+APP.4.4.A18 Use of Micro-Segmentation (H)

APP.4.4.A18 Use of Micro-Segmentation (H)

Pods SHOULD ONLY be able to communicate with each other through the necessary network ports, even within a Kubernetes namespace. There SHOULD be rules within the CNI that disallow all but the necessary network connections within the Kubernetes namespace. These rules SHOULD precisely define the source and destination of the allowed connections using at least one of the following criteria: service name, metadata (“labels”), Kubernetes service accounts, or certificate-based authentication.

All the criteria used as labels for a connection SHOULD be secured in such a way that they can only be changed by authorised persons and management services.

1. Pārskats

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

Prasības

3. Saistītie tiesību akti

Tiesību akti

Saistītie uzdevumi

Saites
blocks G 0.14 Interception of Information / Espionage
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information