 What is Code Change Management and why does it matter?  What are key code change controls and their relationship?  What are some common code change control gaps? Part 5 - Evaluating Code Change Management Processes

 The goal of code change management is to provide a disciplined process for introducing required code changes into the IT environment securely and with minimal disruption to ongoing operations. Purpose of Management of Code Change Review

 Development – Testing – Production environments should be separated  Staging environment for user acceptance testing Code Change Environments

 Control migration between environments  Maintain segregation of duties Code Environment Migrations

Management of Code Changes’ Equation

 Request/System Development Methodology (SDM) –Initiated through a controlled request and/or SDM process  Tested –IT and/or functional users perform documented testing of functionality and stability  Approved – Functional and/or IT owners approve prior to being moved into production.  Monitored – Systems and processes are monitored to confirm code changes follow the controlled process Four Components of a Strong Code CM Process

 Prevention controls – Testing and Approval/Authorization  Detection controls – Monitoring  Efficiency controls - Request/SDM Control Types: Prevention & Detection

 Segregation of Duties (SOD) – Separation of activities that prevent users from making inappropriate/unauthorized changes  Systematic and organizational SOD required Code Change Management - Segregation of Duties

 Prevention controls require SOD: Development access ≠ access to migrate to production (i.e., Change Coordinator) Development access ≠ code change approver Segregation of Duties – Prevention Controls

 Detection (monitoring) controls SOD : Segregation of Duties – Detection Controls ◦ Development/Migration ≠ Monitoring of code change ◦ Development/Migration ≠ access to the code change log or to enable/disable logging

Environment Segregation of Duties and Roles

 Source code - program instructions usable by developers  Source code compiles into object code/executable  Compilation may occur in any environment  NOT all code must compile (e.g., asp) Migration Process Revisited – Source vs. Executable

Migration Process – Source vs. Executable Diagram

When to Compile – Environments & Segregation of Duties Making Change

 How was timing of compiling significant?  What was the problem with the developer having access only to the source code in Test or Production?  What could be a problem if the unit tester and developer are the same individual? Change Demonstration - Lessons Learned

Source Code Escrow Agreement  A third party holder of source code  Provides source in the event software is no longer supported  Only required if source code not available

 Must confirm what code change processes exist for ALL change types  Example code change types: Program Development/Acquisition - Projects Program Code Change – Enhancement Program Code Change – Bug Fix Maintenance - Technical changes Emergency Code Changes Configuration/Parameter Code Changes Types of Code Changes

 Emergency code change procedures should still maintain some SOD  Full review and approvals post implementation Emergency Code Changes

 Testing of ‘unrelated’ functionality with test data  Required for larger enhancements or projects  Conducted in test or staging environment Regression Testing

Find the Findings Scenario Game!!

 What strategies seemed to identify the most controls/findings?  What made your scenario an effective/ ineffective code change management environment?  What control(s) could have been added? Scenario Game - Lessons Learned

1. A culture that embraces change management 2. Monitor, audit, and document all changes 3. Zero tolerance for unauthorized changes 4. Specific, defined consequences for unauthorized changes 5. Test all changes in a preproduction environment before implementing into production 6. Ensure preproduction environment matches production environment 7. Track and analyze change successes and failures to make future change decisions Seven Habits of Highly Effective IT Organizations