What is version control?
Version control is the practice, and the tooling, for keeping every revision of a set of files. A version control system stores each change with its author, its time, the exact lines that changed and a message explaining why. Git is by far the most common. It began as a tool for source code, but security and operations teams now keep firewall configurations, infrastructure-as-code templates, scripts, Group Policy exports and even text-based policies in it. In change management, version control is what makes each change traceable and reversible.
Core terms
- Repository: the store holding the files and their complete history.
- Commit: a saved set of edits with an author, timestamp and message.
- Diff: a comparison showing which lines were added, removed or altered between two versions.
- Branch: a parallel line of work that is merged once reviewed.
- Tag: a name pinned to one version, such as an approved baseline or a release.
- Pull request (or merge request): a proposal to merge a branch, where reviewers approve or reject the edits.
Example: tracing a suspicious rule
During an investigation, a responder finds that the host firewall on a jump server accepts SSH from any address and wants to know who added that line:
git blame -L 42,42 hosts/jump01/nftables.conf
8f3d2c1b (j.okafor 2026-09-30 22:41:07 +0000 42) tcp dport 22 accept
The commit hash leads to the commit message and the change ticket it cites, or shows that no ticket exists. Running git diff baseline-2026q3 -- hosts/jump01/ then lists everything else that changed on that host since the last approved baseline.
Why version control matters for security
- Audit trail: every line of a configuration traces to a person, a time and an approved change, which auditors and investigators both need.
- Rollback: undoing a bad change can be as simple as redeploying the previous version.
git revertadds a new commit that reverses an earlier one, so the history stays intact. - Drift detection: comparing a running configuration with the committed one exposes edits made outside the process. Infrastructure-as-code tools such as Terraform report drift between code and real resources.
- Enforced approval: protected branches can require a reviewed pull request before anything merges, and pipelines can deploy only from that branch, building separation of duties into the tooling.
Protecting the repository
A repository that defines infrastructure is a high-value target. Limit who can push and approve, require MFA, sign commits where provenance matters, and never commit secrets. A password committed once stays in the history after the file is fixed, so it has to be rotated, not just deleted. Secrets scanning catches these mistakes, and public code repositories that expose internal code or keys are an attack surface in their own right.
Version control on the CompTIA Security+ exam
Version control closes the change management material in SY0-801 objective 1.2, beside updating diagrams, policies and procedures. Scenario wording such as nobody being able to tell who modified a configuration, uncertainty about which version is running, restoring the previous configuration exactly, or a running config that no longer matches the approved baseline points to it. The usual distractor is documentation. If the problem is not knowing how things look now, the fix is updated diagrams and procedures; if it is not knowing what changed and who changed it, the fix is version control. The commit history, not the current file, is the evidence of who made a change and when.