| name | cis-oke-v170-5.1.4 |
| description | Minimize Container Registries to only those approved (Manual) |
| category | cis-oke |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","oke","kubernetes","oci","managed-services","image-registry","image-scanning"] |
| cis_id | 5.1.4 |
| cis_benchmark | CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v1.7.0 |
| tech_stack | ["kubernetes","oci","oke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS OKE Benchmark v1.7.0 - Control 5.1.4
Profile Applicability
Description
Use approved container registries.
Rationale
Allowing unrestricted access to external container registries provides the opportunity for malicious or unapproved containers to be deployed into the cluster. Allow listing only approved container registries reduces this risk.
Impact
All container images to be deployed to the cluster must be hosted within an approved container image registry.
Audit Procedure
No specific audit procedure provided. Review organizational policies to ensure only approved container registries are in use.
Remediation
No specific remediation procedure provided. Implement organizational policies to restrict container registries to approved sources only.
Default Value
Not applicable.
References
- https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v7 | 5.2 Maintain Secure Images | | * | * |
| v7 | 5.3 Securely Store Master Images | | * | * |
MITRE ATT&CK Mappings
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|
| T1133, T1195 | TA0001, TA0003 | M1016, M1042 |
Profile
Level 1 (Manual)
