+5.4.2.2 Controls, defaults and verification

5.4.2.2 Controls, defaults and verification

This section maps the threats to specific principles and verification methods.

	Threat		Mitigation control (principle)		Secure by default setting		Verification method
T1/T3		Attack surface minimisation: use a Distroless build and a strict firewall		All ports blocked except 443/22; no shell tools (sh, curl) in production		Nmap scan gate: automated port audit must match the MRSM exposed_ports list
T2		Least privilege: run app as non-root with Linux capabilities		App runs as UID 1001; no SUDO rights for the app user		Systemd audit: automated check of CapabilityBoundingSet in service files

T4	Strong identity: disable password auth; use signed SSH certificates	PasswordAuthentication no in sshd_config	Config validation: script checks SSH config against hardened baseline before release
T5	Vulnerability and patch management: signed updates and immutable file system	Root file system is mounted read-only by default	Mount check: CI test verifies /usr/bin is not writable by any user

1. Forbhreathnú

Teideal	Caighdeán

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais
Foinse	Ceanglas

3. Rialacháin ghaolmhara

Rialacháin
Foinse	Rialáil

ENISA -