OWASP DSOMM

Level 1: Basic understanding of security practices: Test for stored secrets
Risk:
Stored secrets in git history, in container images or directly in code shouldn't exists because they might be exposed to unauthorized parties.
Measure:
Test for secrets in code, container images and history
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: Medium
Usefulness:
Medium
Implementation:

Level 2: Adoption of basic security practices: Test cluster deployment resources
Risk:
The deployment configuration (e.g. kubernetes deployment resources) might contain unsecured configurations.
Measure:
Test the deployment configuration for virtualized environments for unsecured configurations.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: Medium
Usefulness:
High
Implementation:

Level 2: Adoption of basic security practices: Test for image lifetime
Risk:
Old container images in production indicate that patch management is not performed and therefore vulnerabilities might exists.
Measure:
Check the image age of containers in production.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: Low
Usefulness:
Medium
Implementation:

Level 2: Adoption of basic security practices: Test of virtualized environments
Risk:
Virtualized environments (e.g. via <i>Container Images</i>) might contains unsecure configurations.
Measure:
Test virtualized environments for unsecured configurations.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: Medium
Usefulness:
High
Implementation:

Level 2: Adoption of basic security practices: Test the cloud configuration
Risk:
Standard hardening practices for cloud environments are not performed leading to vulnerabilities.
Measure:
With the help of tools, the configuration of virtual environments are tested.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Low
Usefulness:
Very High
Implementation:

Level 2: Adoption of basic security practices: Test the definition of virtualized environments
Risk:
The definition of virtualized environments (e.g. via <i>Dockerfile</i>) might contain unsecure configurations.
Measure:
Test the definition of virtualized environments for unsecured configurations.
Implementation Guide:
For containier (images), test that the images are following best practices like distroless or non-root.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: Medium
Usefulness:
High
Implementation:

Level 3: High adoption of security practices: Analyze logs
Risk:
Not aware of attacks happening.
Measure:
Check logs for keywords.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Medium
Usefulness:
High
Implementation:

Level 3: High adoption of security practices: Test for malware
Risk:
Third party might include malware. Ether due to the maintainer (e.g. typo squatting of an image name and using the wrong image) or by an attacker on behalf of the maintainer with stolen credentials.
Measure:
Check for malware in components (e.g. container images, VM baseline images, libraries).
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Medium
Resources: Medium
Usefulness:
High
Implementation:

Level 3: High adoption of security practices: Test for new image version
Risk:
When a new version of an image is available, it might fix security vulnerabilities.
Measure:
Check for new images of containers in production.
Difficulty of Implementation:
Knowledge: High (two disciplines)
Time: High
Resources: Low
Usefulness:
Medium

Level 4: Very high adoption of security practices: Correlate known vulnerabilities in infrastructure with new image versions
Risk:
TODO.
Measure:
TODO
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time:
Resources: Very High
Usefulness:
Low
Implementation:

Level 4: Very high adoption of security practices: Software Composition Analysis
Description:
Subscribing to Github projects and reading release notes might help. Software Composition Analysis for infrastructure might help, but is often too fine-granular.
Risk:
Known vulnerabilities in infrastructure components like container images might get exploited.
Measure:
Check for known vulnerabilities
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time: Low
Resources: Low
Usefulness:
Very High
Implementation:

Level 4: Very high adoption of security practices: Test of infrastructure components for known vulnerabilities
Risk:
Infrastructure components might have vulnerabilities.
Measure:
Test for known vulnerabilities in infrastructure components. Often, the only way to respond to known vulnerabilities in operating system packages is to accept the risk and wait for a patch. As the patch needs to be applied fast when it is available, this activity depends on 'Usage of a maximum life for images'.
Difficulty of Implementation:
Knowledge: Medium (two disciplines)
Time:
Resources: Medium
Usefulness:
Low
Implementation: