+APP.4.4.A18 Use of Micro-Segmentation (H)

APP.4.4.A18 Use of Micro-Segmentation (H)

Pods SHOULD ONLY be able to communicate with each other through the necessary network ports, even within a Kubernetes namespace. There SHOULD be rules within the CNI that disallow all but the necessary network connections within the Kubernetes namespace. These rules SHOULD precisely define the source and destination of the allowed connections using at least one of the following criteria: service name, metadata (“labels”), Kubernetes service accounts, or certificate-based authentication.

All the criteria used as labels for a connection SHOULD be secured in such a way that they can only be changed by authorised persons and management services.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
blocks G 0.14 Interception of Information / Espionage
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information