Other threats (+testing guide) about docker-security HOT 7 OPEN

Thanks!

You're right. partly however it is there - in the threat model at least., see https://github.com/OWASP/Docker-Security/blob/master/001%20-%20Threats.md.

The concrete point belongs to D08. This needs to be filled with content and it was planned in the spring, when I had more time than I have now. Feel feel starting with that with what you intended, similar to the scheme of the other points which have content. PR's are appeciated.

For k8s: Sigh, yes. What I had in mind is at least add something like a remark in the respective points, like "you should use a ~proper network policy", "pod security policy" and "not rely on the IMO defaults". So in a sense mention the weak points but do not go too much in detail.

from docker-security.

Can this issue be closed?

from docker-security.

Hi

I have t had time to do this, apologies. Yes, close it and at some point I will try to complete it

from docker-security.

I'd rather leave this open at the moment as I on my list was a review of the vector specific threats and maybe then an addition of specific threats.

from docker-security.

from docker-security.

@Aut0R3V : if you want to spend some cycles: you could work on a threat map like the one Timo contributed:
https://raw.githubusercontent.com/OWASP/Docker-Security/master/assets/threats.png

First, that should be in an editable format, preferably SVG. Then: It's halfway between the general threats / vectors as I described in the text and specific threats. So either it should be one or the other. ;-)

To give you an idea I am attaching an SVG I used for a talk a while back which can be used as a starting point

Threats_v0.1.orange.svg.gz

PS + OT: Seems for security reasons I needed to gzip the SVG

from docker-security.

Thanks a lot! I'll get started in sometime.

from docker-security.