In environments with many endpoint devices, there should be a golden image made and stored that captures the desired baseline configuration state for company devices.
Control Type: Technical
Control Function: Preventive
A difficult part of managing technology resources in business environments is ensuring all endpoint devices are properly configured to meet business needs. Every organization has its own selection of software and desired device functionality. The more employees and devices an organization has, the more difficult it becomes to implement the desired state for everyone.
Imagine if you had to have IT staff go from device to device to manually configure every application and setting. This is a ridiculous idea and is not how an IT department should be run. To speed up the device provisioning process, organizations often utilize golden images, which are master copies of the organization’s primary operation system, complete with desired applications, settings, and personalization. The golden image serves as a baseline of what workplace devices should look like and behave like.
When organizations purchase individual endpoints for use by employees, they typically buy them in bulk from vendors like Dell, HP, or Lenovo. The classic approach to preparing a golden image is to take one of the bulk devices and configure it down to the finest detail, including things like applications, drivers, web browser configurations, and operating system settings. Once this is completed, the image is captured by any variety of methods, such as an imaging server. Now, when new devices are being prepared, they only need to boot into the central imaging server and pull down the golden image, hence configuring them into baseline state.
The concept of a golden image has many different interpretations according to what IT platforms are being used. Many device settings can be configured from a central location and pushed out to devices automatically, rather than relying on images. For example, device security settings in Windows networks are usually configured in the Group Policy console on a domain controller and then applied to device/user groups. Software can also be pushed out this way. Mobile device management tools like Microsoft Intune allow administrators to prepare granular scripts and deploy them to enrolled devices regardless of location.
Larger organizations often have differing software and configuration needs department by department. For example, if an organization has 100 Windows laptops, and 12 of them are designated for the accounting department, there is no reason to configure all 100 laptops with accounting programs. This is a waste of storage space, not to mention the wasted license costs required. Instead, the organization should make a unique golden image for each department.
Golden images are an important piece of company data, thus they should be clearly tracked and monitored. Servers hosting golden images should be secured and accessible only by IT staff (for example, keeping the imaging server on a Management or IT specific subnet). There should be a clear change and configuration management process in place for golden images. OS and software updates are usually done automatically, however every few years (3 at max), golden images should be rebuilt to encompass the latest versions of software. Changes to golden images should be tested, both by IT staff and in pilot groups, before being pushed out organization wide. In addition to clearly monitoring and documenting changes, the evolution of golden images should be tracked, both in documentation and in some form of version control system.