SYS.1.6.A24

[sluetze]

No description provided.

[sluetze]

The behavior of the containers and the applications or services operating within them SHOULD be monitored.

ACS offers policies that monitor behavior. Baselining enables the definition of the desired behavior and policies enable the reaction to undesirable behavior (i.e. that does not exist in the baseline).

Deviations from normal behavior SHOULD be noticed and reported.

The policies provided by ACS alert via OpenShift Monitoring. Furthermore, ACS maintains a history of all violations.

Reports SHOULD be handled appropriately in the central security incident handling process.

This requirement must be implemented organizationally.

Note: The alerts from OpenShift monitoring must be forwarded to the system used by the central process for handling security incidents. The usual alert manager methods are available for this. OpenShift provides email and Slack integration. The community offers further integration such as in Teams. If necessary, an integration can be developed that receives the alert manager's webhook and forwards it appropriately to the external system.

The behavior to be monitored SHOULD include at least:

network connections,

created processes,

file system accesses and

kernel requests (syscalls).

At the host level, Red Hat CoreOS supports auditd, which is enabled by default. Policies for auditd can include network connections, created processes, file accesses and syscalls. Red Hat CoreOS provides many sample policies that cover all of the areas described.

ACS offers alerting on network connections, created processes and kernel requests. File access is not covered by ACS policies.

In addition, the files on the RHCOS nodes can be checked cryptographically using the Advanced Intrusion Detection Environment (AIDE) using the file integrity operator provided by Red Hat and changes to files can be detected [FileIntegrity].

[benruland]

I would argue for does not meet, because the requirement is not met by OpenShift by itself. We need a solution such as ACS.

Do you agree @sluetze or would you prefer partial due to capabilities such as auditd? But how to configure auditd for that?

[benruland]

Created PR: ComplianceAsCode#12471

[sluetze]

I would at least add the auditd rules from the linux guides. And the check for file integrity operator.

And then set partial met.

I am not sure if we mapped the auditd rules elsewhere. But a well configured auditing helps with behavioral monitoring as requested.

[benruland]

Per discussion with @sluetze and @lichtblaugue, we will include file integrity operator, appropriate auditd rules (see CIS for "basic audit set") these are even necessary when using ACS) and an additional manual rule for a security solution