+5.4.2.2 Controls, defaults and verification
|
5.4.2.2 Controls, defaults and verification
This section maps the threats to specific principles and verification methods. | Threat | | Mitigation control (principle) | | Secure by default setting | | Verification method | | T1/T3 | | Attack surface minimisation: use a Distroless build and a strict firewall | | All ports blocked except 443/22; no shell tools (sh, curl) in production | | Nmap scan gate: automated port audit must match the MRSM exposed_ports list | | | T2 | | Least privilege: run app as non-root with Linux capabilities | | App runs as UID 1001; no SUDO rights for the app user | | Systemd audit: automated check of CapabilityBoundingSet in service files | |
| T4 | Strong identity: disable password auth; use signed SSH certificates | PasswordAuthentication no in sshd_config | Config validation: script checks SSH config against hardened baseline before release | | T5 | Vulnerability and patch management: signed updates and immutable file system | Root file system is mounted read-only by default | Mount check: CI test verifies /usr/bin is not writable by any user |
1. Prehľad
1.1 Odkazy
1.2 Identifikované požiadavky
1.3 Súvisiace predpisy
2. Identifikované požiadavky
Požiadavky
| Zdroj |
Požiadavka |
3. Súvisiace predpisy
|