Disa Stig
Stig
Stig Viewer Mac

Disa Stig

Findings (MAC III - Administrative Sensitive)

Finding ID	Severity	Title	Description
V-242388	High	The Kubernetes API server must have the insecure bind address not set.	By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the 'insecure bind' address and is set by default to localhost. ...
V-242381	High	The Kubernetes Controller Manager must create unique service accounts for each work payload.	The Kubernetes Controller Manager is a background process that embeds core control loops regulating cluster system state through the API Server. Every process executed in a pod has an associated ...
V-242383	High	User-managed resources must be created in dedicated namespaces.	Creating namespaces for user-managed resources is important when implementing Role-Based Access Controls (RBAC). RBAC allows for the authorization of users and helps support proper API server ...
V-242386	High	The Kubernetes API server must have the insecure port flag disabled.	By default, the API server will listen on two ports. One port is the secure port and the other port is called the 'localhost port'. This port is also called the 'insecure port', port 8080. Any ...
V-242387	High	The Kubernetes Kubelet must have the read-only port flag disabled.	Kubelet serves a small REST API with read access to port 10255. The read-only port for Kubernetes provides no authentication or authorization security control. Providing unrestricted access on ...
V-242392	High	The Kubernetes kubelet must enable explicit authorization.	Kubelet is the primary agent on each node. The API server communicates with each kubelet to perform tasks such as starting/stopping pods. By default, kubelets allow all authenticated requests, ...
V-242391	High	The Kubernetes Kubelet must have anonymous authentication disabled.	A user who has access to the Kubelet essentially has root access to the nodes contained within the Kubernetes Control Plane. To control access, users must be authenticated and authorized. By ...
V-242390	High	The Kubernetes API server must have anonymous authentication disabled.	The Kubernetes API Server controls Kubernetes via an API interface. A user who has access to the API essentially has root access to the entire Kubernetes cluster. To control access, users must be ...
V-242397	High	The Kubernetes kubelet static PodPath must not enable static pods.	Allowing kubelet to set a staticPodPath gives containers with root access permissions to traverse the hosting filesystem. The danger comes when the container can create a manifest file within the ...
V-242415	High	Secrets in Kubernetes must not be stored as environment variables.	Secrets, such as passwords, keys, tokens, and certificates should not be stored as environment variables. These environment variables are accessible inside Kubernetes by the 'Get Pod' API call, ...
V-242436	High	The Kubernetes API server must have the ValidatingAdmissionWebhook enabled.	Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated, or deleted. By applying a pod security policy, control can be given ...
V-242437	High	Kubernetes must have a pod security policy set.	Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated, or deleted. By applying a pod security policy, control can be given ...
V-242434	High	Kubernetes Kubelet must enable kernel protection.	System kernel is responsible for memory, disk, and task management. The kernel provides a gateway between the system hardware and software. Kubernetes requires kernel access to allocate resources ...
V-242435	High	Kubernetes must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures or the installation of patches and updates.	Kubernetes uses the API Server to control communication to the other services that makeup Kubernetes. The use of authorizations and not the default of 'AlwaysAllow' enables the Kubernetes ...
V-242439	High	Kubernetes API Server must disable basic authentication to protect information in transit.	Kubernetes basic authentication sends and receives request containing username, uid, groups, and other fields over a clear text HTTP communication. Basic authentication does not provide any ...
V-242389	Medium	The Kubernetes API server must have the secure port set.	By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests to this port will perform authentication and authorization checks. If this port is ...
V-242380	Medium	The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.	The Kubernetes API Server will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.The use of unsupported protocol exposes vulnerabilities to the ...
V-242382	Medium	The Kubernetes API Server must enable Node,RBAC as the authorization mode.	To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web ...
V-242384	Medium	The Kubernetes Scheduler must have secure binding.	Limiting the number of attack vectors and implementing authentication and encryption on the endpoints available to external sources is paramount when securing the overall Kubernetes cluster. The ...
V-242385	Medium	The Kubernetes Controller Manager must have secure binding.	Limiting the number of attack vectors and implementing authentication and encryption on the endpoints available to external sources is paramount when securing the overall Kubernetes cluster. The ...
V-242468	Medium	The Kubernetes API Server must prohibit communication using TLS version 1.0 and 1.1, and SSL 2.0 and 3.0.	The Kubernetes API Server will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.The use of unsupported protocol exposes vulnerabilities to ...
V-242461	Medium	Kubernetes API Server audit logs must be enabled.	Kubernetes API Server validates and configures pods and services for the API object. The REST operation provides frontend functionality to the cluster share state. Enabling audit logs provides a ...
V-242460	Medium	The Kubernetes admin.conf must have file permissions set to 644 or more restrictive.	The Kubernetes conf files contain the arguments and settings for the Master Node services. These services are controller and scheduler. If these files can be changed, the scheduler will be ...
V-242463	Medium	The Kubernetes API Server must be set to audit log maximum backup.	The Kubernetes API Server must set enough storage to retain logs for monitoring suspicious activity and system misconfiguration, and provide evidence for Cyber Security Investigations.
V-242462	Medium	The Kubernetes API Server must be set to audit log max size.	The Kubernetes API Server must be set for enough storage to retain log information over the period required. When audit logs are large in size, the monitoring service for events becomes degraded. ...
V-242465	Medium	The Kubernetes API Server audit log path must be set.	Kubernetes API Server validates and configures pods and services for the API object. The REST operation provides frontend functionality to the cluster share state. Audit logs are necessary to ...
V-242464	Medium	The Kubernetes API Server audit log retention must be set.	The Kubernetes API Ser