Infrastructure
The following guidance applies to managing infrastructure and supporting technologies:
- Operating System (OS)[Recommended]
- Access Control[Mandatory]
- Backup[Mandatory]
- Different environments[Mandatory]
- Monitoring [Mandatory]
- Auditing [Mandatory]
Operating System (OS)[Recommended]
Linux-based Operating systems are recommended and the same version of the OS must be installed in all environments.
Access Control[Mandatory]
SSH login for root user must be disabled and a dedicated user with sudo access for CI/CD pipelines and automation must be created and used. All users must use passwordless authentication to access the servers. User access to software and database must be configured to allow strict access to software and database needed by their applications only.
Backup[Mandatory]
Regular backup of data and of the whole OS must be taken and this task must be automated.
Different environments[Mandatory]
Different environments must be available for deployment of applications in development, testing and production. Access to these environments must be given to very few persons and they must use personalized login credentials. The web server must also be configured as a bastion server for each environment.
Monitoring [Mandatory]
Monitoring tools for infrastructure must be available and configured with alerts for when servers malfunction.
Auditing [Mandatory]
Each server must be configured to track and log each access to the server. These access logs must be available on an additional different server for failover.