10 docs tagged with "assinatura"

Techniques to generate, sign and validate artefacts with trustworthy provenance, ensuring traceability from build to production.

Generation, versioning and use of SBOMs as evidence of composition, not as proof of security

Principles, practices and controls for building, validating and running images in a secure, auditable and traceable way

Organisational policy that defines the formal process for reviewing and approving IaC execution plans (terraform plan or equivalent) before any apply in staging or production environments, including segregation of duties, plan signing, dual approval and execution windows, proportional to the criticality level (L1, L2, L3).

Validation of the provenance and integrity of container images as technical evidence, not as an execution decision

Technical and operational indicators for the assessment of the effectiveness of security controls in container images and orchestration environments, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Organisational policy that defines the requirements for the generation, format, signing, provenance, archiving and retention of SBOMs (Software Bill of Materials) in software, container and IaC builds, proportional to the application's criticality level (L1, L2, L3).

Organisational policy that defines the security requirements for continuous integration and delivery pipelines, including mandatory gates, integrated scanners, environment separation, artefact signing, secrets management in the pipeline and promotion approvals, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the security requirements for the building, scanning, signing, runtime configuration and management of container images, including securityContext hardening, admission policies in Kubernetes, network isolation and runtime monitoring, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the security requirements for the definition, validation, execution and maintenance of Infrastructure as Code (IaC), including configuration scanning, policy-as-code, environment separation, drift control, approved modules and plan signing, proportional to the criticality level (L1, L2, L3).