At 4:40 on a Friday, a network engineer adds a firewall rule that allows RDP on TCP 3389 from any address to a file server, so a vendor can troubleshoot a failing backup job. The vendor finishes in twenty minutes. Nobody removes the rule, nobody else knows it exists, and five weeks later that open port is how a ransomware crew gets in.
The attackers needed no exploit, only a change that skipped the process. On the CompTIA Security+ SY0-801 exam, change management sits under objective 1.2, a "given a scenario" objective that expects you to apply the change process to realistic situations and explain how each step affects security. This lesson covers the process itself: how a change is requested and approved, what the change advisory board does, who owns a change, which stakeholders need a voice, and how maintenance windows and standard operating procedures keep routine work predictable.
Uncontrolled change is a security risk, not just an operations problem
A large share of outages, and many breaches, start with a change: a misconfigured rule, a patch that broke an application, a test account that was never removed. Change management is the set of business processes that makes sure every change to production systems is requested, assessed, approved, scheduled, carried out and reviewed, with a record at each step.
Every part of the CIA triad depends on it. An untested change can take a service down, which is an availability failure. An unauthorized edit to a configuration file is an integrity failure. A rule that opens access to the wrong people is a confidentiality failure waiting to happen.
Change management also helps detection. When every legitimate change has a record, a change without one stands out. Suppose file integrity monitoring raises an alert that /etc/ssh/sshd_config changed on a bastion host at 02:14. The analyst checks the change calendar. If an approved change covered that host in that window, the alert is expected. If no record exists, the analyst treats it as a possible intrusion.
This is more than good habit. NIST SP 800-53 has a full configuration management control family, including configuration change control (CM-3) and impact analysis (CM-4). PCI DSS requires that production changes in its scope have a documented reason, a documented security impact, approval by authorized people, testing, and a procedure for returning to a secure state if the change fails.
Every change follows the same path from request to closure
Organizations name the steps differently, but the sequence is consistent:
| Stage | What happens |
|---|---|
| Request | A requester submits a request for change (RFC): what, why, which systems, when |
| Assessment | The owner and technical reviewers rate the risk and attach impact analysis, test results and a backout plan |
| Approval | The right authority approves, rejects or sends the request back for more information |
| Scheduling | The change is placed in a maintenance window and stakeholders are notified |
| Implementation | Implementers carry out the approved steps, and only those steps |
| Verification | Someone confirms the change worked and nothing else broke |
| Closure | Documentation is updated, the record is closed, and failed changes get a review |
Not every change needs the same scrutiny. ITIL, the IT service management framework many organizations follow, describes three types. A standard change is low risk, repeatable and pre-approved, such as adding an internal DNS record or adding memory to a virtual machine by following a documented procedure. A normal change is assessed and approved individually, and who approves it depends on its risk. An emergency change must happen faster than the normal cycle allows, such as patching an internet-facing VPN appliance against a flaw that attackers are already exploiting.
Emergency doesn't mean unrecorded. An emergency change still gets approval, usually from a small emergency group rather than the full board, and its documentation is completed afterward. The impact analysis, testing and backout parts of the assessment stage get their own lesson next.