계: Environment

이 섹션에는 소스 코드 외부에 있지만 제작 중인 제품의 보안에는 여전히 중요한 내용이 모두 포함되어 있습니다. 이 섹션에서 다루는 문제들은 소스 코드와 직접적으로 관련이 없기 때문에 나머지 섹션과 분리했습니다.

Kubernetes Misconfiguration: API Server Logging Disabled

Abstract
Kubernetes API 서버가 감사 이벤트를 로그 파일에 저장하지 않습니다.
Explanation
Kubernetes API 서버는 기본적으로 표준 출력에 감사 이벤트를 기록합니다. 감사 이벤트는 영구 스토리지에 기록되어야 합니다. 감사 이벤트에는 보안 사고를 식별하고 정책 위반을 모니터링하며 거부 없음 제어를 지원하는 데 사용되는 중요한 데이터가 포함됩니다.

예제 1: 다음 구성은 --audit-log-path 플래그 없이 Kubernetes API 서버를 시작합니다.

...
spec:
  containers:
  - command:
    - kube-apiserver
    - --authorization-mode=RBAC
  image: example.domain/kube-apiserver-amd64:v1.6.0
...
References
[1] Audit Policy The Kubernetes Authors
[2] Standards Mapping - CIS Kubernetes Benchmark Recommendation 1.2.18
[3] Standards Mapping - Common Weakness Enumeration CWE ID 778
[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172
[5] Standards Mapping - FIPS200 CM
[6] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)
[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation
[9] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration
[10] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)
[11] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls
[12] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management
[13] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration
[14] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration
[15] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration, A10 Insufficient Logging and Monitoring
[16] Standards Mapping - OWASP Top 10 2021 A09 Security Logging and Monitoring Failures
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10, Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4
[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2
[25] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2
[26] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking
[27] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking
[28] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking
[29] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3680.4 CAT II, APP3680.5 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3680.4 CAT II, APP3680.5 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3680.4 CAT II, APP3680.5 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3680.4 CAT II, APP3680.5 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3680.4 CAT II, APP3680.5 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3680.4 CAT II, APP3680.5 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3680.4 CAT II, APP3680.5 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000830 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000830 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000830 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000830 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000830 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000830 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000830 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000830 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000830 CAT II
[45] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II
[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000830 CAT II
[47] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II
[48] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II
[49] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000830 CAT II
[50] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000830 CAT II
[51] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)
desc.structural.yaml.kubernetes_misconfiguration_api_server_logging_disabled