CME-1201

Immutable Infrastructure

Restore Application Unquantified evidence Corrective

Description

Servers are replaced rather than patched in place. Golden images are built in CI/CD, deployed fresh, and destroyed on replacement. Compromised instances are terminated and redeployed from known-good state.

CVSS Vector Impacts

Metric	Transition	Rationale
Availability (A)	H → L	Compromised instance replaced from known-good image; minimal downtime
Integrity (I)	H → L	Persistent modifications eliminated on next deployment cycle

Verification

Verify deployment pipeline builds from golden images and system root is immutable

$ mount | grep 'on / ' | grep -c 'ro,'
# Expected: 1

Platform: linux

$ rpm-ostree status 2>/dev/null | grep -c 'Version'
# Expected: >=1 (ostree-based immutable OS)

Platform: linux

$ kubectl exec <pod> -- sh -c 'which apt-get yum dnf apk 2>/dev/null | wc -l'
# Expected: 0 (no package manager in container image)

Platform: kubernetes