Access your Pro+ Content below.
Integrated change management reduces security risks
This article is part of the November 2009 issue of Information Security magazine
Networks and data centers are in constant flux. In large organizations, it's rare for a day to go by where we don't need to provision new servers or users, upgrade critical systems, patch databases, change firewall rules or update Web applications. But while change is a natural and necessary part of network growth, unmanaged change can quickly lead to chaos that exposes critical data and resources to attack. To prevent exposure, change management systems and procedures are implemented to help companies ensure that policies and approvals are met before a change to the system is implemented. But simply putting a change management process in place is not sufficient. As Pete Lindstrom, research director of Spire Security explains, "If you are creating a change management process because you don't want anything to change, you are missing the point." Rigid, poorly implemented change management processes can be perceived as gating factors covered in red tape that slow growth and impede work. Done correctly, change management integrates...
Features in this issue
Spam, phishing and infected attachments continue to plague messaging platforms, despite sophisticated protection. What's the answer?
Rapid7's acquisition of the Metasploit Project takes down one of the few remaining open source security projects. But expect a smooth transition; there have been many success stories and mistakes made to learn from.
Enterprises can no longer differentiate between insiders and external threats. That's such a 2003 paradigm.
Unmanaged changes to IT systems and networks can recklessly increase risk to enterprises. The key is rolling out an accepted change management process, and sticking to it.
Columns in this issue
Safeguarding your organization against a H1N1 outbreak should be a top priority.
Security experts Bruce Schneier and Marcus Ranum debate the longterm viability of antivirus software.
The checklist approach to security is easy, but the result is poor security.