Application Security · AS-Q11

Question: Are secure deployment configurations enforced and verified across all environments?

  1. Objective — Why This Matters
    Insecure defaults during deployment expose hidden risks like verbose error messages, debug APIs, or exposed admin panels.

  2. Maturity Levels (0–5)

0 — Unaware
No environment segregation; configs copied manually.
1 — Ad Hoc
Basic staging setup; no parameter hardening.
2 — Defined
Deployment checklist defined per environment.
3 — Managed
Infrastructure-as-code with security parameters enforced.
4 — Integrated
Automated configuration validation before deploy.
5 — Optimized
Continuous compliance validation and drift correction.
  1. How to Level Up
From → To Actions
0 → 1 Segregate dev/stage/prod; disable debug.
1 → 2 Document config standards per environment.
2 → 3 Deploy via IaC with secure defaults.
3 → 4 Validate configs with scripts/policy-as-code.
4 → 5 Automate drift correction and compliance reports.

  1. People / Process / Technology Enablers
    People – DevOps, AppSec, Cloud Admins.
    Process – Deployment SOPs, config review cycle.
    Technology – Terraform, Ansible, OPA, Checkov.

  2. Evidence Required
    Deployment checklists, IaC templates, validation logs.

  3. Metrics / KPIs
    • percentage of deployments passing config checks
    • number of drift alerts per quarter
    • average time to fix misconfiguration

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
IaC scanning Checkov / Tfsec Detect insecure IaC parameters.
Validation OPA / Conftest Apply config policies pre-deploy.
Monitoring Grafana / Prometheus Track drift metrics.

  1. Common Pitfalls
    No environment segregation; skipping validation for hotfixes.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.9 / A.8.32.
NIST CSF 2.0 PR.IP-1 / PR.DS-6.
CERT-In 2022 Secure deployment requirement.
NIRMATA Scoring AS-Q11 ≥ Level 4 requires automated validation in pipeline.