Hardening an operating system is one part of a secure application foundation. Integration, updates and evidence need continuing ownership.
Here is how to assess the work your team should retain and what a maintained platform can take on.
A secure application foundation needs more than a careful initial configuration. The services beneath an application must continue to work securely together as vulnerabilities emerge, dependencies change and updates become available. The evidence used to explain that foundation also needs to remain relevant to the system being delivered.
For organisations developing and operating software critical to society, this is a question of capacity and accountability. Someone must own the work throughout the platform's lifecycle. The choice is how much your team should perform itself, and which responsibilities a supplier can take on.
Selecting good components does not settle how they will operate together. An application may need identity management, a database, web services and security monitoring. Each component has its own configuration and maintenance needs; the connections between them create additional work.
Consider an illustrative application using an identity service and a database.
Choosing both products is one decision. Defining their permissions, integrating them with the application, applying updates and documenting the resulting security configuration are further decisions. Your organisation needs clear ownership for each of them.
A useful platform assessment therefore covers three areas: security hardening and integration; continuing maintenance; and evidence for verification. Assessing only the initial installation leaves much of the lifecycle commitment out of the comparison.
With a self-assembled platform, your team chooses the components and coordinates their hardening, integration, updates and supporting evidence. That can suit requirements demanding extensive customisation, provided the necessary expertise and capacity remain available.
Buying supported software gives you a supplier relationship for the products covered by the agreement. Your team still needs to establish who maintains the wider platform, including configurations and connections between products. Product support and ownership of the integrated foundation are different commitments.
A maintained application platform brings an agreed set of those responsibilities together. Assess the actual product and contract: which components are maintained, what integration is covered, what evidence is supplied, and how product support connects with your operations. The value depends on the work you can reuse over time.
Before choosing an approach, record who owns the operating system, platform components, application integrations, hosting and ongoing operations. Include vulnerability handling, updates, documentation and support in the discussion. For each area, identify the supplier's commitment and the work that remains with your team or service provider.
This makes comparisons more useful. A low initial implementation cost says little about the expertise needed to maintain the result. Equally, a platform subscription should be assessed against its defined scope rather than an assumption that every security task is included.
DeeDee combines a hardened Debian operating system with maintained Integrated components and supporting security evidence. Visar takes defined responsibility for the DeeDee products it supplies, including hardening, integration, updates, documentation and support.
Your application, deployment and complete product or service still need their own assessment and operational ownership. Reusing the foundation gives your team more capacity for those responsibilities and for the capabilities customers need.
Bring an application, its required platform services and your security requirements. Together, define what to evaluate, which responsibilities Visar will take on, and what your team will retain.
