13.4.6 / v5.0.be-14.1.5 - known good state

[elarlang]

#	Description	Level	#v5.0.be
13.4.6	Verify that deployed environments are short-lived and frequently redeployed to a "known good" but updated state. Alternatively, long-lived environments must have a "drift prevention" mechanism to ensure that deployed configurations are not changed to an insecure state.	3	v5.0.be-14.1.5

It requires to implement certain solution, but not to address the actual problem that seems to be "ensure that deployed configurations are not changed to an insecure state".

[jmanico]

I think this is a fair observation. If you want to keep this around, I would suggest we state the first, like:

13.4.6 Verify that the integrity and security posture of deployed environments are maintained over time, ensuring that configurations do not drift to an insecure state. Examples of this include using short-lived environments that are frequently redeployed from a secure baseline ("known good state") or employing drift prevention mechanisms for long-lived environments.

[tghosth]

Created #2973 based on @jmanico's proposal

[elarlang]

I can merge in the improved wording, but the question is - is it realistic to be tested and verifiable?

[jmanico]

How about this Elar? A more verifiable version might be:

13.4.6 Verify that mechanisms are in place to detect and respond to configuration drift in deployed environments. This may include using immutable infrastructure, automated redeployment from a secure baseline, or drift detection tools that compare current state against approved configurations.

The tools I use for this include:

• Terraform with drift detection (terraform plan, terraform validate)
• Immutable infrastructure patterns (e.g., AWS AMIs, containers)
• Configuration management systems with drift detection (e.g., Chef, Puppet, Ansible, or Kubernetes GitOps tools like ArgoCD or Flux)

[elarlang]

If you both think that this is actionable and verifiable requirement I'm ok to close this out. I don't have enough experience with this to have a strong opinion on the content, just concerns for the requirement in ASVS.

[jmanico]

I think a push to make this more verifiable is sensible, I'm happy to modify this more to make it more verifiable. It's a good push.

[tghosth]

I like @jmanico's wording so I opened #2980