19 docs tagged with "iac"

Prescriptive validation, evidence and control strategies to ensure a secure, auditable and verifiable adoption of Infrastructure as Code.

A case study demonstrating the integrated, authorship-independent application of Security in Infrastructure as Code practices throughout the whole lifecycle.

The single index of all security verification in SbD-ToE — activity × type × oracle × chapter × risk level — distinguishing testing (behavioural oracle) from analysis/scanning (lookup/policy oracle).

Examples of how to implement toolchain principles with different tools

Annotated examples of code and secure practices to apply in Infrastructure as Code repositories.

Specifics of exception management in the context of Infrastructure as Code - policy engines, enforcement and TTL

Technical and organisational mechanisms to ensure automatic enforcement of security policies in IaC pipelines.

Practical integration of IaC security practices into the SDLC, with proportionality by risk, reusable user stories and auditable evidence

Security practices for the definition, validation and management of infrastructure as code

Canonical catalogue of security requirements for IaC projects (IAC-001 to IAC-013), organised by risk level, with acceptance criteria for the governance of repositories, pipelines, state, modules and configuration drift.

Technical and operational indicators for assessing the effectiveness of security controls in Infrastructure as Code, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Prescriptive practices for the governance, validation and control of reusable modules in IaC, ensuring security, provenance and traceability.

Planning and control strategies to ensure an effective and auditable adoption of security practices in Infrastructure as Code.

Why this chapter is exceptional, which sources support the IaC requirements catalogue and how to create/adapt the organisational catalogue

Binary and auditable checklist to verify the practical application of the security prescriptions for IaC.

Interpretation of Security by Design principles in the specific context of Infrastructure as Code.

Techniques to ensure traceability of changes, use of tagging and secure version management in IaC.

Practical upskilling for technical teams that develop, review or operate IaC projects securely

Prescriptive rules for the secure use of automation/assistance in writing and changing IaC, with validations and evidence by risk level