlling configuration changes.
 Organizations ensure that changes are formally analyzed for their impact
on security — and later tested and approved prior to implementation.
 Organizations may employ a variety of restrictions on making changes to
limit unauthorized or undocumented updates to the system.

4. Monitoring.
 This phase identifies previously undiscovered or undocumented system
components, misconfigurations, vulnerabilities and unauthorized changes
— all of which can expose organizations to increased risk.
 Automated tools help organizations to efficiently identify when the system
is not consistent with the approved baseline configuration and when
remediation actions are necessary.
 The vulnerability management lifecycle

 At the heart of any good cyber risk management strategy

lies vulnerability and configuration management.

 While details can vary, the vulnerability management

lifecycle broadly follows the following stages:
1.Discover what assets you have and what security
protocols are in place.

2. Assess what types of security and vulnerability

standards you want to evaluate against, and deploy tools
to figure out how to collect relevant information.

3. Prioritize to categorize the importance of items you

want to address and how soon they should be tackled.
4. Remediate to address vulnerabilities by
updating patches and changing security
configurations and policies.

5. Verify/reassess to close the loop by validating

that the changes you’ve made have conformed to
security policies.
 Techniques of improving vulnerability &
configuration management
1. Prioritization is key
 The exponential growth in enterprise endpoints makes it impossible to
fix all issues you might find straightaway. That makes effective
prioritization a key activity.

2. Focus on remediation
 Prompt remediation of vulnerabilities and configuration issues is
essential, as attackers act quickly and continue to get better at
exploiting security gaps once identified.
 Always perform frequent scans and have good situational awareness of
where these weak points are and fix them.
3. Track your remediation cadence over time
 Understanding both the speed and success of your remediation
program is a key to understanding the effectiveness of your
vulnerability and configuration management efforts.
 At the Verify phase, you not only need to validate whether the
required changes have been made but also evaluate metrics to your
performance.

4. Automate everywhere you can

 In an ideal world, you would automate the entire vulnerability and
configuration management lifecycle from Discover to Verify.
 This will reduce manual error and cyber risk, accelerate time-to-
remediation and free up staff to work on other tasks.
5. Start small to overcome resistance to change
 One of the biggest barriers to modernizing
vulnerability and configuration management
programs is people and culture.
 There may be staff members in your team who are
firmly against automatic remediations after having
accidentally caused a production outage in the past
through automated patching.
6. Everything starts with policy
 As important as technology is to enhancing vulnerability and
configuration management, let’s not forget the basics. It all begins
with drawing up the right policies and plans.

7. Scan continuously for holistic risk reduction

 Too often, organizations focus on meeting the bare minimum of
compliance requirements without seeing the bigger picture — that
effective vulnerability and configuration management is
fundamentally good for business.
 It’s important, therefore, to ensure endpoint scans are not carried
out simply to check the right regulatory boxes but as part of a
holistic risk management strategy.
•Thanks for participating and Listening