3

Is there a defacto understanding of what a golden image is? I've had it come up in requirements to satisfy cloud audits. What's the meaning of "Golden" when it comes to audit and compliance, especially for cloud services?

It seems like the word "Golden" has different meanings when it comes to different platforms, for instance you can mark a "Golden Snapshot" in UCS Director.

2
  • Intriguing question, since it may end up having something like a canonical answer, but after a quick google search, it's difficult to find a single definition. Do you think perhaps you could rephrase the question to make it clearer that you are concerned about compliance? Mar 1, 2022 at 8:16
  • @BruceBecker yeah, this was something that came up in an AWS Managed Services Provider audit. One of their criteria is maintaining golden images, but it just sounds like a buzz word.
    – Peter Turner
    Mar 3, 2022 at 15:00

1 Answer 1

3

As noted in the comments there are several applications for the term. This answer focuses on the term as it relates to a compliance audit.

In the context of an audit, a golden image refers to an original image that is used when creating servers in your environment. Based on the reference below:

The term itself comes from the old practice of recordable CDs being manufactured with gold film. Hence the gold colored CD actually being the source

The NIST Risk Management Framework (800-53) refer to golden images as baseline configurations. In 800-53 CM-2:

Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

An example that an auditor would be looking for is a hardened image of a specific OS version that is used to build out other servers in your environment. It demonstrates that your base-build a) has been reviewed, b) has not been altered, and that c) its use is repeatable.

References

What is the Genesis of the Term Golden Master
Golden Image
NIST 800-53 CM-2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.