Container Security
What is Container Security?
The practice of protecting containerised applications throughout their lifecycle, from image creation to runtime. Container security addresses image scanning, runtime protection, network policies, and orchestration platform security.
Terms that appear alongside container security
Each of these is named in at least one of the same controls as container security. The number is how many controls name both.
- isolation 5 shared controls
- compliance 5 shared controls
- hardening 5 shared controls
- integrity 4 shared controls
- authentication 4 shared controls
- configuration management 4 shared controls
- vulnerability 4 shared controls
- security posture 4 shared controls
Frameworks that govern container security
What the standards actually require on container security
Requirements naming container security across 6 standards, quoted from the control text.
Secure the O-Cloud platform + containers + secure configuration + patching per O-RAN WG11 Security Requirements + O-Cloud security profile.
ORANWG11-5 · O-Cloud, Container Security, Secure Configuration, Patching →All parties maintain cargo and container integrity by using modern technology, conforming at a minimum to the requirements of the applicable international agreements on container security and sealing.
P2-S4 · Technology →ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...
ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →Security Layer 1 Infrastructure per X.805 Clause 7.1: The Infrastructure Security Layer consists of network facilities (transmission facilities and network elements) protected by the security measures.
X805-Layer1-Infrastructure-Security-Transmission-Facilities-Network-Elements-Lines-Routers-Switches · ITU-T X.805 Security Layer 1 - Infrastructure Security + Transmission Facilities + Network Elements + Routers + Switches + Lines + Physical + Datacenter + Optical + Radio Access + Wireless + Wireline + Edge →Apply D3FEND ISOLATE tactic to create logical or physical barriers in a system to reduce attack opportunities and impact. D3-EI Execution Isolation (D3-HBPI Hardware-based Process Isolation + D3-SCF System Call Filtering + D3-IBCA IO Channel Authentication + D...
MITRE-D3FEND-Isolate-Tactic-Execution-Network-Isolation-Sandboxing-Microsegmentation-DNS-Filtering · MITRE D3FEND Isolate Tactic + Execution + Network Isolation + Sandboxing + Microsegmentation + DNS Filtering →Apply Section 7.5 cloud workload protection covering CWPP (Cloud Workload Protection Platform) + image and template hardening (golden image builds + AMI/VHD hardening + scanning) + container security (image scanning + admission control + runtime monitoring for...
NISTSP144-7 · Cloud Workload Protection, Containers, Serverless, and Configuration →Questions people ask about container security
What is Container Security?
Why is Container Security important for compliance?
Which compliance frameworks address Container Security?
Where can I learn more about Container Security?
See how Container Security applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.