The container platform must verify container images.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233065	SRG-APP-000131-CTR-000285	SV-233065r601697_rule		Medium

Description
The container platform must be capable of validating container images are signed and that the digital signature is from a recognized and approved source approved by the organization. Allowing any container image to be introduced into the registry and instantiated into a container can allow for services to be introduced that are not trusted and may contain malicious code, which introduces unwanted services. These unwanted services can cause harm and security risks to the hosting server, the container platform, other services running within the container platform, and the overall organization.

Description

The container platform must be capable of validating container images are signed and that the digital signature is from a recognized and approved source approved by the organization. Allowing any container image to be introduced into the registry and instantiated into a container can allow for services to be introduced that are not trusted and may contain malicious code, which introduces unwanted services. These unwanted services can cause harm and security risks to the hosting server, the container platform, other services running within the container platform, and the overall organization.

STIG	Date
Container Platform Security Requirements Guide	2021-12-14

Details

Check Text ( C-36001r601696_chk )
Review the container platform configuration to determine if container images are verified by enforcing image signing and that the image is signed recognized by an approved source. If container images are not verified or the signature is not verified as a recognized and approved source, this is a finding.

Fix Text (F-35969r600683_fix)
Configure the container platform to verify container images are digitally signed and the signature is from a recognized and approved source.