+5.4.2.2 Controls, defaults and verification

5.4.2.2 Controls, defaults and verification

This section maps the threats to specific principles and verification methods.

	Threat		Mitigation control (principle)		Secure by default setting		Verification method
T1/T3		Attack surface minimisation: use a Distroless build and a strict firewall		All ports blocked except 443/22; no shell tools (sh, curl) in production		Nmap scan gate: automated port audit must match the MRSM exposed_ports list
T2		Least privilege: run app as non-root with Linux capabilities		App runs as UID 1001; no SUDO rights for the app user		Systemd audit: automated check of CapabilityBoundingSet in service files

T4	Strong identity: disable password auth; use signed SSH certificates	PasswordAuthentication no in sshd_config	Config validation: script checks SSH config against hardened baseline before release
T5	Vulnerability and patch management: signed updates and immutable file system	Root file system is mounted read-only by default	Mount check: CI test verifies /usr/bin is not writable by any user

1. Visão geral

Título	Norma

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos
Fonte	Requisito

3. Regulamentos relacionados

Regulamentos
Fonte	Regulamentação

ENISA -