What Is Security Configuration Management?

Security configuration management identifies misconfigurations of a system’s default settings. Misconfigurations can lead to a host of problems, including poor system performance, noncompliance, inconsistencies, and security vulnerabilities.

In routers or operating systems, for example, manufacturers often set the default configurations with predefined passwords or pre-installed applications. Accepting easily exploitable default settings can make it easy for attackers to gain unauthorized access to an organization’s data and has the potential to cause catastrophic data loss.

[Read also: What leap year code issues can teach us about the 2038 bug]

Specialized configuration management tools allow security teams to understand what’s changing in their key assets and detect a breach early. These tools typically perform the following tasks:

• Classify and manage systems

• Modify base configurations

• Roll out new settings to applicable systems

• Automate patches and updates

• Identify problematic and noncompliant configurations

• Access and apply remediation

Security misconfigurations are a major cause of security breaches. In 2019, for example, nearly half (45%) of all breaches were caused by errors attributed to misconfigurations. The impact of these breaches can be expensive: Each breach caused by a cloud misconfiguration costs organizations an average of $4.4 million, Ponemon Institute and IBM say.

How security configuration management works

Patches, updates and changes to IT hardware and software typically require adjustments to the system configuration. To prevent these adjustments from having an impact on security, organizations require a well-defined security configuration management process and the right tools.

A solid process is key to disaster recovery. You can’t recover the last-known configuration without correct and thorough documentation, for example. Security configuration management tools are also important because they identify misconfigurations and detect and report unusual changes to files or registry keys, enabling organizations to understand how their assets are changing.

Security configuration management has four phases, according to the National Institute of Standards and Technology:

• Planning. This step involves developing policies and procedures for incorporating security configuration management into existing IT and other security programs and then disseminating this guidance throughout the organization.

• Identifying and implementing configurations. Creating, reviewing, approving, and implementing a secure baseline configuration for the system is critical. The approach may address configuration settings, software loads, patch levels, the physical or logical arrangement of data, security control implementation, and documentation.

• Controlling configuration changes. Organizations ensure that changes are formally analyzed for their impact on security — and later tested and approved prior to implementation. Organizations may employ a variety of restrictions on making changes to limit unauthorized or undocumented updates to the system.

• Monitoring. This phase identifies previously undiscovered or undocumented system components, misconfigurations, vulnerabilities, and unauthorized changes — all of which can expose organizations to increased risk. Automated tools help organizations to efficiently identify when the system is not consistent with the approved baseline configuration and when remediation actions are necessary.

[Read also: Nine ways to improve vulnerability and configuration management]

The benefits of modern security configuration management tools

Security configuration management can be challenging for organizations with large networks and complex architectures. It can be difficult to accurately inventory and update records about hardware and software in the network and create and maintain baseline settings for endpoint device configurations. In addition, manual processes can introduce errors, so it’s important to analyze changes before they’re applied and check configurations against policies and standards. Finally, configuration changes can be hard to properly document.

Security configuration management can be challenging for large networks and complex architectures.

Security configuration management tools can address these challenges, providing a number of advantages for businesses:

• Automation and visibility. Without a security configuration management tool, it’s nearly impossible to maintain secure configurations across servers, routers, firewalls, and switches. The right tool automatically brings misconfigurations into alignment while providing real-time visibility.

• Heightened compliance. Security configuration management tools monitor an organization’s compliance with both internal and external standards. This reduces the time to identify noncompliance, which helps avoid incurring costly penalties and fees.

• Lower risk and faster recovery. Tools detect and quickly correct misconfigurations, thereby reducing organizational risk. This enables organizations to provide a higher level of service and faster recovery, since the correct configuration is documented and automated.

[Read also: What is security automation?]

Managing security configuration is necessary for every organization. An effective process and the right tools protect against vulnerabilities and security threats while reducing risk, ensuring compliance, and preventing catastrophic data loss.