+5.4.2.2 Controls, defaults and verification

5.4.2.2 Controls, defaults and verification

This section maps the threats to specific principles and verification methods.

	Threat		Mitigation control (principle)		Secure by default setting		Verification method
T1/T3		Attack surface minimisation: use a Distroless build and a strict firewall		All ports blocked except 443/22; no shell tools (sh, curl) in production		Nmap scan gate: automated port audit must match the MRSM exposed_ports list
T2		Least privilege: run app as non-root with Linux capabilities		App runs as UID 1001; no SUDO rights for the app user		Systemd audit: automated check of CapabilityBoundingSet in service files

T4	Strong identity: disable password auth; use signed SSH certificates	PasswordAuthentication no in sshd_config	Config validation: script checks SSH config against hardened baseline before release
T5	Vulnerability and patch management: signed updates and immutable file system	Root file system is mounted read-only by default	Mount check: CI test verifies /usr/bin is not writable by any user

1. Übersicht

Bezeichnung	Standard

Anforderungen
Quelle	Anforderung

Regulierungen
Quelle	Regulierung

ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.