{"id":19,"date":"2022-09-30T23:28:41","date_gmt":"2022-10-01T04:28:41","guid":{"rendered":"https:\/\/waratek.com\/?page_id=19"},"modified":"2022-10-31T16:38:13","modified_gmt":"2022-10-31T21:38:13","slug":"chapter-3-declarative-and-immutable-security-as-code","status":"publish","type":"page","link":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/","title":{"rendered":"Chapter 3: Declarative and Immutable Security-as-Code"},"content":{"rendered":"<p class=\"p1\">In declarative approaches, you specify the desired final state of the security you want to apply without dictating how to get it.<\/p>\n<p class=\"p1\">This behavior is ideal for CWEs, which refer to software weaknesses rather than specific instances of vulnerabilities within products or systems.<\/p>\n<p class=\"p1\">Declarative programming minimizes the factors that could affect the behavior of a piece of code to ensure that only a function\u2019s input should affect the output, not what\u2019s happening elsewhere in the program.<\/p>\n<p class=\"p1\">This approach enables Security-as-Code\u2019s immutability and makes it possible to prevent vulnerability regressions.<\/p>\n<p class=\"p1\">For example, if SQLi vulnerabilities are rampant in your applications, it\u2019s possible through SaC platforms to declaratively tell your applications that you never want to see another SQLi again.<\/p>\n<p class=\"p1\">From the time you deploy your SQLi rule, there\u2019s no code that developers can add to the codebase that will override your rule.<\/p>\n<p class=\"p1\">Due to the nature of these rules, they inherently remediate zero-days in some instances. This inherent protection is the case for <code>CVE-2022-42889<\/code>, in which the process forking rule is more than sufficient for payloads supplied as Javascript code, as seen below:<\/p>\n<pre class=\"p3\"><span class=\"s1\">app<\/span>(<span class=\"s2\">\"nashorn CVE-2022-42889\"<\/span>)<span class=\"s3\">:<\/span>\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0<\/span><span class=\"s1\"> requires<\/span>(version<span class=\"s3\">:<\/span> ARMR<span class=\"s3\">\/<\/span><span class=\"s4\">2.2<\/span>)\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span><span class=\"s1\">process<\/span>(<span class=\"s2\">\"Deny any process execution\"<\/span>)<span class=\"s3\">:<\/span>\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"s1\">execute<\/span>(<span class=\"s2\">\"*\"<\/span>)\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"s1\">protect<\/span>(message<span class=\"s3\">:<\/span> <span class=\"s2\">\"\"<\/span>, severity<span class=\"s3\">:<\/span> <span class=\"s4\">7<\/span>)\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span><span class=\"s1\">endprocess<\/span>\r\n<span class=\"s1\">endapp<\/span><\/pre>\n<p class=\"p1\">Security-as-Code solutions also provide imperative rules for more involved vulnerabilities like Log4shell (CVE-2021-45105), where conditionality and context are needed.<\/p>\n","protected":false},"excerpt":{"rendered":"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.","protected":false},"author":1,"featured_media":410,"parent":16,"menu_order":3,"comment_status":"closed","ping_status":"closed","template":"template-chapter.blade.php","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"class_list":["post-19","page","type-page","status-publish","has-post-thumbnail","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.7 (Yoast SEO v25.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Chapter 3: Declarative and Immutable Security-as-Code | Waratek<\/title>\n<meta name=\"description\" content=\"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Chapter 3: Declarative and Immutable Security-as-Code | Waratek\" \/>\n<meta property=\"og:description\" content=\"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/\" \/>\n<meta property=\"og:site_name\" content=\"Waratek\" \/>\n<meta property=\"article:modified_time\" content=\"2022-10-31T21:38:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@waratek\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/\",\"url\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/\",\"name\":\"Chapter 3: Declarative and Immutable Security-as-Code | Waratek\",\"isPartOf\":{\"@id\":\"https:\/\/waratek.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png\",\"datePublished\":\"2022-10-01T04:28:41+00:00\",\"dateModified\":\"2022-10-31T21:38:13+00:00\",\"description\":\"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.\",\"breadcrumb\":{\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#primaryimage\",\"url\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png\",\"contentUrl\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/waratek.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security-as-Code: How to with Modern Development\",\"item\":\"https:\/\/waratek.com\/security-as-code\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Chapter 3: Declarative and Immutable Security-as-Code\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/waratek.com\/#website\",\"url\":\"https:\/\/waratek.com\/\",\"name\":\"Waratek\",\"description\":\"Just another WordPress site\",\"publisher\":{\"@id\":\"https:\/\/waratek.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/waratek.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/waratek.com\/#organization\",\"name\":\"Waratek\",\"url\":\"https:\/\/waratek.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/waratek.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png\",\"contentUrl\":\"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png\",\"width\":150,\"height\":31,\"caption\":\"Waratek\"},\"image\":{\"@id\":\"https:\/\/waratek.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/waratek\",\"https:\/\/www.linkedin.com\/company\/waratek-ltd\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Chapter 3: Declarative and Immutable Security-as-Code | Waratek","description":"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/","og_locale":"en_US","og_type":"article","og_title":"Chapter 3: Declarative and Immutable Security-as-Code | Waratek","og_description":"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.","og_url":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/","og_site_name":"Waratek","article_modified_time":"2022-10-31T21:38:13+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_site":"@waratek","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/","url":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/","name":"Chapter 3: Declarative and Immutable Security-as-Code | Waratek","isPartOf":{"@id":"https:\/\/waratek.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#primaryimage"},"image":{"@id":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#primaryimage"},"thumbnailUrl":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png","datePublished":"2022-10-01T04:28:41+00:00","dateModified":"2022-10-31T21:38:13+00:00","description":"Declarative rules tell the machine what should be done. Learn how to use declarative Security-as-Code rules to immutably remediate CWEs.","breadcrumb":{"@id":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#primaryimage","url":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png","contentUrl":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/declarative.png","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/waratek.com\/security-as-code\/chapter-3-declarative-and-immutable-security-as-code\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/waratek.com\/"},{"@type":"ListItem","position":2,"name":"Security-as-Code: How to with Modern Development","item":"https:\/\/waratek.com\/security-as-code\/"},{"@type":"ListItem","position":3,"name":"Chapter 3: Declarative and Immutable Security-as-Code"}]},{"@type":"WebSite","@id":"https:\/\/waratek.com\/#website","url":"https:\/\/waratek.com\/","name":"Waratek","description":"Just another WordPress site","publisher":{"@id":"https:\/\/waratek.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/waratek.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/waratek.com\/#organization","name":"Waratek","url":"https:\/\/waratek.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/waratek.com\/#\/schema\/logo\/image\/","url":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png","contentUrl":"https:\/\/waratek.com\/wp-content\/uploads\/2022\/10\/logo-dark-small.png","width":150,"height":31,"caption":"Waratek"},"image":{"@id":"https:\/\/waratek.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/waratek","https:\/\/www.linkedin.com\/company\/waratek-ltd"]}]}},"_links":{"self":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages\/19","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/comments?post=19"}],"version-history":[{"count":0,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages\/19\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/pages\/16"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/media\/410"}],"wp:attachment":[{"href":"https:\/\/waratek.com\/wp-json\/wp\/v2\/media?parent=19"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}