+SYS.1.6.A21 Extended Security Policies (H)

SYS.1.6.A21 Extended Security Policies (H)

Extended policies SHOULD restrict the permissions of containers. Mandatory Access Control (MAC) or a comparable technology SHOULD enforce these policies. At minimum, policies SHOULD restrict the following types of access:

  • Incoming and outgoing network connections
  • File system access attempts
  • Kernel requests (syscalls)

A runtime SHOULD start containers in such a way that the kernel of the host system prevents all activities of the containers that are not allowed by the relevant policy (e.g. by setting up local packet filters or revoking permissions), or at least reports violations appropriately.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.14 Interception of Information / Espionage
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.27 Lack of Resources
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.40 Denial of Service
blocks G 0.46 Loss of Integrity of Sensitive Information