Test for secrets in code, container images and history.

Risk:Stored secrets in git history, in container images or directly in code shouldn't exists because they might be exposed to unauthorized parties.

Test the deployment configuration for virtualized environments for unsecured configurations.

Risk:The deployment configuration (e.g. kubernetes deployment resources) might contain unsecured configurations.

Check the image age of containers in production.

Risk:Old container images in production indicate that patch management is not performed and therefore vulnerabilities might exists.

Test virtualized environments for unsecured configurations.

Risk:Virtualized environments (e.g. via Container Images) might contains unsecure configurations.

With the help of tools, the configuration of virtual environments are tested.

Risk:Standard hardening practices for cloud environments are not performed leading to vulnerabilities.

Test the definition of virtualized environments for unsecured configurations.

Risk:The definition of virtualized environments (e.g. viaDockerfile) might contain unsecure configurations.

Check logs for keywords.

Risk:Not aware of attacks happening.

Check for malware in components (e.g. container images, VM baseline images, libraries).

Risk:Third party might include malware. Ether due to the maintainer (e.g. typo squatting of an image name and using the wrong image) or by an attacker on behalf of the maintainer with stolen credentials.

Check for new images of containers in production.

Risk:When a new version of an image is available, it might fix security vulnerabilities.

This practice ensures newly deployed container or VM images do not reintroduce or perpetuate known vulnerabilities that exist in the current infrastructure. This process involves cross-referencing existing vulnerability data from infrastructure scans with the components and dependencies in updated images. By continuously correlating known security issues with new image versions, organizations can proactively mitigate risks before deploying potentially vulnerable images to production.

Risk: Failing to correlate known vulnerabilities in infrastructure with new image versions can lead to the unintended deployment of insecure artifacts, which increases the risk of exploitation.

Subscribing to Github projects and reading release notes might help. Software Composition Analysis for infrastructure might help, but is often too fine-granular.

Risk: Known vulnerabilities in infrastructure components like container images might get exploited.