What is configuration management and why is it required?

Answer

Configuration management is a systematic approach maintaining control over system configurations throughout their lifecycle, ensuring systems remain secure and changes are controlled.

What Configuration Management Means

Configuration management involves establishing and maintaining documented baseline configurations that define how systems should be built and configured, implementing change control processes requiring review and approval before modifications, tracking all system components including hardware, software, and configuration settings, and verifying that actual system configurations match approved baselines.

Think of it as version control for entire systems rather than just software code. It ensures you know exactly how systems are configured, prevents unauthorized changes, enables rolling back problematic modifications, and maintains security posture as systems evolve.

Without configuration management, systems drift over time as users make ad-hoc changes, security settings get modified without review, unauthorized software gets installed, and organizations lose visibility into what's actually running in their environment. This configuration drift creates security vulnerabilities, compliance violations, and operational instability.

ITSP.10.171 Configuration Management Requirements

The Configuration Management family in ITSP.10.171 includes multiple detailed requirements.

• Develop and maintain under configuration control a current baseline configuration of systems handling specified information
• Review and update baseline configurations at defined frequency and when system components are installed or modified
• Establish, document, and implement configuration settings that reflect the most restrictive mode consistent with operational requirements
• Identify, document, and approve any deviations from established configuration settings
• Define types of changes that are configuration-controlled
• Review proposed configuration-controlled changes and approve or disapprove with explicit consideration for security impacts
• Implement and document approved changes
• Monitor and review activities associated with configuration-controlled changes
• Analyze security and privacy impacts of changes prior to implementation
• Verify that security requirements continue to be satisfied after changes
• Define, document, approve, and enforce physical and logical access restrictions associated with changes to systems
• Configure systems to provide only mission-essential capabilities
• Prohibit or restrict use of defined functions, ports, protocols, connections, and services
• Identify software programs authorized to execute on systems
• Implement deny-all, allow-by-exception policies for software execution
• Develop and document inventory of system components
• Review and update inventory at defined frequency
• Identify and document location of specified information and system components where information is processed and stored

Why Configuration Management Matters

Strong configuration management delivers multiple security and operational benefits. Security hardening ensures systems are configured according to security best practices, disabling unnecessary services, closing unneeded ports, and implementing secure settings. Many security breaches exploit default or weak configurations that proper configuration management prevents.

Change control prevents well-intentioned but poorly tested changes from introducing vulnerabilities, breaking security controls, or causing outages. Requiring review and approval before changes ensures security implications are considered.

Audit and compliance demonstration becomes straightforward when you can show assessors documented baseline configurations, evidence of change control processes, and verification that systems match approved configurations.

Incident response improves because known baseline configurations enable rapid detection of unauthorized changes that might indicate compromise, and clean baseline images enable faster recovery.

Operational stability benefits as configuration management prevents configuration drift that causes mysterious failures, performance degradation, and incompatibilities. Consistency across multiple systems handling specified information becomes achievable through standardized baseline configurations rather than each system being unique.

Baseline Configuration Development

Creating effective baseline configurations requires systematic effort.

• Start with vendor security guides provided by manufacturers describing security hardening for their products (Microsoft, Cisco, Red Hat, etc. all publish detailed security configuration guides)
• Industry standard benchmarks from organizations like Center for Internet Security (CIS) provide detailed, prescriptive configuration checklists for hundreds of technologies
• Regulatory guidance including ITSP.10.171 itself and related Canadian Centre for Cyber Security publications inform configuration decisions
• Threat modeling identifies what threats the system faces and what configurations mitigate those threats
• Operational requirements balance security with functionality—overly restrictive configurations that prevent legitimate work won't be sustained
• Peer review by security experts, system administrators, and business stakeholders ensures configurations are comprehensive, implementable, and appropriate
• Documentation in detailed, unambiguous terms enables consistent implementation and verification
• Testing in non-production environments before production deployment ensures configurations work as intended without breaking necessary functionality
• The baseline should be formally approved by management and version controlled with changes requiring formal updates

Change Control Processes

Effective change control balances security, agility, and operational needs.

• Changes are requested through formal process documenting what will change, why it's needed, who is requesting it, and when it should occur
• Security review by personnel with security expertise analyzes potential security impacts including whether change might introduce vulnerabilities, break security controls, create new risks, or affect compliance
• Risk-based approval authority varies based on change risk—low-risk routine changes might be delegated to operational managers while high-risk changes affecting security require senior approval
• Testing in non-production environments when possible verifies changes work as intended without adverse effects
• Implementation at defined times, preferably during maintenance windows, minimizes operational impact
• Documentation captures what was changed, when, by whom, and with whose authorization
• Post-implementation review verifies changes achieved intended results without causing issues
• Rollback capability allows reverting changes if problems occur
• Emergency change processes provide expedited approval for urgent security patches or incident response while maintaining accountability
• Organizations should tailor change control rigor to risk—systems handling classified information require more rigorous processes than low-sensitivity systems

Configuration Monitoring and Verification

Establishing baseline configurations is insufficient—organizations must verify systems remain compliant.

• Automated configuration scanning tools continuously or periodically check actual system configurations against documented baselines, identifying deviations
• File integrity monitoring detects unauthorized changes to critical system files, configurations, or software
• Vulnerability scanning identifies security misconfigurations and missing patches
• Manual reviews periodically verify automated tools are working properly and assess configurations holistically
• Deviation handling processes investigate why deviations occurred—are they unauthorized changes requiring remediation, are they approved changes not yet reflected in baseline documentation, or do they indicate the baseline needs updating?
• Remediation procedures quickly return systems to compliant configurations when unauthorized changes are detected
• Trend analysis over time identifies whether configuration drift is increasing, whether certain systems are prone to drift, or whether baseline configurations need adjustment
• Organizations should define monitoring frequency based on risk—systems handling specified information require more frequent monitoring than general-purpose systems

Least Functionality Principle

ITSP.10.171 requires configuring systems to provide only mission-essential capabilities, implementing the security principle of least functionality.

• Disabling or removing unnecessary services, applications, and features that aren't required for the system's intended purpose—each additional capability increases attack surface
• Closing or blocking unused network ports and protocols prevents adversaries from exploiting services you didn't know were running
• Removing unnecessary user accounts and groups reduces potential for unauthorized access
• Disabling or restricting unused hardware components like Bluetooth, cameras, or USB ports on systems handling very sensitive information prevents data exfiltration
• Minimizing installed software reduces what needs to be patched, what might contain vulnerabilities, and what adversaries could exploit

Organizations should default to denial—unless a capability is explicitly needed and approved, it should be prohibited. This philosophy makes security the default and requires justification for adding functionality rather than justification for restricting it.

Application Allow Listing

ITSP.10.171 requires implementing deny-all, allow-by-exception policies for software execution—only explicitly authorized software can run. Application allow listing (formerly called "whitelisting") provides strong defense against malware by preventing unauthorized code execution.

Organizations must identify and document authorized applications including commercial software, custom applications, system utilities, and scripts. Implement technical controls that block execution of any software not on the authorized list, using operating system features, endpoint security tools, or dedicated application control products.

Maintain and update the authorized software list as new applications are approved through change control processes. Monitor and alert when blocked execution attempts occur, as this might indicate malware or policy violations. Exception processes allow temporary execution of unauthorized software when legitimate need arises, with appropriate approval and time limitations.

While application allow listing requires initial effort to inventory approved software and ongoing maintenance as applications change, it provides powerful protection against ransomware, malware, and unauthorized tools.

System Component Inventory

Comprehensive inventory of system components is fundamental to configuration management. Organizations must maintain accurate inventories documenting hardware devices, software applications and versions, network equipment, mobile devices, and cloud resources that process or store specified information.

Information for each component should include identifying information (serial numbers, asset tags, network addresses), current configuration and patch status, ownership and responsible personnel, and location and security zone.

Automated discovery tools can identify network-connected devices, installed software, and cloud resources, though manual validation ensures accuracy. Integration with IT asset management systems provides single source of truth. Regular reconciliation compares inventory to actual deployed components, identifying undocumented systems (shadow IT), missing systems, or inventory errors.

Inventory enables effective patch management (you can't patch what you don't know exists), configuration management (can't baseline unknown systems), incident response (knowing what's on your network helps identify compromised systems), and compliance demonstration (assessors want evidence you know what systems handle specified information).

Common Configuration Management Challenges

Organizations face several implementation challenges.

• Initial baseline development requires significant effort and expertise for complex systems with thousands of configurable parameters
• Maintaining baselines as systems evolve requires ongoing resources and formal change integration processes
• Balancing security and functionality often creates tension when hardened configurations break necessary functionality, requiring negotiation and documented deviations
• Legacy systems may lack modern configuration management capabilities or might break if reconfigured to modern standards, requiring risk-based decisions about remediation vs. compensating controls
• Diverse environments with many different technologies multiply baseline development and maintenance effort
• Inadequate tooling makes manual configuration management impractical at scale, requiring investment in automation

Organizations should address these challenges through phased implementation starting with highest-risk systems, investment in configuration management tools and skilled personnel, executive support for enforcing configuration discipline, and treating configuration management as ongoing program rather than one-time project.

Learn More

Additional resources are available to help understand configuration management requirements.

• Protecting Specified Information (ITSP.10.171)
• Baseline Security Requirements for Network Security Zones (ITSP.80.022)