Red Hat OpenShift Container Platform 4.12 STIG

18 items · Security · Hard difficulty · 4 hours

Essential STIG tasks to secure OpenShift 4.12 for DoD compliance.

• Verify OpenShift version is 4.12

  Confirm installed version matches cpe:/a:redhat:openshift_container_platform:4.12

• Apply latest OpenShift patches and updates

  Include all security errata and node/cluster updates from Red Hat

• Run STIG compliance scan against the cluster

  Use XCCDF-based tools or authorized scanners to assess compliance

• Generate CUI/non-compliance report for AO review

  Produce a report of failed STIG items for authorizing official review

• Configure Role-Based Access Control (RBAC) least privilege

  Restrict cluster-admin rights and grant only required permissions

• Integrate with central identity provider (SSO/IAM)

  Delegate authentication to the enterprise IAM for centralized control

• Configure SSO provider for OpenShift

  Set up OIDC or SAML per enterprise standards

• Map enterprise roles to OpenShift roles

  Align IAM groups and roles to cluster RBAC policies

• Enforce strong authentication policies (MFA, password complexity)

  Require MFA and set password/lockout policies via IAM

• Enable and forward audit logs to central log server

  Collect cluster and API audit logs and centralize them for analysis

• Enable OpenShift audit logging with required retention

  Configure audit policy, log levels, and retention per STIG

• Configure log forwarder to send logs to central server

  Use Fluentd/Vector or approved forwarder and secure the transport

• Implement network segmentation using NetworkPolicies

  Limit pod-to-pod and ingress/egress access per workload needs

• Harden container runtime and node configuration

  Apply sysctl, seccomp, SELinux, and node hardening settings

• Disable unused services and API endpoints

  Remove or restrict extra addons, routes, and unused APIs

• Scan and remediate container images for vulnerabilities

  Integrate image scanning in CI/CD and remediate before deploy

• Review and remediate known CVEs affecting the platform

  Track applicable CVEs and apply patches or mitigations promptly

• Document exceptions and obtain Authorizing Official (AO) approval

  Record deviations, compensating controls, and mitigation timelines

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.