Compliance at System and Process levels

System Level Policies

Some of the common malpractices like below can be avoided, monitored using the Validation Framework -

Allowing open access to servers using 0.0.0.0/0

Allowing SSH connections directly from the internet

Minimum restriction on outbound traffic

Leaving databases open to the internet

Allowing direct traffic without load balancers or bastion hosts

Leaving storage in public domain and unencrypted

Using Regions which are not authorized

Common Process Controls

Segregation of Duties (SoD) are performed

Business Owner approvals are received

Key Quality Thresholds are implemented

Mandatory Security Testing activities are performed

Appropriate levels of permissions are maintained

Required Stage Gates are performed