+5.4.2.2 Controls, defaults and verification
|
5.4.2.2 Controls, defaults and verification
This section maps the threats to specific principles and verification methods. | Threat | | Mitigation control (principle) | | Secure by default setting | | Verification method | | T1/T3 | | Attack surface minimisation: use a Distroless build and a strict firewall | | All ports blocked except 443/22; no shell tools (sh, curl) in production | | Nmap scan gate: automated port audit must match the MRSM exposed_ports list | | | T2 | | Least privilege: run app as non-root with Linux capabilities | | App runs as UID 1001; no SUDO rights for the app user | | Systemd audit: automated check of CapabilityBoundingSet in service files | |
| T4 | Strong identity: disable password auth; use signed SSH certificates | PasswordAuthentication no in sshd_config | Config validation: script checks SSH config against hardened baseline before release | | T5 | Vulnerability and patch management: signed updates and immutable file system | Root file system is mounted read-only by default | Mount check: CI test verifies /usr/bin is not writable by any user |
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|