Chapter 10 — Security governance, risk and compliance: control configuration
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Configuring to policy"]
N2["10.2 Documenting decisions"]
N3["10.3 Testing changes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Configuring to policy"]
N2["10.2 Documenting decisions"]
N3["10.3 Testing changes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 Configuring to policy]
|
v
[10.2 Documenting decisions]
|
v
[10.3 Testing changes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) configure controls to meet policy; (2) document configuration decisions; (3) test before and after changes.
10.1 Configuring to policy
Amina helps configure controls to match Fenwick's policies. She enables multi-factor authentication for all cloud accounts, sets backup jobs to include the stock database and online shop data, and configures alerts for repeated sign-in failures. For each, she checks the policy requirement and chooses settings that meet it. She learns that configuration is where policy becomes real, and that small setting choices can make a large difference. Including the stock database in backups, for example, protects the one component that both the shop and the branches depend on.
10.2 Documenting decisions
Some settings involve trade-offs. Amina sets the sign-in alert threshold at five failures within ten minutes. Lower would cause many false alarms from mistyped passwords; higher might miss guessing. She records the decision and reason in the configuration notes. She learns that documenting why a setting was chosen helps future technicians adjust it sensibly rather than guessing or reverting it without understanding. If false alarms later prove frequent, the recorded reason shows exactly which trade-off to revisit. The note sits beside the setting itself, so it is found by whoever next opens the configuration.
10.3 Testing changes
Before changing backup settings, Amina tests restore of the current backup. After the change, she runs a new backup and restores sample files from the stock database. Both tests pass. She records the results. She learns that testing before and after a change shows both that the old state worked and that the change did not break anything, which provides useful evidence of a controlled change. The before-and-after restore results go into the change record as evidence that the backup change was controlled.
Worked example
Amina configures MFA, backups and alerts to policy, documents the alert threshold reasoning and tests backups before and after change.
Synthetic case. Configurations are synthetic.
Errors and limits
Thresholds need tuning. Tests sample only some files.
Exercises
- EX037 — Threshold choice. What alert threshold did Amina set? Rubric: 3 = five failures within ten minutes;; 2 = 5 in 10;; 1 = vague;; 0 = none.
- EX038 — Threshold trade-off. Why not set the threshold lower? Rubric: 3 = many false alarms from mistyped passwords;; 2 = false alarms;; 1 = vague;; 0 = none.
- EX039 — Before-after tests. Why test both before and after a change? Rubric: 3 = shows old state worked and change broke nothing;; 2 = baseline;; 1 = vague;; 0 = none.
- EX040 — Backup scope. Which data were added to backup jobs? Rubric: 3 = the stock database and online shop data;; 2 = two;; 1 = vague;; 0 = none.
Synthesis
Controls become real through documented configuration and before-and-after testing.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →