Cluster Setup Cluster Setup
15%
- Use Network security policies to restrict cluster level accessUse Network security policies to restrict cluster level access
- Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
- Properly set up Ingress with TLSProperly set up Ingress with TLS
- Protect node metadata and endpointsProtect node metadata and endpoints
- Verify platform binaries before deployingVerify platform binaries before deploying
Cluster Hardening Cluster Hardening
15%
- Use Role Based Access Controls to minimize exposureUse Role Based Access Controls to minimize exposure
- Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created onesExercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
- Restrict access to Kubernetes APIRestrict access to Kubernetes API
- Upgrade Kubernetes to avoid vulnerabilitiesUpgrade Kubernetes to avoid vulnerabilities
System Hardening System Hardening
10%
- Minimize host OS footprint (reduce attack surface)Minimize host OS footprint (reduce attack surface)
- Using least-privilege identity and access managementUsing least-privilege identity and access management
- Minimize external access to the networkMinimize external access to the network
- Appropriately use kernel hardening tools such as AppArmor, seccompAppropriately use kernel hardening tools such as AppArmor, seccomp
Minimize Microservice Vulnerabilities Minimize Microservice Vulnerabilities
20%
- Use appropriate pod security standardsUse appropriate pod security standards
- Manage Kubernetes secretsManage Kubernetes secrets
- Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
- Implement Pod-to-Pod encryption (Cilium, Istio)Implement Pod-to-Pod encryption (Cilium, Istio)
Supply Chain Security Supply Chain Security
20%
- Minimize base image footprintMinimize base image footprint
- Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
- Secure your supply chain (permitted registries, sign and validate artifacts, etc.)Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
- Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)
Monitoring, Logging and Runtime Security Monitoring, Logging and Runtime Security
20%
- Perform behavioral analytics to detect malicious activitiesPerform behavioral analytics to detect malicious activities
- Detect threats within physical infrastructure, apps, networks, data, users and workloadsDetect threats within physical infrastructure, apps, networks, data, users and workloads
- Investigate and identify phases of attack and bad actors within the environmentInvestigate and identify phases of attack and bad actors within the environment
- Ensure immutability of containers at runtimeEnsure immutability of containers at runtime
- Use Kubernetes audit logs to monitor accessUse Kubernetes audit logs to monitor access