Agree completely. To take it a step further - even if you assume that you have all of the above locked down and have inspected all of your servers - someone sti

Agree completely. To take it a step further - even if you assume that you have all of the above locked down and have inspected all of your servers - someone still has to connect to those servers. Let's assume they are connecting using an iOS device or OSX on a Mac to run commands on the server. As everyone knows, Apple devices allow full root access from the cloud for Apple to install new applications etc. These same backdoors can often be exploited [1] or leveraged by governments. If we assume an attacker has full control of the laptop the devops engineer is using to secure the system it becomes trivial for him to insert a backdoor in the servers too. [1] https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/ https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-...