IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.78 Careful modifications of configurations
Initiation responsibility: Head of IT Section, IT Security management
Implementation responsibility: Administrators
All changes made to an IT system during actual operation should be
considered as critical, and appropriate caution must be exercised when
performing such changes.
Before any change is made to an IT system, the old configuration should be
backed up, so that it is readily available if the new configuration poses any
problems.
In the case of networked IT systems, users must be duly informed about
impending maintenance work, so that they can plan for a temporary system
shutdown and correctly localise any problems which might occur after the
changes have been made.
Changes to a configuration should always be performed in individual steps.
Regular checks should be made as to whether these steps have been executed
correctly, and whether the affected IT system and applications are still fully
functional.
If changes are made to system files, a re-start should be performed
subsequently in order to check whether the IT system can still be started
correctly. All data carriers required for emergency starting - such as boot
diskettes, boot CD-ROM - should be kept handy in case a problem occurs.
If possible, complex changes to a configuration should not be made in the
original files, but in copies. All changes which have been performed should be
examined by a colleague before being incorporated into regular operations.
In the case of IT systems which need to fulfil high availability requirements,
redundant systems should be maintained, or at least restricted IT operations
should be ensured. Ideally, the procedures specified in the contingency manual
should be followed in this case.
All changes made to a configuration should be noted down step-by-step, so
that if a problem occurs, the functionality of the IT system can be restored by
a successive reversal of the changes (also refer to S 2.34 Documentation of
changes made to an existing IT system).
Additional controls:
- Have changes to the system been documented step-by-step?
- Can the changes be undone subsequently?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000