5.1 Describe management concepts

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

🔷 What is Configuration Management?

Configuration Management (CM) is the process of maintaining, controlling, and tracking system settings and configurations in an IT environment.

A configuration is how a system is set up, including:

Operating system settings
Installed software and versions
Network settings
Security policies
System roles and permissions

👉 In simple terms:
Configuration management ensures that systems are set up correctly and stay consistent over time.

🔷 Why Configuration Management is Important

Configuration management is critical for cybersecurity and operations because it helps:

1. Maintain Consistency

All systems follow the same approved configuration (baseline)
Prevents unexpected behavior

2. Improve Security

Ensures secure settings (e.g., disabling unused services)
Reduces attack surface

3. Detect Unauthorized Changes

Alerts when configurations are modified
Helps identify possible attacks or misconfigurations

4. Simplify Troubleshooting

Known configurations make it easier to identify problems

5. Support Compliance

Meets organizational and regulatory security standards

🔷 Key Components of Configuration Management

1. Configuration Items (CIs)

A Configuration Item (CI) is any component that needs to be managed.

Examples in IT:

Servers
Network devices (routers, switches)
Applications
Databases
Virtual machines
Security tools

👉 Each CI has:

Unique identifier
Configuration details
Version information

2. Configuration Baseline

A baseline is a standard, approved configuration.

It defines:

Secure settings
Required software versions
Approved services

👉 Example:

A server baseline may require:
- Specific OS version
- Firewall enabled
- Certain ports closed

⚠️ Systems should always match the baseline unless officially changed.

3. Change Management (Connected Concept)

Configuration management works closely with change management.

Change management ensures:

Changes are approved before implementation
Changes are documented
Risks are analyzed

👉 Example:

Installing a new application must go through approval before changing the configuration.

4. Version Control

Tracks changes made to configurations over time.

It allows:

Viewing previous configurations
Rolling back to earlier versions
Tracking who made changes

👉 Important for:

Incident response
Auditing
Troubleshooting

5. Configuration Monitoring

Continuously checks systems for changes.

It helps:

Detect unauthorized modifications
Ensure compliance with baseline
Alert administrators of changes

6. Configuration Documentation

All configurations must be documented clearly.

Documentation includes:

System setup details
Installed software
Network configurations
Security settings

👉 This ensures:

Easy understanding
Faster recovery
Better communication among teams

🔷 Configuration Management Process

Step 1: Identify Configuration Items

List all systems and components
Assign unique identifiers

Step 2: Define Baselines

Create standard configurations
Apply security best practices

Step 3: Implement Configurations

Set up systems according to baseline

Step 4: Monitor and Control Changes

Track any configuration changes
Detect unauthorized changes

Step 5: Record and Report

Document all changes
Maintain logs for auditing

🔷 Configuration Management in Security (Very Important for Exam)

Configuration management plays a major role in cybersecurity operations:

1. Prevents Misconfigurations

Misconfigured systems are a major cause of security breaches

2. Supports Incident Detection

Unexpected configuration changes may indicate compromise

3. Helps in Incident Response

Known baseline helps identify what changed during an attack

4. Reduces Vulnerabilities

Ensures patches and secure settings are applied

🔷 Common Configuration Management Tools

You should recognize these tools for the exam:

🔹 Automation Tools

Ansible
Puppet
Chef

👉 Used to:

Automatically configure systems
Enforce baselines

🔹 Version Control Systems

👉 Used to:

Track configuration files
Maintain history

🔹 Configuration Monitoring Tools

Tripwire
OSSEC

👉 Used to:

Detect file/configuration changes

🔷 Configuration Drift (Very Important Concept)

Configuration drift happens when a system’s configuration:

Gradually moves away from the baseline

Causes:

Manual changes
Unauthorized modifications
Updates not applied consistently

Risks:

Security vulnerabilities
System instability

👉 Configuration management tools help detect and fix drift.

🔷 Desired State vs Actual State

Desired State → What the configuration should be (baseline)
Actual State → What the system currently is

👉 Goal: Keep both the same.

🔷 Secure Configuration Guidelines

For exam understanding, secure configurations include:

Disable unnecessary services
Close unused ports
Apply patches and updates
Enforce strong authentication
Use least privilege
Enable logging and monitoring

🔷 Example in an IT Environment

A system administrator:

Defines a baseline for web servers
Uses automation tools to apply configurations
Monitors systems for changes
Detects if a service is unexpectedly enabled
Reverts system back to baseline

🔷 Key Terms to Remember (Exam Focus)

Configuration Item (CI)
Baseline
Configuration Drift
Version Control
Change Management
Desired vs Actual State
Configuration Monitoring

🔷 Quick Exam Summary

Configuration management ensures systems remain secure, consistent, and controlled
It uses baselines, monitoring, and version control
It works closely with change management
It helps detect unauthorized changes and attacks
Configuration drift is a key risk
Tools automate and enforce configurations