🔥 They're INVISIBLE:
   You can't scan your code for them — they live in configs, flags, and defaults.

🔥 They SCALE:
   One Terraform module copied across 50 services = 50 vulnerable services.

🔥 They're PERSISTENT:
   Once deployed, nobody revisits them. They sit there, for years, waiting.

🔥 They're EXPLOITED AUTOMATICALLY:
   Bots scan the entire internet for misconfigured S3 buckets, exposed APIs,
   default credentials, and open dashboards. 24/7. Non-stop.

🔥 They DEFEAT ALL OTHER CONTROLS:
   You can have perfect code, encrypted databases, and MFA on everything.
   One misconfigured firewall rule exposes it all.

Security Misconfiguration = Any security setting that is:
   • Not set when it should be
   • Set incorrectly
   • Left at an insecure default
   • Forgotten after initial deployment
   • Inconsistent across environments
   • Overly permissive

Example: MongoDB installed with default settings
  → Listens on 0.0.0.0 (all interfaces, including public internet)
  → No authentication required
  → All collections readable/writable to anyone

Developer: "The app connects to the database. It works. Done!"
→ Default settings remain
→ Debug mode left ON
→ Admin interface accessible publicly
→ Nobody runs a hardening checklist

Developer: "Before I move on, let me run the hardening checklist."
→ Bind to localhost only
→ Enable authentication
→ Disable debug mode
→ Restrict admin interface by IP
→ Enable encryption
→ Review every setting

Shodan.io, Censys, ZoomEye continuously scan every IP on the internet.
They catalog:
  - Open ports
  - Service versions
  - Default pages
  - Exposed databases
  - Admin panels
  - Misconfigured S3 buckets

Attackers subscribe to these services and get real-time alerts
when new vulnerable targets appear.

Average time from exposure to exploitation:
  - Open database:         < 1 hour
  - Default credentials:   < 24 hours
  - Public S3 bucket:      < 7 days (depending on content value)
  - Exposed admin panel:   < 48 hours

"Company X leaks 100 million customer records due to 
 misconfigured database"

Setting: "Allow public access to blob"
         Default: ✅ Enabled

Result: 2.4 TB of data exposed, including:
  - Customer names, emails, phone numbers
  - Company names
  - Internal communications
  - Proof of Concept documents
  - Signed Statements of Work (SOWs)

Impact: 65,000+ companies affected across 111 countries

Two buckets exposed:
  1. Cultura Colectiva bucket:    146 GB — 540 million records
  2. "At the Pool" bucket:        Fewer records but included passwords
  
All data was accessible WITHOUT any authentication.
Just a URL and a browser.

❌ Misconfiguration 1: Expired SSL certificate on monitoring tool
   → Attackers' encrypted exfiltration went UNDETECTED for 76 days
   → Monitoring tool couldn't inspect encrypted traffic without a valid cert

❌ Misconfiguration 2: Overly broad network access
   → Once inside, attackers moved laterally to 48 databases

❌ Misconfiguration 3: Credentials stored in plaintext files
   → Attackers found database credentials in a plaintext config

❌ Misconfiguration 4: No multi-factor authentication on admin accounts
   → Lateral movement was trivial once initial access was gained

❌ Misconfiguration 5: Unpatched Apache Struts (ironic — a config issue)
   → Patch was available 2 months before the breach

🔴 Someone made a configuration decision (or non-decision)
🔴 That decision was NEVER reviewed
🔴 No automated check caught it
🔴 It was exploited within days/weeks
🔴 By the time it was discovered, massive damage was done

🔴 EXAMPLES:

"text-slate-500 font-normal italic"># Overly permissive file
chmod 777 /etc/shadow                 "text-slate-500 font-normal italic"># Everyone can read password hashes

"text-slate-500 font-normal italic"># World-writable config
chmod 666 /app/config/database.yml    "text-slate-500 font-normal italic"># Anyone can modify database config

"text-slate-500 font-normal italic"># S3 bucket with public write
"Effect": "Allow",
"Principal": "*",
"Action": "s3:PutObject"              "text-slate-500 font-normal italic"># Anyone can upload files

"text-slate-500 font-normal italic"># Database with world access
GRANT ALL PRIVILEGES ON *.* TO 'app'@'%'  "text-slate-500 font-normal italic"># App user can do EVERYTHING

- Debug mode left enabled in production
- Admin interfaces exposed to the internet
- Default passwords unchanged
- Sample applications left installed
- Verbose error messages enabled
- Directory listing enabled
- Unnecessary HTTP methods allowed
- Missing security headers

# 🔴 VULNERABLE
DATABASE_URL = "postgresql://admin:[email protected]/users"
AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"
JWT_SECRET = "my-secret-key-dont-tell"

# These end up in:
# - Git repositories (searchable forever, even if deleted later)
# - Container images
# - Build logs
# - Backup files
# - Developer laptops

Common offenders:
├── admin / admin
├── root / root
├── admin / password
├── admin / <blank>
├── guest / guest
├── Tomcat Manager:    tomcat / s3cret
├── Jenkins:           admin / admin
├── MongoDB:           no password
├── Redis:             no password
├── Elasticsearch:     no auth by default
└── Grafana:           admin / admin

🔴 BAD — Reveals internal structure:

{
  "error": "SQLSTATE[42S02]: Base table or view not found: 1146 
            Table 'prod_db.users_v2' doesn't exist (SQL: select * 
            from `users_v2` where `email` = '[email protected]')",
  "file": "/var/www/html/app/Http/Controllers/AuthController.php",
  "line": 47,
  "trace": [
    "/var/www/html/vendor/laravel/framework/src/Illuminate/Database/..."
  ]
}

Attacker now knows:
  - Database type (MySQL - SQLSTATE 42S02)
  - Database name (prod_db)
  - Table name (users_v2) — implies v1 might also exist
  - Framework (Laravel)
  - File structure (/var/www/html/app/Http/Controllers/)
  - Vulnerability (likely SQL injection point)

Headers you MUST have — but probably don't:

❌ Strict-Transport-Security      (HSTS)
❌ Content-Security-Policy        (CSP)
❌ X-Frame-Options                (Clickjacking)
❌ X-Content-Type-Options         (MIME sniffing)
❌ Referrer-Policy                (Information leakage)
❌ Permissions-Policy             (Feature permissions)
❌ Cross-Origin-Opener-Policy     (COOP)
❌ Cross-Origin-Embedder-Policy   (COEP)

# 🔴 FOUND IN PRODUCTION (true story)
app.run(debug=True, host='0.0.0.0')

# This gives attackers:
# - Interactive Python console on error pages
# - Full stack traces
# - Environment variables
# - LITERAL REMOTE CODE EXECUTION

Common unnecessary features left enabled:
├── Sample applications (e.g., /manager/html on Tomcat)
├── WebDAV on web servers
├── TRACE/TRACK HTTP methods
├── Directory listing (autoindex on)
├── Default error pages exposing server version
├── phpMyAdmin on production
├── Jenkins script console
├── Kubernetes Dashboard with public access
├── Elasticsearch with Kibana publicly accessible
└── Database admin tools (adminer, phpMyAdmin, pgAdmin)

Classic AWS S3 misconfigurations:

❌ Bucket ACL: "Everyone can read"
❌ Bucket Policy: Principal "*" with s3:GetObject
❌ Object ACL: "Public read" on individual objects
❌ Block Public Access: DISABLED at account level
❌ CloudFront OAI not used (direct S3 access allowed)
❌ Versioning disabled (no recovery from deletion)
❌ Logging disabled (no visibility into access)
❌ Encryption not enforced

Why misconfiguration?
Because "disable auto-updates" or "we'll patch later"
IS a configuration decision.

Examples:
- Apache 2.2 still running in 2024 (EOL since 2017)
- PHP 5.6 in production (EOL since 2019)
- OpenSSL versions with known CVEs
- Operating systems past end-of-life
- Container base images never updated

// 🔴 DISASTER
app.use(cors({
    origin: '*',           // ANY origin can call this API
    credentials: true,     // AND with user cookies/tokens
    methods: '*',          // Using ANY HTTP method
    allowedHeaders: '*'    // With ANY headers
}));

// This is equivalent to saying:
// "Anyone on the internet can make authenticated requests to my API"

Common cryptographic misconfigurations:

❌ TLS 1.0 / 1.1 still enabled (should be TLS 1.3 only)
❌ Weak cipher suites (RC4, DES, 3DES, EXPORT)
❌ Self-signed certificates in production
❌ Expired certificates
❌ Database encryption disabled "for performance"
❌ Backups stored unencrypted
❌ Default encryption keys ("CHANGE_ME_IN_PRODUCTION")

Endpoints that MUST have rate limiting but often don't:

❌ /login                    → Enables brute force
❌ /register                 → Enables account spam
❌ /forgot-password          → Enables email enumeration
❌ /api/*                    → Enables scraping and abuse
❌ /verify-otp               → Enables OTP brute force
❌ /2fa                      → Enables 2FA brute force
❌ /search                   → Enables data scraping
❌ /upload                   → Enables storage exhaustion

Day 1:   Developer creates S3 bucket for "temporary file sharing"
Day 1:   Sets bucket to "Public Read" because "it's easier"
Day 2:   Developer uploads customer export (CSV with 500K records)
Day 2:   Forgets to delete it
Day 7:   Automated bucket scanner (BucketStream, S3Scanner) finds it
Day 8:   Attacker downloads the entire bucket
Day 90:  Data appears on dark web
Day 120: Company discovers the breach via security researcher
Day 125: Public disclosure
Day 365: $5M in fines, class action lawsuits begin

// 🔴 THE WORST POLICY EVER WRITTEN (and still very common)
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}
// This grants EVERYTHING to EVERYTHING. Full admin on the account.
// Found in production more often than you'd believe.

// 🟢 PROPERLY SCOPED POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-app-uploads/users/${aws:userid}/*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "us-east-1"
                },
                "Bool": {
                    "aws:SecureTransport": "true"
                },
                "NumericLessThan": {
                    "s3:ContentLength": "5242880"
                }
            }
        }
    ]
}

🔴 THE "I'LL FIX IT LATER" RULE:

Type:        All Traffic
Protocol:    All
Port Range:  All
Source:      0.0.0.0/0  (The entire internet)

Translation: "Anyone, anywhere, on any port, with any protocol
             can connect to this resource."

Found in:
  - Development environments that became production
  - "Temporary" debugging rules
  - Default VPC configurations
  - Copy-pasted Terraform modules

# 🔴 EVERYTHING WRONG WITH THIS DOCKERFILE

FROM ubuntu:latest                       # ❌ "latest" tag = unpredictable
RUN apt-get update && apt-get install -y \
    curl \
    wget \
    netcat \
    nmap \                               # ❌ Attack tools in prod
    && apt-get clean
ADD . /app                               # ❌ ADD vs COPY, no .dockerignore
WORKDIR /app
RUN chmod 777 /app                       # ❌ World-writable
ENV DB_PASSWORD=SuperSecret123           # ❌ Secret in image
EXPOSE 22                                # ❌ SSH in a container
USER root                                # ❌ Running as root
CMD ["python", "app.py", "--debug"]      # ❌ Debug mode

# 🟢 PROPERLY HARDENED DOCKERFILE

FROM python:3.11-slim-bookworm AS builder    # ✅ Specific version, slim base

WORKDIR /build
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

FROM python:3.11-slim-bookworm               # ✅ Multi-stage build

# ✅ Create non-root user
RUN groupadd -r appuser && useradd -r -g appuser -u 1001 appuser

# ✅ Set secure defaults
WORKDIR /app
COPY --from=builder /root/.local /home/appuser/.local
COPY --chown=appuser:appuser . .

# ✅ Switch to non-root user BEFORE running
USER appuser

# ✅ Use PATH to find user-installed packages
ENV PATH=/home/appuser/.local/bin:$PATH \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# ✅ Explicit port, not SSH
EXPOSE 8000

# ✅ Health check for orchestration
HEALTHCHECK --interval=30s --timeout=3s \
    CMD curl -f http://localhost:8000/health || exit 1

# ✅ No debug mode, no shell
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]

# 🔴 DISASTER POD SPECIFICATION

apiVersion: v1
kind: Pod
metadata:
  name: vulnerable-pod
spec:
  hostNetwork: true          # ❌ Pod uses host's network stack
  hostPID: true              # ❌ Pod sees all host processes
  hostIPC: true              # ❌ Pod shares host IPC
  containers:
  - name: app
    image: myapp:latest      # ❌ "latest" tag
    securityContext:
      privileged: true       # ❌ Full root on host
      runAsUser: 0           # ❌ Running as root
      allowPrivilegeEscalation: true
      capabilities:
        add: ["ALL"]         # ❌ All Linux capabilities
    volumeMounts:
    - name: host-root
      mountPath: /host       # ❌ Mounting host filesystem
    env:
    - name: DB_PASSWORD
      value: "SuperSecret"   # ❌ Secret in plaintext
  volumes:
  - name: host-root
    hostPath:
      path: /                # ❌ Entire host filesystem

# 🟢 PROPERLY HARDENED POD SPECIFICATION

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  namespace: production
spec:
  automountServiceAccountToken: false    # ✅ Don't auto-mount SA token
  securityContext:
    runAsNonRoot: true                   # ✅ Enforce non-root
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault               # ✅ Default seccomp profile
  containers:
  - name: app
    image: myregistry.io/myapp:1.2.3@sha256:abc123...  # ✅ Pinned image
    imagePullPolicy: Always              # ✅ Always pull
    securityContext:
      allowPrivilegeEscalation: false    # ✅ No privilege escalation
      readOnlyRootFilesystem: true       # ✅ Read-only root FS
      runAsNonRoot: true
      capabilities:
        drop: ["ALL"]                    # ✅ Drop all capabilities
    resources:                           # ✅ Resource limits set
      requests:
        memory: "128Mi"
        cpu: "100m"
      limits:
        memory: "512Mi"
        cpu: "500m"
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:                    # ✅ Secret from K8s Secrets
          name: db-credentials
          key: password
    livenessProbe:                       # ✅ Health checks
      httpGet:
        path: /health
        port: 8080
      initialDelaySeconds: 30
    readinessProbe:
      httpGet:
        path: /ready
        port: 8080
      initialDelaySeconds: 5
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /var/cache
  volumes:
  - name: tmp
    emptyDir: {}                         # ✅ Writable tmp only
  - name: cache
    emptyDir: {}

"text-slate-500 font-normal italic"># 🟢 THE COMPLETE SET

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin
Cache-Control: no-store, max-age=0
Clear-Site-Data: "cache", "cookies", "storage"

"text-slate-500 font-normal italic"># 🟢 COMPREHENSIVE SECURITY HEADERS IN NGINX

server {
    listen 443 ssl http2;
    server_name example.com;
    
    "text-slate-500 font-normal italic"># ─── TLS Configuration ───
    ssl_protocols TLSv1.3;                    "text-slate-500 font-normal italic"># TLS 1.3 ONLY
    ssl_prefer_server_ciphers off;
    ssl_ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    
    "text-slate-500 font-normal italic"># OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    
    "text-slate-500 font-normal italic"># ─── Security Headers ───
    
    "text-slate-500 font-normal italic"># Force HTTPS for 2 years, include subdomains, allow preloading
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    
    "text-slate-500 font-normal italic"># Prevent MIME sniffing
    add_header X-Content-Type-Options "nosniff" always;
    
    "text-slate-500 font-normal italic"># Prevent clickjacking
    add_header X-Frame-Options "DENY" always;
    
    "text-slate-500 font-normal italic"># Control referrer information
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    "text-slate-500 font-normal italic"># Restrict browser features
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always;
    
    "text-slate-500 font-normal italic"># Content Security Policy (strict)
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests" always;
    
    "text-slate-500 font-normal italic"># Cross-origin isolation
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
    add_header Cross-Origin-Resource-Policy "same-origin" always;
    
    "text-slate-500 font-normal italic"># ─── Hide Server Information ───
    server_tokens off;                        "text-slate-500 font-normal italic"># Don't reveal nginx version
    more_clear_headers 'Server';              # Remove Server header entirely
    more_clear_headers 'X-Powered-By';
    
    "text-slate-500 font-normal italic"># ─── Disable Dangerous HTTP Methods ───
    if ($request_method !~ ^(GET|POST|PUT|DELETE|PATCH|OPTIONS|HEAD)$) {
        return 405;
    }
    
    "text-slate-500 font-normal italic"># ─── Rate Limiting ───
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_req zone=general burst=20 nodelay;
    
    "text-slate-500 font-normal italic"># ─── Hide Specific Paths ───
    location ~ /\. {
        deny all;                             "text-slate-500 font-normal italic"># Block hidden files (.git, .env, etc.)
    }
    
    location ~ \.(log|sql|conf|bak)$ {
        deny all;                             "text-slate-500 font-normal italic"># Block config/log files
    }
}

🔴 BAD — Different configs per environment:
├── dev/      → Debug ON, auth disabled, open CORS
├── staging/  → Different again
└── prod/     → "Hopefully" secure (nobody really knows)

🟢 GOOD — Same structure, different values:
├── config.yaml                    (base config)
├── config.dev.yaml                (dev overrides only)
├── config.staging.yaml            (staging overrides only)
└── config.prod.yaml               (prod overrides only)

Benefit: Testing in dev/staging catches configuration bugs
         before they hit production.

🔴 WRONG:
secrets stored in:
  - Code files
  - Config files
  - Environment variables (in Dockerfiles)
  - Git repositories
  - Slack messages
  - Documentation

🟢 RIGHT:
secrets stored in:
  - HashiCorp Vault
  - AWS Secrets Manager / Parameter Store
  - Azure Key Vault
  - GCP Secret Manager
  - Kubernetes Secrets (encrypted at rest)

Accessed via:
  - IAM roles (not credentials)
  - Service accounts
  - Short-lived tokens
  - Just-in-time access

QUESTION TO ASK FOR EVERY FEATURE/SERVICE/PORT:
"Do we actually need this?"

If the answer is "I'm not sure" or "maybe someday" → DISABLE IT

Examples:
❌ Default sample applications → Remove
❌ Admin interfaces exposed publicly → Internal network only
❌ Unused HTTP methods (PUT, DELETE on static endpoints) → Disable
❌ Legacy TLS versions → Disable
❌ Debug endpoints in production → Remove
❌ Verbose logging in production → Set to WARNING or ERROR
❌ Default accounts → Delete

Operating Systems:
├── CIS Red Hat Enterprise Linux Benchmark
├── CIS Ubuntu Linux Benchmark
├── CIS Microsoft Windows Server Benchmark
└── CIS macOS Benchmark

Web Servers:
├── CIS Apache HTTP Server Benchmark
├── CIS NGINX Benchmark
└── CIS Microsoft IIS Benchmark

Databases:
├── CIS MySQL Benchmark
├── CIS PostgreSQL Benchmark
├── CIS MongoDB Benchmark
├── CIS Oracle Database Benchmark
└── CIS Microsoft SQL Server Benchmark

Cloud:
├── CIS Amazon Web Services Foundations Benchmark
├── CIS Microsoft Azure Foundations Benchmark
└── CIS Google Cloud Platform Foundation Benchmark

Containers:
├── CIS Docker Benchmark
└── CIS Kubernetes Benchmark

Office Suites:
├── CIS Microsoft 365 Benchmark
└── CIS Google Workspace Benchmark

"text-slate-500 font-normal italic"># 🔴 INSECURE TERRAFORM

resource "aws_s3_bucket" "data" {
  bucket = "my-company-data"
  acl    = "public-read"           "text-slate-500 font-normal italic"># ❌ PUBLIC
}

resource "aws_security_group" "web" {
  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]    "text-slate-500 font-normal italic"># ❌ ALL PORTS, OPEN TO WORLD
  }
}

resource "aws_db_instance" "default" {
  engine                 = "mysql"
  publicly_accessible    = true     "text-slate-500 font-normal italic"># ❌ PUBLIC DATABASE
  storage_encrypted      = false    "text-slate-500 font-normal italic"># ❌ UNENCRYPTED
  backup_retention_period = 0       "text-slate-500 font-normal italic"># ❌ NO BACKUPS
  deletion_protection    = false    "text-slate-500 font-normal italic"># ❌ CAN BE ACCIDENTALLY DELETED
  username               = "admin"  "text-slate-500 font-normal italic"># ❌ DEFAULT USERNAME
  password               = "ChangeMe123!"  "text-slate-500 font-normal italic"># ❌ WEAK HARDCODED PASSWORD
}

"text-slate-500 font-normal italic"># 🟢 SECURE TERRAFORM

resource "aws_s3_bucket" "data" {
  bucket = "my-company-data-${random_id.suffix.hex}"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = true    "text-slate-500 font-normal italic"># ✅ Block all public access
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id
  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.data.arn    "text-slate-500 font-normal italic"># ✅ KMS encryption
      sse_algorithm     = "aws:kms"
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration {
    status = "Enabled"               "text-slate-500 font-normal italic"># ✅ Versioning for recovery
  }
}

resource "aws_s3_bucket_logging" "data" {
  bucket        = aws_s3_bucket.data.id
  target_bucket = aws_s3_bucket.logs.id
  target_prefix = "s3-access-logs/"  "text-slate-500 font-normal italic"># ✅ Access logging
}

resource "aws_security_group" "web" {
  name_prefix = "web-sg-"
  description = "Security group for web servers"
  vpc_id      = aws_vpc.main.id
  
  ingress {
    description     = "HTTPS from ALB only"
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]  "text-slate-500 font-normal italic"># ✅ Specific source
  }
  
  egress {
    description = "HTTPS to internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = {
    Name = "web-sg"
  }
}

resource "aws_db_instance" "default" {
  identifier = "production-db"
  engine     = "mysql"
  engine_version = "8.0.35"
  instance_class = "db.t3.medium"
  
  "text-slate-500 font-normal italic"># Storage
  allocated_storage     = 100
  storage_type          = "gp3"
  storage_encrypted     = true                      "text-slate-500 font-normal italic"># ✅ Encrypted at rest
  kms_key_id            = aws_kms_key.rds.arn
  
  "text-slate-500 font-normal italic"># Credentials from Secrets Manager
  username = jsondecode(data.aws_secretsmanager_secret_version.db.secret_string)["username"]
  password = jsondecode(data.aws_secretsmanager_secret_version.db.secret_string)["password"]
  
  "text-slate-500 font-normal italic"># Network
  publicly_accessible    = false                    "text-slate-500 font-normal italic"># ✅ PRIVATE
  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.db.id]
  
  "text-slate-500 font-normal italic"># Backup
  backup_retention_period = 30                      "text-slate-500 font-normal italic"># ✅ 30 days of backups
  backup_window          = "03:00-04:00"
  copy_tags_to_snapshot  = true
  
  "text-slate-500 font-normal italic"># Maintenance
  auto_minor_version_upgrade = true                 "text-slate-500 font-normal italic"># ✅ Auto security patches
  maintenance_window         = "mon:04:00-mon:05:00"
  
  "text-slate-500 font-normal italic"># Protection
  deletion_protection      = true                   "text-slate-500 font-normal italic"># ✅ Can't be deleted
  skip_final_snapshot      = false
  final_snapshot_identifier = "production-db-final"
  
  "text-slate-500 font-normal italic"># Monitoring
  monitoring_interval = 60                          "text-slate-500 font-normal italic"># ✅ Enhanced monitoring
  monitoring_role_arn = aws_iam_role.rds_monitoring.arn
  
  "text-slate-500 font-normal italic"># Logging
  enabled_cloudwatch_logs_exports = ["audit", "error", "general", "slowquery"]
  
  "text-slate-500 font-normal italic"># Performance insights
  performance_insights_enabled    = true
  performance_insights_kms_key_id = aws_kms_key.rds.arn
}

// ══════════════════════════════════════════════════════════════
// 🔴 INSECURE EXPRESS APPLICATION
// ══════════════════════════════════════════════════════════════

const express = require('express');
const app = express();

// ❌ No security middleware
// ❌ Error details leaked
// ❌ Default error handler

app.use(express.json({ limit: '100mb' }));  // ❌ Huge payload allowed

// ❌ Fully permissive CORS
app.use((req, res, next) => {
    res.header('Access-Control-Allow-Origin', '*');
    res.header('Access-Control-Allow-Methods', '*');
    res.header('Access-Control-Allow-Headers', '*');
    next();
});

app.get('/api/user/:id', (req, res) => {
    db.query(`SELECT * FROM users WHERE id = ${req.params.id}`, 
        (err, result) => {
            if (err) {
                res.status(500).json({
                    error: err.message,          // ❌ Leaks DB errors
                    stack: err.stack             // ❌ Leaks stack trace
                });
                return;
            }
            res.json(result);
        }
    );
});

// ❌ Debug info endpoint accessible
app.get('/debug', (req, res) => {
    res.json({
        env: process.env,                        // ❌ Leaks ALL env vars
        version: process.version,
        platform: process.platform
    });
});

app.listen(3000, '0.0.0.0');                     // ❌ Binds to all interfaces


// ══════════════════════════════════════════════════════════════
// 🟢 SECURE EXPRESS APPLICATION
// ══════════════════════════════════════════════════════════════

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const compression = require('compression');
const { v4: uuidv4 } = require('uuid');

const app = express();

// ✅ Trust proxy for correct IP detection (behind load balancer)
app.set('trust proxy', 1);

// ✅ Disable X-Powered-By header
app.disable('x-powered-by');

// ✅ Security headers via Helmet
app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'"],
            styleSrc: ["'self'", "'unsafe-inline'"],
            imgSrc: ["'self'", "data:", "https:"],
            connectSrc: ["'self'"],
            fontSrc: ["'self'"],
            objectSrc: ["'none'"],
            mediaSrc: ["'self'"],
            frameSrc: ["'none'"],
            upgradeInsecureRequests: []
        }
    },
    hsts: {
        maxAge: 63072000,
        includeSubDomains: true,
        preload: true
    },
    crossOriginEmbedderPolicy: true,
    crossOriginOpenerPolicy: { policy: "same-origin" },
    crossOriginResourcePolicy: { policy: "same-origin" }
}));

// ✅ Strict CORS — whitelist only
const allowedOrigins = [
    'https://app.example.com',
    'https://admin.example.com'
];

app.use(cors({
    origin: (origin, callback) => {
        // Allow requests with no origin (mobile apps, Postman)
        if (!origin) return callback(null, true);
        if (allowedOrigins.includes(origin)) {
            callback(null, true);
        } else {
            callback(new Error('Not allowed by CORS'));
        }
    },
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
    allowedHeaders: ['Content-Type', 'Authorization'],
    maxAge: 86400
}));

// ✅ Body parser with REASONABLE limits
app.use(express.json({ limit: '100kb' }));
app.use(express.urlencoded({ extended: true, limit: '100kb' }));

// ✅ Rate limiting
const generalLimiter = rateLimit({
    windowMs: 15 * 60 * 1000,   // 15 minutes
    max: 100,                   // 100 requests per window
    standardHeaders: true,
    legacyHeaders: false,
    message: 'Too many requests, please try again later.'
});

const strictLimiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 5,                     // Stricter for sensitive endpoints
    skipSuccessfulRequests: true
});

app.use('/api/', generalLimiter);
app.use('/api/auth/', strictLimiter);

// ✅ Compression (gzip)
app.use(compression());

// ✅ Request ID for tracing
app.use((req, res, next) => {
    req.id = uuidv4();
    res.setHeader('X-Request-ID', req.id);
    next();
});

// ✅ Structured logging
app.use((req, res, next) => {
    logger.info({
        request_id: req.id,
        method: req.method,
        url: req.url,
        ip: req.ip,
        user_agent: req.get('user-agent')
    });
    next();
});

// ✅ Routes with parameterized queries
app.get('/api/user/:id', async (req, res) => {
    try {
        // ✅ Input validation
        const id = parseInt(req.params.id, 10);
        if (isNaN(id) || id < 1) {
            return res.status(400).json({ error: 'Invalid user ID' });
        }
        
        // ✅ Parameterized query
        const result = await db.query(
            'SELECT id, email, name FROM users WHERE id = $1',
            [id]
        );
        
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'User not found' });
        }
        
        res.json(result.rows[0]);
    } catch (err) {
        // ✅ Log internally, generic message externally
        logger.error({
            request_id: req.id,
            error: err.message,
            stack: err.stack
        });
        res.status(500).json({
            error: 'Internal server error',
            request_id: req.id
        });
    }
});

// ✅ Health check (no sensitive info)
app.get('/health', (req, res) => {
    res.json({ status: 'ok', timestamp: Date.now() });
});

// ✅ 404 handler
app.use((req, res) => {
    res.status(404).json({ error: 'Not found' });
});

// ✅ Global error handler (NO stack traces to users)
app.use((err, req, res, next) => {
    logger.error({
        request_id: req.id,
        error: err.message,
        stack: err.stack
    });
    
    res.status(err.status || 500).json({
        error: process.env.NODE_ENV === 'production'
            ? 'An error occurred'
            : err.message,
        request_id: req.id
    });
});

// ✅ Bind to localhost in dev, specific interface in prod
const HOST = process.env.HOST || '127.0.0.1';
const PORT = process.env.PORT || 3000;

const server = app.listen(PORT, HOST, () => {
    logger.info(`Server listening on ${HOST}:${PORT}`);
});

// ✅ Graceful shutdown
process.on('SIGTERM', () => {
    logger.info('SIGTERM received, shutting down gracefully');
    server.close(() => {
        logger.info('Server closed');
        process.exit(0);
    });
});

# ══════════════════════════════════════════════════════════════
# 🔴 INSECURE FLASK APPLICATION
# ══════════════════════════════════════════════════════════════

from flask import Flask, request, jsonify
import os

app = Flask(__name__)
app.config['SECRET_KEY'] = 'dev-key-123'           # ❌ Hardcoded weak key

@app.route('/api/exec')
def execute():
    cmd = request.args.get('cmd')
    result = os.popen(cmd).read()                  # ❌ COMMAND INJECTION
    return result

@app.errorhandler(500)
def error(e):
    return str(e), 500                             # ❌ Leaks internal errors

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0', port=5000) # ❌ Debug mode in prod!
    # Debug mode exposes an interactive Python console on error pages
    # = REMOTE CODE EXECUTION


# ══════════════════════════════════════════════════════════════
# 🟢 SECURE FLASK APPLICATION
# ══════════════════════════════════════════════════════════════

import os
import secrets
import logging
from flask import Flask, request, jsonify, abort
from flask_talisman import Talisman
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
from werkzeug.middleware.proxy_fix import ProxyFix

# ✅ Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
)
logger = logging.getLogger(__name__)

app = Flask(__name__)

# ✅ Load secrets from environment / secrets manager
app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
if not app.config['SECRET_KEY']:
    raise RuntimeError("SECRET_KEY environment variable not set")

# ✅ Secure session configuration
app.config.update(
    SESSION_COOKIE_SECURE=True,            # HTTPS only
    SESSION_COOKIE_HTTPONLY=True,          # No JavaScript access
    SESSION_COOKIE_SAMESITE='Strict',      # CSRF protection
    PERMANENT_SESSION_LIFETIME=1800,       # 30 minutes
    SESSION_COOKIE_NAME='__Secure-session',
    MAX_CONTENT_LENGTH=1 * 1024 * 1024    # 1MB request limit
)

# ✅ Proxy fix for correct IP behind load balancer
app.wsgi_app = ProxyFix(
    app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_prefix=1
)

# ✅ Security headers via Talisman
csp = {
    'default-src': "'self'",
    'script-src': "'self'",
    'style-src': ["'self'", "'unsafe-inline'"],
    'img-src': ["'self'", 'data:', 'https:'],
    'object-src': "'none'",
    'frame-ancestors': "'none'",
    'base-uri': "'self'",
    'form-action': "'self'"
}

Talisman(
    app,
    content_security_policy=csp,
    force_https=True,
    strict_transport_security=True,
    strict_transport_security_max_age=63072000,
    strict_transport_security_include_subdomains=True,
    strict_transport_security_preload=True,
    session_cookie_secure=True,
    session_cookie_http_only=True,
    frame_options='DENY',
    referrer_policy='strict-origin-when-cross-origin'
)

# ✅ Rate limiting
limiter = Limiter(
    app=app,
    key_func=get_remote_address,
    default_limits=["200 per hour", "50 per minute"],
    storage_uri="redis://localhost:6379"
)

# ✅ Remove server identification
@app.after_request
def remove_server_header(response):
    response.headers['Server'] = ''
    return response

# ✅ Secure endpoint example
@app.route('/api/data/<int:data_id>')
@limiter.limit("30 per minute")
def get_data(data_id):
    # ✅ Input validation (int type via route converter)
    if data_id < 1 or data_id > 1000000:
        abort(400, description="Invalid ID")
    
    try:
        # ✅ Parameterized query (via ORM or prepared statement)
        data = Data.query.filter_by(id=data_id).first()
        if not data:
            abort(404)
        
        # ✅ Authorization check
        if not current_user.can_access(data):
            abort(403)
        
        return jsonify(data.to_safe_dict())
    except Exception as e:
        # ✅ Log internally
        request_id = secrets.token_hex(8)
        logger.error(f"[{request_id}] Error in get_data: {e}", exc_info=True)
        # ✅ Return generic error with reference
        return jsonify({
            "error": "An unexpected error occurred",
            "request_id": request_id
        }), 500

# ✅ Custom error handlers (no information leakage)
@app.errorhandler(400)
def bad_request(e):
    return jsonify({"error": "Bad request"}), 400

@app.errorhandler(401)
def unauthorized(e):
    return jsonify({"error": "Unauthorized"}), 401

@app.errorhandler(403)
def forbidden(e):
    return jsonify({"error": "Forbidden"}), 403

@app.errorhandler(404)
def not_found(e):
    return jsonify({"error": "Not found"}), 404

@app.errorhandler(429)
def ratelimit_handler(e):
    return jsonify({
        "error": "Rate limit exceeded",
        "retry_after": e.retry_after
    }), 429

@app.errorhandler(500)
def internal_error(e):
    request_id = secrets.token_hex(8)
    logger.error(f"[{request_id}] Internal error", exc_info=True)
    return jsonify({
        "error": "Internal server error",
        "request_id": request_id
    }), 500

# ✅ Health check endpoint (minimal info)
@app.route('/health')
def health():
    return jsonify({"status": "ok"}), 200

# ✅ NEVER run with Flask's dev server in production
# Use gunicorn/uwsgi instead
if __name__ == '__main__':
    # Development only
    if os.environ.get('FLASK_ENV') != 'development':
        raise RuntimeError(
            "Do NOT use Flask's dev server in production. "
            "Use gunicorn: 'gunicorn -w 4 -b 0.0.0.0:8000 app:app'"
        )
    app.run(debug=False, host='127.0.0.1', port=5000)

"text-slate-500 font-normal italic"># 🟢 PRODUCTION-READY SECURE NGINX CONFIG

"text-slate-500 font-normal italic"># ─── Global Settings ───
user www-data;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    multi_accept on;
    worker_connections 65535;
}

http {
    "text-slate-500 font-normal italic"># ─── Hide Nginx version ───
    server_tokens off;
    more_clear_headers 'Server';
    
    "text-slate-500 font-normal italic"># ─── MIME types ───
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    "text-slate-500 font-normal italic"># ─── Logging ───
    log_format main_ext '$remote_addr - $remote_user [$time_local] '
                        '"$request" $status $body_bytes_sent '
                        '"$http_referer" "$http_user_agent" '
                        '$request_id';
    
    access_log /var/log/nginx/access.log main_ext;
    error_log /var/log/nginx/error.log warn;
    
    "text-slate-500 font-normal italic"># ─── Performance ───
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 100;
    reset_timedout_connection on;
    
    "text-slate-500 font-normal italic"># ─── Buffer sizes (prevent buffer overflow attacks) ───
    client_body_buffer_size 1k;
    client_header_buffer_size 1k;
    client_max_body_size 1m;
    large_client_header_buffers 2 1k;
    
    "text-slate-500 font-normal italic"># ─── Timeouts (prevent slowloris attacks) ───
    client_body_timeout 10;
    client_header_timeout 10;
    send_timeout 10;
    
    "text-slate-500 font-normal italic"># ─── Gzip (secure config) ───
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript;
    "text-slate-500 font-normal italic"># ❌ NEVER enable gzip for HTML with sensitive data (BREACH attack)
    
    "text-slate-500 font-normal italic"># ─── Rate Limiting Zones ───
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
    limit_req_zone $binary_remote_addr zone=api:10m rate=30r/s;
    
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    
    "text-slate-500 font-normal italic"># ─── SSL/TLS Global Settings ───
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 1.0.0.1 valid=300s;
    resolver_timeout 5s;
    
    "text-slate-500 font-normal italic"># ─── HTTP → HTTPS Redirect ───
    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        return 301 https:"text-slate-500 font-normal italic">//$host$request_uri;
    }
    
    "text-slate-500 font-normal italic"># ─── Main HTTPS Server ───
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name example.com www.example.com;
        
        "text-slate-500 font-normal italic"># ─── Certificate ───
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
        
        "text-slate-500 font-normal italic"># ─── Security Headers ───
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests" always;
        add_header Cross-Origin-Opener-Policy "same-origin" always;
        add_header Cross-Origin-Embedder-Policy "require-corp" always;
        add_header Cross-Origin-Resource-Policy "same-origin" always;
        
        "text-slate-500 font-normal italic"># ─── Request Limits ───
        limit_req zone=general burst=20 nodelay;
        limit_conn addr 10;
        
        "text-slate-500 font-normal italic"># ─── Allowed HTTP Methods ───
        if ($request_method !~ ^(GET|POST|PUT|DELETE|PATCH|OPTIONS|HEAD)$) {
            return 405;
        }
        
        "text-slate-500 font-normal italic"># ─── Block Hidden Files ───
        location ~ /\.(?!well-known) {
            deny all;
            access_log off;
            log_not_found off;
        }
        
        "text-slate-500 font-normal italic"># ─── Block Sensitive File Extensions ───
        location ~ \.(log|sql|conf|bak|old|orig|save|swo|swp|~|yml|yaml)$ {
            deny all;
            access_log off;
        }
        
        "text-slate-500 font-normal italic"># ─── Block User-Agents ───
        if ($http_user_agent ~* (nmap|nikto|wikto|sf|sqlmap|bsqlbf|w3af|acunetix|havij|appscan)) {
            return 403;
        }
        
        "text-slate-500 font-normal italic"># ─── Login Endpoint — Stricter Rate Limiting ───
        location /login {
            limit_req zone=login burst=5 nodelay;
            proxy_pass http:"text-slate-500 font-normal italic">//app_backend;
        }
        
        "text-slate-500 font-normal italic"># ─── API Endpoints ───
        location /api/ {
            limit_req zone=api burst=50 nodelay;
            proxy_pass http:"text-slate-500 font-normal italic">//app_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Request-ID $request_id;
        }
        
        "text-slate-500 font-normal italic"># ─── Static Files ───
        location /static/ {
            alias /var/www/static/;
            expires 1y;
            add_header Cache-Control "public, immutable";
            access_log off;
        }
        
        "text-slate-500 font-normal italic"># ─── Default — Reverse Proxy ───
        location / {
            proxy_pass http:"text-slate-500 font-normal italic">//app_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Request-ID $request_id;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }
        
        "text-slate-500 font-normal italic"># ─── Custom Error Pages (no leaks) ───
        error_page 400 401 402 403 404 /error.html;
        error_page 500 501 502 503 504 /error.html;
        
        location = /error.html {
            internal;
            root /var/www/errors;
        }
    }
    
    "text-slate-500 font-normal italic"># ─── Catch-all for other hosts ───
    server {
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;
        server_name _;
        ssl_reject_handshake on;
        return 444;    "text-slate-500 font-normal italic"># Close connection without response
    }
}

Online scanners (just paste your URL):
├── https:"text-slate-500 font-normal italic">//securityheaders.com     — Mozilla / Scott Helme
├── https:"text-slate-500 font-normal italic">//observatory.mozilla.org — Mozilla Observatory
├── https:"text-slate-500 font-normal italic">//www.ssllabs.com/ssltest — SSL/TLS testing
├── https:"text-slate-500 font-normal italic">//hstspreload.org         — HSTS preload status
└── https:"text-slate-500 font-normal italic">//csp-evaluator.withgoogle.com — CSP evaluator

"text-slate-500 font-normal italic"># Discover open ports and services
nmap -sV -sC -O target.example.com

"text-slate-500 font-normal italic"># Detect default credentials
nmap --script http-default-accounts target.example.com

"text-slate-500 font-normal italic"># Scan for common misconfigurations
nmap --script "default,safe,vuln" target.example.com

"text-slate-500 font-normal italic"># Check for exposed admin interfaces
nmap --script http-enum target.example.com

┌─────────────────────────────────────────────────────────────┐
│                                                             │
│  Rule 1: 🧐 ASSUME DEFAULTS ARE INSECURE                    │
│          → Every new service, every new resource,           │
│            every new feature starts in an insecure state.   │
│                                                             │
│  Rule 2: 🤖 AUTOMATE EVERYTHING                             │
│          → Config as code. IaC scanning. Policy as code.    │
│            If a human has to remember it, it will be        │
│            forgotten.                                       │
│                                                             │
│  Rule 3: 🔄 CONTINUOUSLY MONITOR                            │
│          → Configuration drift is inevitable.               │
│            Detect it in real-time. Alert on changes.        │
│            Auto-remediate where possible.                   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

┌────────────────────────────────────────────────────────────────────┐
│                   MISCONFIGURATION BREACH COSTS                    │
├────────────────────────────────────────────────────────────────────┤
│                                                                    │
│  Average breach cost (misconfiguration):          $4.14 MILLION   │
│  Average S3 bucket exposure duration:             90 DAYS         │
│  % of breaches detected by third parties:         65%             │
│  % of breaches detected within 24 hours:          < 10%           │
│                                                                    │
│  Cost to implement CSPM tool:                     $20K - $200K/yr │
│  ROI of catching ONE prevented breach:            20x - 200x      │
│                                                                    │
│  Sources: IBM, Gartner, Verizon DBIR 2024                         │
└────────────────────────────────────────────────────────────────────┘

Configuration = Code
Code = Reviewable
Reviewable = Testable
Testable = Automatable
Automatable = Continuously Verifiable
Continuously Verifiable = SECURE