IaC
Infrastructure as code
Machine-readable definitions used to provision and configure infrastructure, which require review of both source and resulting deployment plans.
- Defined in
- NIST glossary: infrastructure as code
Covered in
Test infrastructure policy and detect security-relevant drift
Connect source configuration, the proposed plan and deployed resources so a safe review does not become stale after deployment.
Review infrastructure changes as access changes
Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Choose and evaluate application security testing tools
What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
Place each security control in the pipeline and decide what it blocks
Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI