The container platform runtime must generate audit records when successful/unsuccessful attempts to access objects occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233267	SRG-APP-000507-CTR-001295	SV-233267r601844_rule		Medium

Description
Container platform runtime objects are defined as configuration files, code, etc. This provides the ability to configure resources and software parameters prior to image execution from the container platform registry. An unauthorized user with malicious intent could modify existing objects causing vulnerabilities or attacks. It would be difficult to establish, correlate, and investigate events relating to an incident or identify those responsible without audit record generation. Without audit record generation, unauthorized users can access objects unknowingly for malicious intent creating vulnerabilities within the container platform.

Description

Container platform runtime objects are defined as configuration files, code, etc. This provides the ability to configure resources and software parameters prior to image execution from the container platform registry. An unauthorized user with malicious intent could modify existing objects causing vulnerabilities or attacks. It would be difficult to establish, correlate, and investigate events relating to an incident or identify those responsible without audit record generation. Without audit record generation, unauthorized users can access objects unknowingly for malicious intent creating vulnerabilities within the container platform.

STIG	Date
Container Platform Security Requirements Guide	2021-12-14

Details

Check Text ( C-36203r601884_chk )
Review the container platform configuration to verify that the runtime generates audit records on successful/unsuccessful access to objects. If audit records are not generated by the runtime when objects are successfully/unsuccessfully accessed, this is a finding.

Fix Text (F-36171r601289_fix)
Configure the container platform runtime to generate audit records on successful/unsuccessful access to objects.