Posture Management, Vulnerability Management, and DevSecOps
Domain 8: Posture Management, Vulnerability Management, and DevSecOps
This domain tests continuous assessment of cloud configuration, vulnerability prioritization, and integrating security into delivery. Expect CSPM, CNAPP, CVSS/EPSS/KEV, policy as code, and CI/CD gates.
Core rules
- CSPM continuously evaluates configuration against benchmarks and policies; it detects drift but does not fix it. Remediation is a separate workflow.
- CNAPP combines posture, workload protection, vulnerability scanning, and identity risk; use it to correlate findings rather than as a single score.
- Prioritize vulnerabilities by exploitability and exposure: internet reachability, data sensitivity, active exploitation (KEV), and EPSS probability. CVSS severity alone is insufficient.
- Shift left with IaC scanning, dependency scanning, secret scanning, and SBOM generation. Enforce gates in CI/CD for high-confidence, high-impact findings.
- Policy as code makes guardrails testable and versioned; pair preventive controls (SCPs, Azure Policy deny) with detective controls.
Worked example
Two findings: a CVSS 9.8 in an internal, non-routable test service with no sensitive data, and a CVSS 7.5 in an internet-facing production API with a known exploited vulnerability. The second is prioritized first because exposure and exploitation trump the higher base score. Reasoning: risk is likelihood times impact; the test service has low reachability and low impact. The team patches the production API, adds a WAF virtual patch as temporary mitigation, and tracks the test finding on a normal SLA.
Traps
- Ranking by CVSS alone and ignoring internet exposure.
- Assuming CSPM findings are automatically remediated.
- Scanning only container images and not host OS or dependencies.
- Letting IaC scanners run without failing the build for critical issues.
- Ignoring identity posture findings such as unused admin roles.