This chapter is from the book
This chapter is from the book
This chapter is from the book
Documentation
An essential part of any IT or cybersecurity professional’s role is the creation and maintenance of documentation. Documentation is written material that provides information about a system or process. It might include user guides, technical specifications, or system descriptions. Documentation may also be written for specific products (for example, product documentation, user guides) or for specific processes (for example, installation instructions, uninstallation guides, patching processes). Documentation can also include policies, procedures, standards, and guidelines. Many organizations have their own security policies that cover critical security topics such as change management and change control policies, information security policies, acceptable use policies (AUPs), and business continuity planning (BCP)/disaster recovery policies (DRPs).
Good documentation ensures a clear understanding of system operations, making it easier to train new staff and troubleshoot issues. It is often a good idea to begin with documentation when trying to ascertain any dependencies software or a system may require for operations and to map any dependencies.
Updating Diagrams
In the ever-evolving landscape of your IT environment, the process of updating diagrams plays a vital role. Updating diagrams is the process of editing current diagrams of systems or networks and inserting any changes that have occurred since the diagrams were originally created. As a best practice, you should ensure strong version control and put a version control number on every diagram. Diagrams can be visualized as maps or blueprints of your network or flowcharts of a process.
Updating diagrams ensures that everyone has an accurate and current picture of the systems. This clarity can significantly enhance troubleshooting and system upgrades. A good configuration management process helps to prevent small or large changes from going undocumented. Undocumented changes can lead to poor performance, inconsistencies, or noncompliance and can negatively impact business operations and security. Poorly documented changes add to instability and downtime. Having good network diagrams and well-written and up-to-date documentation is crucial and allows you to not only troubleshoot problems but also respond quickly to security incidents.
Updating Policies/Procedures
One crucial responsibility you will shoulder is updating policies and procedures. In the cybersecurity landscape, policies are the rules governing how IT systems are used and secured, whereas procedures are the specific steps required to implement these rules. It’s worth noting that policies and procedures are directive controls and help communicate expectations to an organization. You must continuously revise policies and procedures to align with technological advancements, environmental shifts, or system modifications. Doing so ensures smooth, efficient, and secure operation of your IT infrastructure.
You should generally pay special attention to legacy applications that require unique user instructions. For instance, a legacy terminal application that is used to manage network interfaces could inadvertently expose privileged access if a policy changes but the corresponding procedures are not updated.