Secure by default

• Default-deny network and access; open only what is documented.
• No shared accounts; every identity is unique and attributable.
• Encrypt in transit and at rest; modern ciphers only (no deprecated algorithms).
• Patch the base image; golden images are hardened before use.

Configuration baselines

Define a baseline per asset class (Linux server, Windows server, container, network device). Track

drift against the baseline and remediate or formally accept.

Secrets management

• Secrets live in the vault; applications fetch at runtime.
• Rotate on schedule and on any suspicion of exposure.
• Never commit secrets to git - secret-scanning runs on every push.

Drift & integrity

• Alert on file-integrity changes to critical paths.
• Re-apply baselines via IaC; avoid manual snowflake config.

Assume breach: if a control fails silently, defence-in-depth should still catch it. Test that assumption.