Lion Cipher Lab
Reconcile config changes against change tickets to find unauthorized changes
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Change control is one of the most commonly audited security controls, because uncontrolled change causes both outages and breaches. NIST SP 800-53 control CM-3 (Configuration Change Control) requires organizations to decide which changes are controlled, review and approve them, document them and monitor them. NIST SP 800-128 builds a whole configuration management process around it. Approving tickets is only half the control, though. The other half is checking that what actually changed matches what was approved, because a change made with no ticket, outside its window, or under a rejected…
What you'll learn
- configuration change control and why auditors test it
- where observed-change data comes from (FIM, config management, audit logs)
- matching changes to tickets by host, status and time window
- classifying unauthorized changes by type
- measuring what naive matching misses
- handling emergency changes properly
- turning reconciliation into a recurring control
Steps in this lab
- Two records that should agree
- The sample week
- Write the reconciler
- Run it: five of nine changes need an explanation
- Measure the naive check
- Emergency changes, and making it a control