Detections
Analytics

4.6.3 Require hardened security contexts for all workload Pods and containers

Information

Require hardened security contexts for GKE workload Pods and containers. Security contexts should define workload level and container level controls that reduce privilege, limit host exposure, and enforce safer runtime behavior.

Security contexts control important runtime security settings for Pods and containers, including user and group identity, privilege escalation, Linux capabilities, privileged mode, seccomp profile, and related container isolation settings. GKE settings help reduce the workload attack surface and should be explicitly defined in workload manifests rather than relying on broad runtime defaults.

A hardened configuration should normally include settings such as runAsNonRoot=true, allowPrivilegeEscalation=false, privileged=false, dropped Linux capabilities, and seccompProfile.type=RuntimeDefault or an approved custom profile. These align with restricted Pod security expectations and can also be enforced or audited with admission controls such as Pod Security Admission and Policy Controller.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Update workload manifests, Helm charts, overlays, or GitOps sources so hardened security contexts are defined before deployment. Apply settings at the Pod level when they apply to all containers, and use container level settings where a specific container requires a different configuration.

 -

Set workloads to run as non root where compatible.

 -

Set allowPrivilegeEscalation=false for workload containers.

 -

Set privileged=false and remove host level access unless explicitly required.

 -

Drop unnecessary Linux capabilities, and use drop: ["ALL"] where the application supports it.

 -

Set seccompProfile.type=RuntimeDefault or use an approved custom Localhost profile.

Redeploy the workload and validate application behavior in a lower environment before broad rollout. Use admission controls such as Pod Security Admission or Policy Controller to prevent future workloads from being admitted without the required security context settings.

Impact:

Incorrectly configured security contexts can cause workloads to fail at startup or lose required runtime behavior, especially applications that expect root privileges, writable root filesystems, elevated capabilities, host access, or unrestricted system calls. Teams should test hardened settings in lower environments, document approved exceptions, and apply container level overrides only where a specific workload requirement exists.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: GCP

Control ID: a5662388e665620358937ebc67f3ca9bf20f4aa634ddd42c020a735fe083750f