LHDI Countermeasures Section 5: Deployment

[rdvyas]

The following countermeasures need to be complete in the Deployment section of the SDElements survey. A link to the SD elements dashboard can be found here (access through VA Network): https://sde.lighthouse.va.gov/bunits/va/in-person-identity-proofing/in-person-identity-proofing-first-project/tasks/phase/deployment/

• [ ] T1186: Do not store secrets in Dockerfiles (Docker) (10)
• [ ] T2285: Set up and maintain cloud users and roles (Cloud) (10)
• [ ] T2287: Configure a secure user authorization (Cloud) (1/2) (10)
• [ ] T2290: Secure data in transit (Cloud) (1/2) (10)
• [ ] T2291: Secure hosts and operating systems (Cloud) (10)
• [ ] T2365: Secure data in transit (Cloud) (2/2) (10)
• [ ] T1174: Create non-root users for containers (Docker) (9)
• [ ] CT65: Configure the logging level (Docker) (8)
• [ ] T1154: Secure Docker registries (Docker) (8)
• [ ] T1156: Do not use the aufs storage driver (Docker) (8)
• [ ] T1166: Encrypt data exchanged between containers on different nodes on the overlay network (Docker) (8)
• [ ] T1188: Configure Linux Security Modules (Docker) (8)
• [ ] T1190: Restrict Linux Kernel Capabilities within containers (Docker) (8)
• [ ] T1192: Do not expose unnecessary host resources (Docker) (8)
• [ ] T1198: Do not share the host's network namespace (Docker) (8)
• [ ] T1200: Limit resources used by containers (Docker) (8)
• [ ] T1202: Set container CPU priority appropriately (Docker) (8)
• [ ] T1204: Mount container's root file system as read-only (Docker) (8)
• [ ] T1210: Configure seccomp profile (Docker) (8)
• [ ] T1214: Restrict containers from acquiring additional privileges (Docker) (8)
• [ ] T2294: Enable logs and configuration monitoring in your cloud environment (Cloud) (1/4) (8)
• [ ] T2372: Enable logs and configuration monitoring in your cloud environment (Cloud) (3/4) (8)
• [ ] T2373: Enable logs and configuration monitoring in your cloud environment (Cloud) (4/4) (8)
• [ ] T1208: Do not set mount propagation mode to 'shared' (Docker) (7)
• [ ] T1212: Confirm cgroup usage (Docker) (7)
• [ ] T2360: Configure a secure user authorization (Cloud) (2/2) (7)

[lmorris3]

added complete list of countermeasures - we can break this down into priority for individual stories

[lmorris3]

@moanu404 you'll love this section - it's all about DOCKER! :)