SCENARIO: Joe, your network administrator, is overworked and underpaid. His bags are packed and ready for a family vacation to Disney World when he is tasked with deploying acritical patch. In order to make his flight, Joe quickly builds an installation file for the patch and deploys it before leaving for his trip. Next, Sue, the oncall service desk technician, begins receiving calls that nobody can login. It turns out that no testing was done for the recently installed critical patch.

Discussion questions

1. What should Sue's response be in this scenario?

a. Does Sue have the expertise to handle this incident? What is Sue's level of expertise? (For the purpose of this exercise, make some assumptions about Sue's expertise.)

b. What are the defined escalation processes?

2. Does your organization have a formal change control policy?

a. If yes, briefly describe the existing policy in a paragraph or two.

b. If no, briefly describe in a paragraph or two what the change control policy should contain.

3. How are your employees trained on proper change control?

a. Give a brief over view of the training content and the frequency of training.

b. Are there different levels of proper change control training for different roles in the organization? For example, does training for the network administrator over the identical content as training for the sales and marketing manager?

c. Which department delivers the training Human Resources, Information Technology, Information Security, or a combination? What is the rationale for the training strategy/ approach you describe?

d. Describe your organization's disciplinary procedures for when an employee fails to follow established policies? For example, are there consequences for installing and/ or using unapproved software?

4. Does your organization have the ability to "roll back" patches in the event of unanticipated negative impacts?

a. If yes, describe the existing "rollback" policies and procedures.

b. If no, define appropriate "rollback" policies and procedures that should be implemented.