Making sure the same finding never comes back

The security team scanned four clouds with CSPM (a cloud configuration checking tool) and handed over a list of findings. I was the main owner of sorting and fixing them.

The first-year remediation rate was about 60%. Some items were postponed because fixing them could affect the live service.

1. Sort by service impact

Select a cell to see how it is handled.

2. When blocking is not possible, agree on compensating controls

One finding said to close a port entirely, but the service was actively using that port.

Instead of choosing between “block” and “keep”, I proposed another way to reduce the risk.

• Restrict source access to only the required IP ranges
• Add WAF (web application firewall) rules on web paths

Exposure shrank from “the whole internet” to “the required ranges”, so the security team accepted it, and the dev team could apply it with no service change.

3. Repeated findings become Terraform defaults

If people fix findings by hand every time, the same problem returns with each new resource. So I treated the cause as “the default is not safe” rather than “someone forgot”, and changed the Terraform module defaults themselves. I also created a code review checklist.

Default example (for illustration)

# Block opening admin ports to the whole internet (0.0.0.0/0) at the code stage
variable "admin_ingress_cidrs" {
  type = list(string)
  validation {
    condition     = !contains(var.admin_ingress_cidrs, "0.0.0.0/0")
    error_message = "0.0.0.0/0 is not allowed on admin ports. Specify only the required ranges."
  }
}

# Encrypt disks by default
resource "aws_ebs_volume" "this" {
  encrypted = true
  # ...
}

4. Add a gate to the deployment pipeline

Terraform validate (syntax and configuration check) and plan (preview of changes) became required gates in the GitLab CI/CD and Jenkins pipelines. A change that fails a module’s validation stops here and cannot reach deployment.

Developer code change → terraform validate (failure stops the deployment) → terraform plan → review and checklist → apply

The audit remediation rate rose from about 60% in the first year to over 85% the next year.

New resources now start with safe settings from the beginning.

If a security owner stops at “no”, the conversation ends. Fixes happen when you bring an alternative.

A structure that keeps the problem from coming back matters more than a one-time fix, and it only lasts if the dev team can accept it.