Infrastructure Hardening Audit
infrastructure-hardening · v1.1.1 · paid
Container, Kubernetes, and network security review covering image hardening, RBAC, network policies, and supply chain integrity.
Container & Image Security
container-image-security · weight 0.3
- criticalAll Dockerfile FROM statements use official base images with SHA-256 digest pinningab-001630
- criticalDockerfile includes USER directive with non-root UID above 1000ab-001631
- criticalImage layers are scanned for hardcoded credentials and secretsab-001632
- highImage uses multi-stage builds to minimize final layer sizeab-001633
- highCI/CD pipeline runs vulnerability scanning on every image buildab-001634
Network & TLS
network-tls · weight 0.25
Access Control & RBAC
access-control-rbac · weight 0.2
- highKubernetes RBAC configured with minimal permissions; no wildcard verbs or cluster-adminab-001638
- mediumNo containers run with privileged flag or securityContext.privileged: trueab-001639
- mediumContainers run with read-only root filesystem where permittedab-001640
- mediumSecrets are stored in a dedicated secrets manager with encryption at restab-001641
Monitoring & Incident Response
monitoring-incident-response · weight 0.25
- mediumKubernetes audit logging is enabled and covers authentication, API calls, and RBAC denialsab-001642
- mediumEgress traffic is restricted to approved destinations; no open egress to 0.0.0.0/0ab-001643
- lowImages are signed using Docker Content Trust or Cosign; verification enforced at deploymentab-001644
- lowDNSSEC enabled; DNS query logging configuredab-001645
- lowImage pull credentials enforced via ImagePullSecrets or IAM-based registry authenticationab-001646
- lowLiveness and readiness probes configured for all Deploymentsab-001647
- lowCPU and memory resource limits defined for all podsab-001648
- lowContainer runtime security policies (seccomp, AppArmor) are appliedab-001649
- lowPod Security Standards enforcement at namespace levelab-001650
- lowProduction containers do not expose SSH port 22 or RDPab-001651
- infoCDN or WAF deployed with DDoS protection, geo-blocking, rate limiting, and bot detectionab-001652
- infoCentralized log aggregation configured with timestamps, severity, and trace IDsab-001653
- infoAlerting configured for anomalous patterns (failed logins, privilege escalation, unexpected connections)ab-001654
- infoDisaster recovery procedures documented, tested quarterly, with RTO and RPO targetsab-001655