STIGQter: STIG Summary: Container Platform Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

The container platform registry must employ a deny-all, permit-by-exception (whitelist) policy to allow only authorized container images in the container platform.

DISA Rule

SV-233192r599641_rule

Vulnerability Number

V-233192

Group Title

SRG-APP-000386

Rule Version

SRG-APP-000386-CTR-000920

Severity

CAT II

CCI(s)

• CCI-001774 - The organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system.

Weight

10

Fix Recommendation

Configure the container platform to utilize a deny-all, permit-by-exception policy when allowing the execution of authorized software.

Check Contents

Review documentation and configuration settings to identify if the container platform whitelisting specifies which container platform components are allowed to execute.

Check for the existence of policy settings or policy files that can be configured to restrict container platform component execution. Demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction.

Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or Software Restriction Policies, Application Security Manager, or Role-Based Access Controls (RBAC).

If container platform whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Vulnerability Number

V-233192

Documentable

False

Rule Version

SRG-APP-000386-CTR-000920

Severity Override Guidance

Review documentation and configuration settings to identify if the container platform whitelisting specifies which container platform components are allowed to execute.

Check for the existence of policy settings or policy files that can be configured to restrict container platform component execution. Demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction.

Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or Software Restriction Policies, Application Security Manager, or Role-Based Access Controls (RBAC).

If container platform whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Check Content Reference

M

Target Key

5239

Comments