Title

The container platform must enforce access restrictions and support auditing of the enforcement actions. (Cat II impact)

Discussion

Auditing the enforcement of access restrictions against changes to the container platform helps identify attacks and provides forensic data for investigation for after-the-fact actions. Attempts to change configurations, components, or data maintained by a component (e.g., images in the registry, running containers in the runtime, or keys in the keystore) must be audited. Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.

Check Content

Review container platform documentation and logs to determine if enforcement actions used to restrict access associated with changes to the container platform are logged. If these actions are not logged, this is a finding.

Fix Text

Configure the container platform to log the enforcement actions used to restrict access associated with changes.

Additional Identifiers

Rule ID: SV-233189r879754_rule

Vulnerability ID: V-233189

Group Title: SRG-APP-000381

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.