Infrastructure Security · IS-Q07

Question: Are container images, registries, and runtimes hardened and continuously scanned for vulnerabilities?

  1. Objective — Why This Matters
    Containers share kernels and resources; a single weak image can compromise entire clusters. Image hardening, scanning, and signed deployments minimize risk.

  2. Maturity Levels (0 – 5)

0 — Unaware
No scanning or signed image enforcement.
1 — Ad Hoc
Manual scans before release; inconsistent base images.
2 — Defined
Registry with limited writers; scheduled scans.
3 — Managed
Automated scans on push; signed images enforced.
4 — Integrated
Runtime enforcement and drift detection.
5 — Optimized
Continuous compliance with SBOM tracking and zero-trust admission controls.
  1. How to Level Up
From → To Actions
0 → 2 Centralize images in a private registry and restrict writes.
2 → 3 Enable scanning and image signing.
3 → 4 Add runtime scanning and enforce admission policies.
4 → 5 Generate SBOMs and integrate into CI/CD for compliance.

  1. People / Process / Technology Enablers
    People – DevOps, Platform Engineer.
    Process – Image build review, approval workflows.
    Technology – Trivy, Clair, Harbor, Kyverno.

  2. Evidence Required
    Scan reports, signed image manifests, runtime alerts.

  3. Metrics / KPIs
    • percentage of images scanned before deployment
    • number of unsigned or unverified images detected
    • average time from detection to patch update

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
Scanning Trivy / Clair Automated image vulnerability scanning.
Registry Harbor Built-in scanning and signature enforcement.
Policy Kyverno / OPA Admission control for compliance.

  1. Common Pitfalls
    Skipping scans for internal projects; ignoring critical CVEs in base images.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.9 / A.8.13.
NIST CSF 2.0 PR.DS-1 / PR.IP-1.
CERT-In 2022 Secure software supply chain.
NIRMATA Scoring IS-Q07 ≥ Level 4 requires runtime drift monitoring.