Skip to content
ATO Pathways
  Log In

Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000014-CTR-000040

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must use TLS 1.2 or greater for secure communication.

    &lt;VulnDiscussion&gt;The authenticity and integrity of the container platform and communication between nodes and components must be secure. If an...
    Rule Medium Severity
    Show

  • SRG-APP-000023-CTR-000055

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must use a centralized user management solution to support account management functions.

    &lt;VulnDiscussion&gt;OpenShift supports several different types of identity providers. To add users and grant access to OpenShift, an identity pro...
    Rule Medium Severity
    Show

  • SRG-APP-000023-CTR-000055

    <GroupDescription></GroupDescription>
    Group
    Show

  • The kubeadmin account must be disabled.

    &lt;VulnDiscussion&gt;Using a centralized user management solution for account management functions enhances security, simplifies administration, i...
    Rule Medium Severity
    Show

  • SRG-APP-000026-CTR-000070

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must automatically audit account creation.

    &lt;VulnDiscussion&gt;Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing ...
    Rule Medium Severity
    Show

  • SRG-APP-000027-CTR-000075

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must automatically audit account modification.

    &lt;VulnDiscussion&gt;Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing ...
    Rule Medium Severity
    Show

  • SRG-APP-000028-CTR-000080

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must generate audit rules to capture account related actions.

    &lt;VulnDiscussion&gt;Account management actions, such as creation, modification, disabling, removal, and enabling are important changes within the...
    Rule Medium Severity
    Show

  • SRG-APP-000029-CTR-000085

    <GroupDescription></GroupDescription>
    Group
    Show

  • Open Shift must automatically audit account removal actions.

    &lt;VulnDiscussion&gt;When application accounts are removed, user accessibility is affected. Once an attacker establishes access to an application,...
    Rule Medium Severity
    Show

  • SRG-APP-000033-CTR-000090

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift RBAC access controls must be enforced.

    &lt;VulnDiscussion&gt;Controlling and limiting users access to system services and resources is key to securing the platform and limiting the inten...
    Rule High Severity
    Show

  • SRG-APP-000038-CTR-000105

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must enforce network policy on the namespace for controlling the flow of information within the container platform based on organization-defined information flow control policies.

    &lt;VulnDiscussion&gt;OpenShift provides several layers of protection to control the flow of information between the container platform components ...
    Rule Medium Severity
    Show

  • SRG-APP-000039-CTR-000110

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must enforce approved authorizations for controlling the flow of information within the container platform based on organization-defined information flow control policies.

    &lt;VulnDiscussion&gt;OpenShift provides several layers of protection to control the flow of information between the container platform components ...
    Rule Medium Severity
    Show

  • SRG-APP-000068-CTR-000120

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must display the Standard Mandatory DOD Notice and Consent Banner before granting access to platform components.

    &lt;VulnDiscussion&gt;OpenShift has countless components where different access levels are needed. To control access, the user must first log into ...
    Rule Low Severity
    Show

  • SRG-APP-000089-CTR-000150

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must generate audit records for all DOD-defined auditable events within all components in the platform.

    &lt;VulnDiscussion&gt;The OpenShift Platform supports three audit levels: Default, WriteRequestBodies, and AllRequestBodies. The identities of the ...
    Rule Medium Severity
    Show

  • SRG-APP-000091-CTR-000160

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must generate audit records when successful/unsuccessful attempts to access privileges occur.

    &lt;VulnDiscussion&gt;OpenShift and its components must generate audit records successful/unsuccessful attempts to access or delete security object...
    Rule Medium Severity
    Show

  • SRG-APP-000092-CTR-000165

    <GroupDescription></GroupDescription>
    Group
    Show

  • Red Hat Enterprise Linux CoreOS (RHCOS) must initiate session audits at system startup.

    &lt;VulnDiscussion&gt;Initiating session audits at system startup allows for comprehensive monitoring of user activities and system events from the...
    Rule High Severity
    Show

  • SRG-APP-000095-CTR-000170

    <GroupDescription></GroupDescription>
    Group
    Show

  • All audit records must identify what type of event has occurred within OpenShift.

    &lt;VulnDiscussion&gt;Within the container platform, audit data can be generated from any of the deployed container platform components. This audit...
    Rule Medium Severity
    Show

  • SRG-APP-000096-CTR-000175

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift audit records must have a date and time association with all events.

    &lt;VulnDiscussion&gt;Within the container platform, audit data can be generated from any of the deployed container platform components. This audit...
    Rule Medium Severity
    Show

  • SRG-APP-000099-CTR-000190

    <GroupDescription></GroupDescription>
    Group
    Show

  • All audit records must generate the event results within OpenShift.

    &lt;VulnDiscussion&gt;Within the container platform, audit data can be generated from any of the deployed container platform components. Since the ...
    Rule Medium Severity
    Show

  • SRG-APP-000109-CTR-000215

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must take appropriate action upon an audit failure.

    &lt;VulnDiscussion&gt;It is critical that when the container platform is at risk of failing to process audit logs as required that it takes action ...
    Rule Medium Severity
    Show

  • SRG-APP-000111-CTR-000220

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift components must provide the ability to send audit logs to a central enterprise repository for review and analysis.

    &lt;VulnDiscussion&gt;Sending audit logs to a central enterprise repository allows for centralized log management. Instead of scattered logs across...
    Rule Medium Severity
    Show

  • SRG-APP-000116-CTR-000235

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must use internal system clocks to generate audit record time stamps.

    &lt;VulnDiscussion&gt;Knowing when a sequence of events for an incident occurred is crucial to understand what may have taken place. Without a comm...
    Rule Medium Severity
    Show

  • SRG-APP-000116-CTR-000235

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Red Hat Enterprise Linux CoreOS (RHCOS) chrony Daemon must use multiple NTP servers to generate audit record time stamps.

    &lt;VulnDiscussion&gt;Utilizing multiple NTP servers for the chrony daemon in RHCOS ensures accurate and reliable audit record timestamps. It impro...
    Rule Medium Severity
    Show

  • SRG-APP-000118-CTR-000240

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must protect audit logs from any type of unauthorized access.

    &lt;VulnDiscussion&gt;If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially ma...
    Rule Medium Severity
    Show

  • SRG-APP-000118-CTR-000240

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must protect system journal file from any type of unauthorized access by setting file permissions.

    &lt;VulnDiscussion&gt;It is a fundamental security practice to enforce the principle of least privilege, where only the necessary permissions are g...
    Rule Medium Severity
    Show

  • SRG-APP-000118-CTR-000240

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must protect system journal file from any type of unauthorized access by setting owner permissions.

    &lt;VulnDiscussion&gt;OpenShift follows the principle of least privilege, which aims to restrict access to resources based on user roles and respon...
    Rule Medium Severity
    Show

  • SRG-APP-000118-CTR-000240

    <GroupDescription></GroupDescription>
    Group
    Show

  • OpenShift must protect log directory from any type of unauthorized access by setting file permissions.

    &lt;VulnDiscussion&gt;Log files contain sensitive information such as user credentials, system configurations, and potentially even security-relate...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules