Cyberstudy
PDF p.387 In progress

Allowed and Blocked Changes

Open PDF at p.387 14 flashcards

Summary

PDF p.387

Allow lists and deny lists are crucial in change management, controlling approved and blocked software, hardware, and change types. They streamline processes and prevent unauthorized or risky changes.

In plain words

Supplementary — not from your PDF

Allow lists name approved software, hardware and change types (and who may approve them), streamlining low-risk changes. Deny lists explicitly block risky or unauthorized ones. Technical controls (access controls, firewall rules, software restrictions) enforce them. Note: allow lists based on file hashes can break after patching, since the hash changes.

Detailed explanation

PDF p.387
  • Allow Lists
    • Purpose: List of approved software, hardware, and change types.
    • Streamline Processes: Reduce time and effort for trusted changes.
    • Regular Updates: Ensure alignment with organizational needs.
    • Examples: Routine or low-risk changes, specific individuals with approval authority.
  • Deny Lists
    • Purpose: List of explicitly blocked software, hardware, and change types.
    • Prevent Risks: Block unauthorized or high-risk changes.
    • Security Measure: Clearly identify off-limits changes.
    • Examples: Software with known security issues, high-impact changes, unauthorized individuals.
  • Technical Controls
    • Access Controls: Manage who can make changes.
    • Firewall Rules: Control network traffic.
    • Software Restriction Mechanisms: Prevent unauthorized software execution.
  • Impact on Change Implementation
    • Software Patching: Allow lists based on hash values may fail after patching.
    • Testing Plan: Incorporate impacts of allow and block lists.

Important terms

taken from the text above
Streamline Processes
Reduce time and effort for trusted changes.
Regular Updates
Ensure alignment with organizational needs.
Prevent Risks
Block unauthorized or high-risk changes.
Security Measure
Clearly identify off-limits changes.
Access Controls
Manage who can make changes.
Firewall Rules
Control network traffic.
Software Restriction Mechanisms
Prevent unauthorized software execution.
Software Patching
Allow lists based on hash values may fail after patching.
Testing Plan
Incorporate impacts of allow and block lists.

Examples & real-world scenarios

Supplementary — not from your PDF
  • An allow list of routine, low-risk changes.
  • A deny list blocking software with known vulnerabilities.
  • Software restriction policies enforcing the lists.

Scenario

After patching an approved application, a hash-based allow list no longer recognizes it and blocks it. The testing plan must account for how patching affects allow lists.

Common mistakes

Supplementary — not from your PDF
  • Forgetting that patching changes file hashes and breaks hash-based allow lists.
  • Relying only on lists without technical enforcement.

Practical skills

Supplementary — not from your PDF
  • Explain how allow and deny lists shape change approval.

What I should remember

Key Points PDF p.387
  • Allow Lists: Approved changes, streamline processes, regular updates.
  • Deny Lists: Blocked changes, prevent risks, security measure.
  • Technical Controls: Access controls, firewall rules, software restrictions.
  • Impact on Implementation: Consider allow/block list impacts in testing.