Container Platform Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The container platform must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.
Without verification, security functions may not operate correctly and this failure may go unnoticed within the container platform. Security functions are responsible for enforcing the system secu...Rule Medium Severity -
The container platform must generate audit records when successful/unsuccessful attempts to access security objects occur.
The container platform and its components must generate audit records when successful and unsuccessful access security objects occur. All the components must use the same standard so that the event...Rule Medium Severity -
The container platform must generate audit records when successful/unsuccessful attempts to modify security levels occur.
Unauthorized users could modify the security levels to exploit vulnerabilities within the container platform component. All the components must use the same standard so that the events can be tied ...Rule Medium Severity -
The container platform must generate audit records when successful/unsuccessful attempts to delete security objects occur.
Unauthorized users modify level the security levels to exploit vulnerabilities within the container platform component. All the components must use the same standard so that the events can be tied ...Rule Medium Severity -
The container platform must generate audit records when successful/unsuccessful logon attempts occur.
The container platform and its components must generate audit records when successful and unsuccessful logon attempts occur. The information system can determine if an account is compromised or is ...Rule Medium Severity -
The container platform must generate audit records when concurrent logons from different workstations and systems occur.
The container platform and its components must generate audit records for concurrent logons from workstations perform remote maintenance, runtime instances, connectivity to the container registry, ...Rule Medium Severity -
The container platform runtime must generate audit records when successful/unsuccessful attempts to access objects occur.
Container platform runtime objects are defined as configuration files, code, etc. This provides the ability to configure resources and software parameters prior to image execution from the containe...Rule Medium Severity -
The container runtime must generate audit records for all container execution, shutdown, restart events, and program initiations.
The container runtime must generate audit records that are specific to the security and mission needs of the organization. Without audit record, it would be difficult to establish, correlate, and i...Rule Medium Severity -
The container platform must use a valid FIPS 140-2 approved cryptographic modules to generate hashes.
The cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function wi...Rule Medium Severity -
The container platform must be able to store and instantiate industry standard container images.
Monitoring the container images and containers during their lifecycle is important to guarantee the container platform is secure. To monitor the containers and images, security tools can be put in ...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.