Most operating systems (OSs) aren’t secure out of the box. Instead, administrators must take specific steps to secure them. If you’re planning to take the SY0-601 version of the Security+ exam, you should understand how to do so.
For example, can you answer this question?
Q. Security experts want to reduce risks associated with updating critical operating systems. Which of the following will BEST meet this goal?
A. Implement patches when they are released.
B. Implement a change management policy.
C. Use only trusted operating systems.
D. Implement operating systems with secure configurations.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
Patch Management
Software is not secure. There. I said it. As someone who has written a few programs over the years, that’s not easy to say. In a perfect world, extensive testing would discover all the bugs, exploits, and vulnerabilities that cause so many problems.
However, because operating systems and applications include millions of lines of code, testing simply doesn’t find all the problems. Instead, most companies make a best effort to test software before releasing it. Later, as problems crop up, companies write and release patches or updates. Administrators must apply these patches to keep their systems up to date and protected against known vulnerabilities.
Patch management ensures that systems and applications stay up to date with current patches. This is one of the most efficient ways to reduce operating system and application vulnerabilities because it protects systems from known vulnerabilities. Patch management includes a group of methodologies and includes the process of identifying, downloading, testing, deploying, and verifying patches.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Administrators often test updates in a sandbox environment such as a virtual machine. A sandbox environment provides an isolated environment. After testing the patches, administrators deploy them. They don’t typically deploy the patches manually. Instead, they use third-party tools to deploy the patches in a controlled manner. For example, Microsoft Endpoint Configuration is a systems management tool used for many purposes, including patch management. It examines endpoints to determine if patches are installed.
In addition to deploying patches, systems management tools also include a verification component that verifies patch deployment. They periodically query the systems and retrieve a list of installed patches and updates. They then compare the retrieved list with the list of deployed patches and updates, providing reports for discrepancies. In some networks, administrators combine this with network access control (NAC) technologies and isolate unpatched systems in quarantined networks until they are patched.
Improper or weak patch management results in preventable vulnerabilities that attackers can exploit. This includes vulnerabilities in operating systems, applications, and firmware.
Change Management Policy
The worst enemies of many networks have been unrestrained administrators. A well- meaning administrator can make what appears to be a minor change to fix one problem, only to cause a major problem somewhere else. A misconfiguration can take down a server, disable a network, stop email communications, and even stop all network traffic for an entire enterprise.
For example, I once saw a major outage occur when an administrator was troubleshooting a printer problem. After modifying the printer’s Internet Protocol (IP) address, the printer began to work. Sounds like a success, doesn’t it? Unfortunately, the new IP address was the same IP address assigned to a Domain Name System (DNS) server, and it created an IP address conflict. The conflict prevented the DNS server from resolving names to IP addresses. This resulted in a major network outage until another administrator discovered and corrected the problem.
These self-inflicted disasters were relatively common in the early days of IT. They still occur today, but organizations with mature change management processes in place have fewer of these problems. Change management defines the process for any type of system modifications or upgrades, including changes to applications. It provides two key goals:
• To ensure changes to IT systems do not result in unintended outages
• To provide an accounting structure or method to document all changes
When a change management program is in place, administrators are discouraged from making configuration changes without submitting the change for review and approval. In other words, they don’t immediately make a change as soon as they identify a potential need for the change. This includes making any type of configuration changes to systems, applications, patches, or any other change. Instead, they follow the change management process before making a change.
Experts from different areas of an organization examine change requests and can either approve or postpone them. The process usually approves simple changes quickly. A formal change review board regularly reviews postponed requests and can approve, modify, or reject the change. This entire process provides documentation for approved changes. For example, some automated change management systems create accounting logs for all change requests. The system tracks the request from its beginning until implementation. Administrators use this documentation for configuration management and disaster recovery. If a modified system fails, change and configuration management documentation identifies how to return the system to its prefailure state.
Change management isn’t only for computing devices. It’s important to use these processes for any devices on the network, including firewalls, proxy servers, data loss prevention systems, mobile device management systems, routers, and switches.
Q. Security experts want to reduce risks associated with updating critical operating systems. Which of the following will BEST meet this goal?
A. Implement patches when they are released.
B. Implement a change management policy.
C. Use only trusted operating systems.
D. Implement operating systems with secure configurations.
Answer is B. A change management policy helps reduce risk associated with making any changes to systems, including updating them.
Patches should be tested and evaluated before implementing them and implementing them when they are released sometimes causes unintended consequences.
The use of a trusted operating system or operating systems with secure configurations doesn’t address how they are updated.
See Chapter 5 of the CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide for more information on implementing secure systems.
