forter / security-101-for-saas-startups

security tips for startups
Other
4.61k stars 292 forks source link

'immutable' #18

Closed joejag closed 7 years ago

joejag commented 7 years ago

Thanks for curating this document. I've learnt a lot from reading it.

I think you can improve the wording in this paragraph:

At this point you should already have automated testing, and (at least semi-) automatic of upgrading and downgrading production versions. The next step is to make sure the production system is immutable. Meaning, any change of code, database, toggles must go through change management (like a pull request, or similar system).

Do you mean to use the word immutable here?

If you are advocating for immutable - which does provide extra security - then I'd update the Meaning, any to Meaning a server that is once deployed, is never modified, merely replaced with a new updated instance. Any change of code, database, toggles must go through change management (like a pull request, or similar system)

https://martinfowler.com/bliki/ImmutableServer.html https://martinfowler.com/bliki/PhoenixServer.html

Thanks, Joe.

itaifrenkel commented 7 years ago

got it! thank you so much.