2 cissp ® Official Study Guide Eighth Edition

Configuration Documentation
Configuration documentation identifies the current configuration of systems. It identi-
fies who is responsible for the system and the purpose of the system, and lists all changes 
applied to the baseline. Years ago, many organizations used simple paper notebooks to 
record this information for servers, but it is much more common to store this information 
in files or databases today. Of course, the challenge with storing the documentation in a 
data file is that it can be inaccessible during an outage.
Managing Patches and Reducing 
Vulnerabilities
Patch management and vulnerability management processes work together to help protect 
an organization against emerging threats. Bugs and security vulnerabilities are routinely 
discovered in operating systems and applications. As they are discovered, vendors write 
and test patches to remove the vulnerability. Patch management ensures that appropriate 
patches are applied, and vulnerability management helps verify that systems are not vulner-
able to known threats.
Systems to Manage
It’s worth stressing that patch and vulnerability management doesn’t only apply to work-
stations and servers. It also applies to any computing device with an operating system. 
Network infrastructure systems such as routers, switches, firewalls, appliances (such as a 
unified threat management appliance), and printers all include some type of operating sys-
tem. Some are Cisco-based, others are Microsoft-based, and others are Linux-based.
Embedded systems are any devices that have a central processing unit (CPU), run an 
operating system, and have one or more applications designed to perform one or more 
functions. Examples include camera systems, smart televisions, household appliances (such 
as burglar alarm systems, wireless thermostats, and refrigerators), automobiles, medical 
devices, and more. These devices are sometimes referred to as the Internet of Things (IoT).
These devices may have vulnerabilities requiring patches. As an example, the massive 
distributed denial-of-service
attack on Domain Name System (DNS) servers in late 2016 
effectively took down the internet by preventing users from accessing dozens of web-
sites. Attackers reportedly used the Mirai malware to take control of IoT devices (such as 

---

724
Chapter 16 
■
Managing Security Operations
Internet Protocol [IP] cameras, baby monitors, and printers) and join them to a
botnet
. 
Tens of millions of devices sent DNS lookup requests to DNS servers, effectively overload-
ing them. Obviously, these devices should be patched to prevent a repeat of this attack, but 
many manufacturers, organizations, and owners don’t patch IoT devices. Worse, many ven-
dors don’t even release patches. 
Last, if an organization allows employees to use mobile devices (such as smartphones 
and tablets) within the organizational network, these devices should be managed too.