Details

By leveraging Docker Secrets or Kubernetes secrets to store configuration files and small amounts of user-generated data (up to 500 kb in size), the data is encrypted at rest by the Engine’s FIPS-validated cryptography.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

For all containerized applications that leverage configuration files and/or small amounts of user-generated data, store that data in Docker Secrets.

All secrets should be created and managed using a UCP client bundle.

A reference for the use of docker secrets can be found at https://docs.docker.com/engine/swarm/secrets/.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-UNIX_V2R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-28
• CAT|II
• CCI|CCI-001199
• Rule-ID|SV-235826r627605_rule
• STIG-ID|DKER-EE-002660
• STIG-Legacy|SV-104823
• STIG-Legacy|V-95685
• Vuln-ID|V-235826

Source

• Tenable.com/audits