Container Platform Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The container platform must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data and images. The container platform must implement cryptographic modules adhering to the...Rule Medium Severity -
SRG-APP-000429
Group -
SRG-APP-000431
Group -
The container platform runtime must maintain separate execution domains for each container by assigning each container a separate address space.
Container namespace access is limited upon runtime execution. Each container is a distinct process so that communication between containers is performed in a manner controlled through security poli...Rule Medium Severity -
SRG-APP-000435
Group -
The container platform must protect against or limit the effects of all types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This require...Rule Medium Severity -
SRG-APP-000439
Group -
The application must protect the confidentiality and integrity of transmitted information.
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered. This requiremen...Rule High Severity -
SRG-APP-000441
Group -
SRG-APP-000442
Group -
The container platform must maintain the confidentiality and integrity of information during reception.
Information either can be unintentionally or maliciously disclosed or modified during reception for reception within the container platform during aggregation, at protocol transformation points, an...Rule Medium Severity -
SRG-APP-000447
Group -
SRG-APP-000450
Group -
The container platform must implement organization-defined security safeguards to protect system CPU and memory from resource depletion and unauthorized code execution.
The execution of images within the container platform runtime must implement organizational defined security safeguards to prevent distributed denial-of-service (DDOS) and other possible attacks ag...Rule Medium Severity -
SRG-APP-000454
Group -
SRG-APP-000454
Group -
SRG-APP-000456
Group -
The container platform registry must contain the latest images with most recent updates and execute within the container platform runtime as authorized by IAVM, CTOs, DTMs, and STIGs.
Software supporting the container platform, images in the registry must stay up to date with the latest patches, service packs, and hot fixes. Not updating the container platform and container imag...Rule Medium Severity -
SRG-APP-000456
Group -
SRG-APP-000472
Group -
The organization-defined role must verify correct operation of security functions in the container platform.
Without verification, security functions may not operate correctly and this failure may go unnoticed within the container platform. The container platform components must identity and ensure the se...Rule Medium Severity -
SRG-APP-000473
Group -
SRG-APP-000474
Group -
The container platform must provide system notifications to the system administrator and operational staff when anomalies in the operation of the organization-defined security functions are discovered.
If anomalies are not acted upon, security functions may fail to secure the container within the container platform runtime. Security functions are responsible for enforcing the system security pol...Rule Medium Severity -
SRG-APP-000492
Group -
SRG-APP-000493
Group -
The container platform must generate audit records when successful/unsuccessful attempts to access security levels occur.
Unauthorized users could access the security levels to exploit vulnerabilities within the container platform component. All the components must use the same standard so that the events can be tied ...Rule Medium Severity -
SRG-APP-000494
Group -
The container platform must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an in...Rule Medium Severity -
SRG-APP-000495
Group -
The container platform must generate audit records when successful/unsuccessful attempts to modify privileges occur.
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an in...Rule Medium Severity -
SRG-APP-000496
Group -
The container platform must generate audit records when successful/unsuccessful attempts to modify security objects occur.
The container platform and its components must generate audit records when modifying security objects. All the components must use the same standard so that the events can be tied together to under...Rule Medium Severity -
SRG-APP-000497
Group -
SRG-APP-000498
Group -
The container platform must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an in...Rule Medium Severity -
SRG-APP-000499
Group -
The container platform must generate audit records when successful/unsuccessful attempts to delete privileges occur.
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an in...Rule Medium Severity -
SRG-APP-000500
Group -
The container platform must generate audit records when successful/unsuccessful attempts to delete security levels occur.
The container platform and its components must generate audit records when deleting security levels. All the components must use the same standard so that the events can be tied together to underst...Rule Medium Severity -
SRG-APP-000501
Group -
SRG-APP-000502
Group -
The container platform must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an in...Rule Medium Severity -
SRG-APP-000503
Group -
SRG-APP-000504
Group -
The container platform must generate audit record for privileged activities.
The container platform components will generate audit records for privilege activities and container platform runtime, registry, and keystore must generate access audit records to detect possible m...Rule Medium Severity -
SRG-APP-000505
Group -
The container platform audit records must record user access start and end times.
The container platform must generate audit records showing start and end times for users and services acting on behalf of a user accessing the registry and keystore. These components must use the s...Rule Medium Severity -
SRG-APP-000506
Group -
SRG-APP-000507
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.