Full Report
The Wiz admission controller simplifies supply chain security by ensuring only trusted container images can be deployed in Kubernetes environments.
Analysis Summary
# Best Practices: Container Image Supply Chain Security and Integrity Validation
## Overview
These practices address the security risks introduced by the proliferation of container images and microservices, focusing specifically on securing the software supply chain against tampering, unauthorized sources, and malicious injection during the development and deployment process. The core goal is to ensure that only cryptographically verified and trusted container artifacts are deployed to production environments, particularly Kubernetes.
## Key Recommendations
### Immediate Actions
1. **Implement Container Image Signing:** Establish a firm policy and initial process to cryptographically sign all container images upon successful build, utilizing tools like Cosign or Notary.
2. **Deploy an Admission Controller:** Immediately deploy a Kubernetes Admission Controller capable of policy enforcement to begin intercepting and reviewing deployment requests for container images.
3. **Define Trusted Sources:** Create an initial, centralized list defining which developers, teams, and pipelines are explicitly authorized to build and sign deployable container images.
### Short-term Improvements (1-3 months)
1. **Enforce Image Verification Pre-Deployment:** Configure every Admission Controller policy to *block* the deployment of any container image that lacks a valid signature from a trusted entity.
2. **Integrate Integrity Validation with Existing Tools:** Configure the admission controller to leverage existing signing infrastructure (e.g., Cosign keys) to perform the verification step before allowing workloads onto Kubernetes clusters.
3. **Establish Centralized Visibility:** Configure logging and monitoring to capture all image verification events (both pass and fail) generated by the Admission Controller across all active Kubernetes clusters.
### Long-term Strategy (3+ months)
1. **Establish End-to-End Supply Chain Governance:** Extend security coverage beyond deployment validation to track image integrity from code creation (build stage), through storage (registry scanning), to runtime execution.
2. **Automate Threat Response based on Context:** Integrate admission controller failure events with the broader Security Graph context (cloud, container, runtime data) to generate high-fidelity alerts and automate containment procedures for unauthorized deployment attempts.
3. **Regularly Review and Audit Policies:** Periodically audit the list of trusted signers and the admission controller policies to ensure they reflect current organizational structure, development pipelines, and security posture.
## Implementation Guidance
### For Small Organizations
- **Leverage Open Source Foundations:** Focus on quickly adopting and manually integrating image signing tools like Cosign.
- **Prioritize Enforcement:** Immediately enforce the "signed/trusted only" rule via a simple Admission Controller configuration in staging environments before rolling out to production. Keep the list of trusted sources small initially.
### For Medium Organizations
- **Automate Policy Definition:** Use centralized configuration management (e.g., GitOps) to manage the definition of integrity validators and associated access policies across multiple clusters.
- **Standardize Signing:** Mandate that all new microservices pipelines *must* incorporate image signing as a mandatory build step before images can be pushed to staging registries.
### For Large Enterprises
- **Centralized CNAPP Integration:** Deploy a Cloud-Native Application Protection Platform (CNAPP) solution capable of integrating image verification directly into the admission control layer for a unified management plane.
- **Granular Authorization:** Implement complex RBAC (Role-Based Access Control) rules tied to image source origin, allowing different teams to deploy images signed only by their authorized pipeline execution environments.
- **Comprehensive Visibility Rollout:** Ensure all cluster activity logs related to image deployment failures are streamed to a central SIEM/SOC platform for comprehensive MTTD/MTTR analysis.
## Configuration Examples
*Specific configuration details are often proprietary or tool-dependent, but the principle revolves around:*
1. **Define the Validator Policy:** Establish a rule that requires an image to have an accompanying signature verified against a known public key (or certificate authority).
2. **Admission Controller Configuration:** Deploy the controller (e.g., implementing OPA/Gatekeeper or a vendor-specific controller) configured to deny the Kubernetes admission chain request if the image metadata check fails the validation policy.
3. **Command Example (Conceptual based on tools mentioned):** Ensure the build pipeline executes: `cosign sign <image_name>:<tag>` and the K8s deployment enforces: `admission_controller.validate(image) requires signature_found=True AND signature_verified=True`.
## Compliance Alignment
- **NIST SP 800-218 (Secure Software Development Framework - SSDF):** Directly supports the Protect Stage (e.g., PR.DS-1: Protection Against Software Tampering).
- **ISO/IEC 27001/27034:** Addresses requirements for secure development practices and managing control over deployed software components.
- **CIS Benchmarks (Especially for Kubernetes):** Aligns with hardening clusters against unauthorized deployments and maintaining strict configuration control.
## Common Pitfalls to Avoid
- **Blind Trust in Source Registries:** Do not assume images pulled from a trusted *registry* are inherently safe; they must still be *signed and verified* as the registry itself can be compromised.
- **Configuration Drift:** Failing to use infrastructure-as-code or GitOps to manage the Admission Controller policies, leading to inconsistency between clusters.
- **Ignoring Failed Deployments:** Treating failed image verification alerts as informational noise instead of actively investigating the attempted deployment, which may signify an active compromise attempt.
- **Manual Maintenance of Trust Roots:** Relying on manual key rotation or policy updates, which is unsustainable at scale and prone to human error.
## Resources
- **Cosign Documentation (Sigstore):** For open-source image signing implementation.
- **Notary Project Documentation:** Alternative open-source solution for image signing and verification.
- **Vendor Admission Controller Documentation (e.g., Wiz Docs):** For implementation specifics on integrating existing signing processes with vendor-provided policy enforcement tools.