Skip to content
ATO Pathways
  Log In

BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4

Rules and Groups employed by this XCCDF Profile

  • Kubernetes Settings

    Each section of this configuration guide includes information about the configuration of a Kubernetes cluster and a set of recommendations for hard...
    Group
    Show

  • System and Software Integrity

    System and software integrity can be gained by installing antivirus, increasing system encryption strength with FIPS, verifying installed software,...
    Group
    Show

  • Ensure that Cluster Version Operator is deployed

    Integrity of the OpenShift platform is handled to start by the cluster version operator. Cluster Version Operator will by default GPG verify the in...
    Rule Medium Severity
    Show

  • Ensure that Cluster Version Operator verifies integrity

    Integrity of the OpenShift platform is handled to start by the cluster version operator. Cluster Version Operator will by default GPG verify the in...
    Rule Medium Severity
    Show

  • Ensure that File Integrity Operator is scanning the cluster

    <a href="https://docs.openshift.com/container-platform/4.7/security/file_integrity_operator/file-integrity-operator-understanding.html">The File In...
    Rule Medium Severity
    Show

  • Kubernetes - Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...
    Group
    Show

  • Restrict Automounting of Service Account Tokens

    Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API ser...
    Rule Medium Severity
    Show

  • Ensure Usage of Unique Service Accounts

    Using the <code>default</code> service account prevents accurate application rights review and audit tracing. Instead of <code>default</code>, crea...
    Rule Medium Severity
    Show

  • OpenShift Kube API Server

    This section contains recommendations for kube-apiserver configuration.
    Group
    Show

  • Ensure that anonymous requests to the API Server are authorized

    By default, anonymous access to the OpenShift API is enabled, but at the same time, all requests must be authorized. If no authentication mechanism...
    Rule Medium Severity
    Show

  • Configure the Client Certificate Authority for the API Server

    Certificates must be provided to fully setup TLS client certificate authentication. To ensure the API Server utilizes its own TLS certificates, the...
    Rule Medium Severity
    Show

  • Configure the Encryption Provider Cipher

    <p> When you enable etcd encryption, the following OpenShift API server and Kubernetes API server resources are encrypted: <ul> <li>...
    Rule Medium Severity
    Show

  • Ensure that the --kubelet-https argument is set to true

    The kube-apiserver ensures https to the kubelet by default. The apiserver flag "--kubelet-https" is deprecated and should be either set to "true" o...
    Rule Medium Severity
    Show

  • Configure the kubelet Certificate File for the API Server

    To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...
    Rule High Severity
    Show

  • Configure the kubelet Certificate Key for the API Server

    To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...
    Rule High Severity
    Show

  • Configure the Certificate for the API Server

    To ensure the API Server utilizes its own TLS certificates, the <code>tls-cert-file</code> must be configured. Verify that the <code>apiServerArgum...
    Rule Medium Severity
    Show

  • Use Strong Cryptographic Ciphers on the API Server

    To ensure that the API Server is configured to only use strong cryptographic ciphers, verify the <code>openshift-kube-apiserver</code> configmap co...
    Rule Medium Severity
    Show

  • Configure the Certificate Key for the API Server

    To ensure the API Server utilizes its own TLS certificates, the <code>tls-private-key-file</code> must be configured. Verify that the <code>apiServ...
    Rule Medium Severity
    Show

  • Ensure APIServer is not configured with Old tlsSecurityProfile

    The configuration <code>tlsSecurityProfile</code> specifies TLS configurations to be used while establishing connections with the externally expose...
    Rule Medium Severity
    Show

  • OpenShift etcd Settings

    Contains rules that check correct OpenShift etcd settings.
    Group
    Show

  • Kubernetes - General Security Practices

    Contains evaluations for general security practices for operating a Kubernetes environment.
    Group
    Show

  • Ensure the notification is enabled for file integrity operator

    The OpenShift platform provides the File Integrity Operator to monitor for unwanted file changes, and this control ensures proper notification aler...
    Rule Medium Severity
    Show

  • Apply Security Context to Your Pods and Containers

    Apply Security Context to your Pods and Containers
    Rule Medium Severity
    Show

  • Ensure that GitOps Operator is deployed

    Red Hat OpenShift GitOps is a declarative continuous delivery platform based on Argo CD. It enables teams to adopt GitOps principles for managing c...
    Rule Medium Severity
    Show

  • Ensure that the kubeadmin secret has been removed

    The kubeadmin user is meant to be a temporary user used for bootstrapping purposes. It is preferable to assign system administrators whose users ar...
    Rule Medium Severity
    Show

  • Ensure TLS v1.2 is minimum for Openshift APIServer

    Verify tls version for the openshift APIServer.
    Rule Medium Severity
    Show

  • This is a helper rule to fetch the required api resource for detecting HyperShift OCP version

    no description
    Rule Medium Severity
    Show

  • This is a helper rule to fetch the required api resource for detecting OCP version

    no description
    Rule Medium Severity
    Show

  • Kubernetes Kubelet Settings

    The Kubernetes Kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod. The kubelet takes a ...
    Group
    Show

  • Ensure That The kubelet Client Certificate Is Correctly Set

    To ensure the kubelet TLS client certificate is configured, edit the kubelet configuration file <code>/etc/kubernetes/kubelet.conf</code> and confi...
    Rule Medium Severity
    Show

  • Ensure That The kubelet Server Key Is Correctly Set

    To ensure the kubelet TLS private server key certificate is configured, edit the kubelet configuration file <code>/etc/kubernetes/kubelet.conf</cod...
    Rule Medium Severity
    Show

  • Kubernetes - Network Configuration and Firewalls

    Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses th...
    Group
    Show

  • Ensure that the CNI in use supports Network Policies

    There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectiv...
    Rule High Severity
    Show

  • Ensure that application Namespaces have Network Policies defined.

    Use network policies to isolate traffic in your cluster network.
    Rule High Severity
    Show

  • Ensure that project templates autocreate Network Policies

    Configure a template for newly created projects to use default network policies and make sure this template is referenced from the default project ...
    Rule Medium Severity
    Show

  • Role-based Access Control

    Role-based access control (RBAC) objects determine whether a user is allowed to perform a given action within a project. Cluster administrators ca...
    Group
    Show

  • Ensure cluster roles are defined in the cluster

    <p> RBAC is a critical feature in terms of security for Kubernetes and OpenShift. It enables administrators to segment the privilege...
    Rule Medium Severity
    Show

  • Ensure that the RBAC setup follows the principle of least privilege

    Role-based access control (RBAC) objects determine whether a user is allowed to perform a given action within a project. If users or groups exist ...
    Rule High Severity
    Show

  • Ensure that the cluster-admin role is only used where required

    The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed.
    Rule Medium Severity
    Show

  • Limit Access to Kubernetes Secrets

    The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Acce...
    Rule Medium Severity
    Show

  • Ensure roles are defined in the cluster

    <p> RBAC is a critical feature in terms of security for Kubernetes and OpenShift. It enables administrators to segment the privilege...
    Rule Medium Severity
    Show

  • Minimize Wildcard Usage in Cluster and Local Roles

    Kubernetes Cluster and Local Roles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possi...
    Rule Medium Severity
    Show

  • Kubernetes - Registry Security Practices

    Contains evaluations for Kubernetes registry security practices, and cluster-wide registry configuration.
    Group
    Show

  • Allowed registries are configured

    The configuration <code>registrySources.allowedRegistries</code> determines the permitted registries that the OpenShift container runtime can acces...
    Rule Medium Severity
    Show

  • Allowed registries for import are configured

    The configuration <code>allowedRegistriesForImport</code> limits the container image registries from which normal users may import images. This is ...
    Rule Medium Severity
    Show

  • Check configured allowed registries for import uses secure protocol

    The configuration <code>allowedRegistriesForImport</code> limits the container image registries from which normal users may import images. This is ...
    Rule Medium Severity
    Show

  • Check if any insecure registry sources is configured

    The configuration <code>registrySources.insecureRegistries</code> determines the insecure registries that the OpenShift container runtime can acces...
    Rule Medium Severity
    Show

  • OpenShift - Risk Assessment Settings

    Contains evaluations for the cluster's risk assessment configuration settings.
    Group
    Show

  • Ensure that Compliance Operator is scanning the cluster

    <a href="https://docs.openshift.com/container-platform/latest/security/compliance_operator/compliance-operator-understanding.html#compliance-operat...
    Rule Medium Severity
    Show

  • Ensure that Compliance Operator scans are running periodically

    <a href="https://docs.openshift.com/container-platform/latest/security/compliance_operator/compliance-operator-understanding.html#compliance-operat...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules