- In lesson 3.1,
we're gonna focus in on configuration management.
And I hope to stress to you the absolute importance
of configuration management.
A configuration management
that you'll sometimes see abbreviated as CM
is a set of practices designed to ensure
that configuration items, by items we just mean items
like our servers or our routers, or our software,
are deployed in a consistent state
and stay that way throughout their lifetime.
In other words, we set them up,
we know that they're working
and we can trust that they're always working
the way we set them up.
Now the goal of configuration management
is absolutely to minimize risk.
Configuration management is a form
of IT service management that ensures
that the configuration of resources are always known,
always good and can always be trusted.
Now there are two primary
configuration management elements.
The first is a CI or configuration item.
And that's an aggregation of information system components
that are treated as a single entity
throughout the configuration management process.
So perhaps it's your domain controllers,
perhaps it is your smartphones,
perhaps it is your routers,
perhaps it's your database servers.
And then a baseline configuration.
A baseline configuration or BC is a set of specifications
for that particular configuration item.
How that item is going to be configured.
Now those specifications are researched, they're reviewed,
they're agreed upon, and then they can only be changed
through the change management process.
And we'll talk about the change management process
and change management procedures in our next lesson.
And once that baseline is established,
it is used as a basis for all future builds and releases.
And that's really important,
because let's say a server fails,
it has to be rebuilt, right?
We wanna make sure that when it's rebuilt, right,
it is rebuilt to this particular baseline,
that someone's just not rebuilding it.
Ah, I think it should have this
I think it should have that, right?
We don't wanna rely on institutional knowledge.
We don't wanna rely on the fact
that someone says I think I know how to do it.
We wanna have the standard baseline configurations,
again, that have been researched, reviewed, and agreed upon,
and are only changed through the change control procedures.
So what does a configuration
management workflow look like?
Well, first, we're defining our objectives.
So what is it that we need to configure
is really part of our objectives.
Then we're gonna do research.
We will then propose a configuration.
So that's most of our job, right?
We do the research and we propose,
we say based on best practices
or recommendations from highly regarded sources,
this is the configuration that we are proposing.
It will then be reviewed.
Generally, there'll be a committee that will review it.
It will be approved.
Again, that's often the responsibility
of somebody in management or a management committee.
It will then be published,
and if there have been multiple versions
of that configuration, we'll make sure
we have good version or version control.
It will then be implemented
and then it will be controlled.
In this case, when we're using the word control,
we're not talking about a control
like we've been talking about in the other lessons.
We're talking about that we manage it,
that we say, okay, this is what we're using,
that it can't be changed
unless we go through the change control procedures.
We have control over it.
It's a better way to think about it.
And then we'll monitor it, right?
We wanna make sure that this
is still the right configuration,
because things change over time.
And if there needs to be any changes
in the the baseline configuration,
well, then we're gonna go right
through this process again.
Are those, you know, changes necessary?
We'll research, we'll propose,
we'll review, we'll approve,
we'll republish, we'll re-implement.
Automated provisioning, which is really
the wave of the future, is the ability
to deploy information technology, IT
or operational technology, OT systems
and services using predefined, automated procedures
without requiring human intervention.
And multiple times in this course,
we're gonna come back to this idea of automation
and all of the benefits of automation.
Now in this case, automation is used
to ensure consistency in provisioning
in the support of configuration management
with the goal that automation will reduce
or eliminate manual dependencies and human error.
So here are some provisioning processes
that really tie in with configuration management
and with automation that you wanna be familiar with.
Demand-generated resource allocation, idempotence,
immutable systems or immutability,
and infrastructure as code.
Demand-generated resource allocation
is just the automatic provisioning
and de-provisioning of our resources based upon demand.
Now, of course, we're gonna wanna make sure
that we're always using our baseline configurations
when we're doing this provisioning.
Idempotence is a principle that says every time
an automated configuration script is run,
the same exact result should be produced.
So we can depend on that script, right?
That script is trustworthy and the systems
that were produced are trustworthy as well.
Another principle is the principle of immutability.
Immutability is a principle
that resources should not be changed,
only created and destroyed.
So instead of trying to fix something,
we have a corruption maybe in our database,
or there's, you know, a problem in a configuration file,
in our domain controller.
Instead of trying to fix it,
what we're gonna do is we're just gonna recreate.
So we create or destroy, but we don't try to fix.
So it utilizes automation to replace rather than fix.
Again, because we know what once we've replaced it,
with that clean copy based on our baseline configuration,
that system will have be approved and trustworthy.
And then lastly, we have infrastructure as code.
Now, infrastructure as code is using code
to manage configurations
and to automate the provisioning of the infrastructure.
And that really supports the principle of idempotence.
Again, that every time a configuration script is run,
the same exact result should be produced.
And that brings us to the end of configuration management
and to the start of our three-second challenge.
You ready?
Five challenge questions, three seconds each.
Let's do it.
An aggregation of information system components
treated as a single entity.
One, two, three.
That's a configuration item or a CI.
Question two, agreed upon specification
for a configuration item or a CI.
One, two, three.
That's gonna be our baseline configuration or our BC.
Question three, ability to deploy IT or OT systems
without requiring human intervention.
One word, starts with the letter A.
One, two, three.
At the automated or automation,
or actually two words here, automated provisioning.
Question four, the principle that every time
an automated configuration script is run
the same exact results will be produced.
One, two, three.
That's idempotence.
And lastly, number five.
This is the principle that resources should not be changed,
only created and destroyed.
In this case, we use automation
to replace rather than fix.
One, two, three.
And that's immutability.
Or sometimes you'll say it as immutable systems.
All right, that brings us
to our security in action case study.
This one's on configuration management
and we're doing these case studies,
so you can practically apply your knowledge.
We'll go through the case study together.
I'll ask you a question.
Great time to put me on pause
while you jot down some answers.
Then you'll come back
and we'll talk through the case study together.
Your organization is rapidly growing,
both organically and through acquisition.
You're concerned that unmanaged growth
will result in security issues, and you're proposing
the implementation of a configuration management program
supported by automation.
Well, the IT manager,
who I guess is probably maybe a little skeptical of this,
has asked you to come to a departmental meeting
to present to his or her team why this is important.
So what are you gonna tell them, right?
So you're growing a lot both by acquisition
and organically, you're really concerned
that all this growth, things are gonna get out of control.
We're gonna have security issues.
And you say, you know what?
It's really time that we have
a good configuration management program
and that we support it with automation.
Now you're in security.
It's really the IT folks who are building all these systems,
who are doing the provisioning.
And they're saying, all right,
well, come to one of our meetings and convince us.
Tell us why it's important.
So my question to you is, what are you gonna tell 'em?
Great time to put me on pause.
Think through this, jot down some notes.
Well, here might be in your presentation.
Configuration management ensures that systems are deployed
and maintained in a consistent state.
I always think of this as sort of making order out of chaos.
I always know how my systems are going to be configured.
I'm not depending upon institutional knowledge
or what a vendor might come in and do.
I know how they're set up all the time.
Now, automated provisioning
supports configuration management
by using predefined automated procedures
to ensure consistent configurations.
And you really wanna stress that configuration management
will ultimately make IT's job easier.
It'll make supporting many systems
and devices easier and more efficient, right?
Because they're all set up the same way
and it will reduce their workload.
The many times when we use the term automation,
folks get really nervous about losing their jobs.
And when I always talk about
when I talk to folks who are nervous about automation
is it's not about losing your job,
it's about being able to use yourself,
your own resources better,
that you can apply your human intelligence, right?
Your decision making, right?
Your thought process,
the things that really need that opposed
to some of these more rote tasks
that can easily be automated.
So having this conversation with the IT team,
helping them understand why configuration management
is so essential, so important for an organization,
and what the benefits are of automation.
That my friends is security in action, right?
Brings you to a word cloud.
There's a lot here, okay?
Make sure that you understand everything
that's on here, right?
Don't move on until you can say,
okay, yeah, I can speak to each one of those items.
If you can't, go back into the lesson.
When we're covering all of this, go back into the lesson,
learn a little bit more about it,
come back to your word cloud, speak it again.
And then when you're ready, move on to the next lesson
and I'll be waiting for you right there.