Container Hardening

• Prerequisite for staging
• Complete helmet package
  
  • All artefacts included
  • No external dependencies
  • Helmet packages are configurable
  • Versioning
• Protected package consistency

At this first level, we analyse the software to be used and transfer it and the required dependencies to our internal environment. The software is bundled into a KOSI package, which allows the software to be installed without internet access and reproducibly in our own environment. The package therefore fulfils the following characteristics: no external dependencies, fully configurable and clear versioning. This forms the basis for the staging process and all subsequent stages.

• Parameters set to the highest security level
• Required operating parameters integrated
• Improved documentation

The second level includes a comprehensive review and customisation of the software package with regard to the container used. We analyse the container images and set the configurations for operation to a high security level and reduce them to the essentials. The configuration and packages are also documented in detail.

• Revision according to safety guidelines
• Supply chain secured
• No critical vulnerabilities
• No detectable malware

In this stage, we focus on securing the container images and packages of a software. We harden container images and packages by removing insecure and unnecessary components and implementing secure configuration guidelines for operation. Depending on the vulnerability, it may be necessary to rebuild the source software, container and Helm package. Continuous security scans are carried out so that new vulnerabilities can be responded to accordingly.

• Ready-to-use configuration
• Scalability guaranteed
• Applied best practices
• Licence management

At this level, we implement the operational readiness for a corresponding package. This means that resources such as an ingress or proxy configuration are implemented in the package and configured accordingly for the target environment. These configurations determine how the application is reached or via which proxy communication must take place in order to be able to request resources from the Internet, for example. Further operating properties are: Labelling, monitoring, tracing and storage. Container best practices (health checks) and scalability of the application are also integrated at this level.

• Aiming for Distroless-Containe
• If not possible, hardening of the image stack
• Use of ‘lightweight’ base image

The final level of our concept is continuous hardening. Security is an ongoing process and we ensure that the container environments are regularly checked and updated. The container images themselves are reduced to the application to be executed.