Initial commit

02-standards/kubernetes-security-standard.md

@@ -0,0 +1,70 @@
+Title: Kubernetes Security Standard
+Document ID: [STD-K8S-001]
+Version: 0.1 Draft
+Status: Draft
+Owner: CISO (Paul Jenkins)
+Approver: CISO (Paul Jenkins)
+Classification: Internal
+Effective date: [DD Month YYYY]
+Review date: [DD Month YYYY]
+
+# Kubernetes Security Standard
+
+## Purpose
+
+This standard defines the minimum requirements for securing Kubernetes clusters, workloads, and supporting control planes used within the ISMS scope.
+
+## Scope
+
+This standard applies to Kubernetes clusters, namespaces, workloads, controllers, configuration manifests, ingress paths, secrets usage, administrative access, and supporting operational components.
+
+## Mandatory Requirements
+
+Access to Kubernetes control planes, cluster administration functions, and production namespaces must be restricted to authorised personnel and systems.
+
+Role-based access controls must be defined and maintained to limit privileges according to operational need.
+
+Cluster and workload configuration must follow approved security baselines, including restrictions on overly permissive settings and unnecessary privilege.
+
+Secrets used by workloads must be managed through approved secrets management processes and must not be embedded insecurely in manifests or images.
+
+Network exposure and service-to-service connectivity must be controlled according to business need and risk.
+
+Cluster changes and workload deployments must be subject to approved change and deployment controls.
+
+Security-relevant cluster events and administrative activity must be logged and monitored where feasible.
+
+Workloads, images, and supporting components must be maintained in line with vulnerability and patch management expectations.
+
+## Implementation Guidance
+
+BlackDice should apply this standard in a way that reflects its use of containerised services, automation pipelines, and potentially different deployment models across SaaS and operator-hosted environments.
+
+Kubernetes security assurance should address both platform-level controls and workload-level controls.
+
+Baseline expectations should cover namespace separation, administrative identity, workload privilege, network policy, configuration validation, and image provenance where relevant.
+
+Where managed Kubernetes services are used, BlackDice should define which responsibilities remain with the provider and which remain internal.
+
+## Roles and Responsibilities
+
+- [Role] must define Kubernetes security expectations.
+- Platform owners must ensure clusters and supporting services meet this standard.
+- Engineering and operations teams must deploy and manage workloads in line with approved controls.
+
+## Exceptions
+
+Exceptions must be documented, risk-assessed, approved, and reviewed through the defined process.
+
+## Related Documents
+
+- Cloud Security Policy
+- Network and Infrastructure Security Policy
+- Secrets Management Standard
+- CI/CD Security Standard
+
+## Version Control
+
+| Version | Date | Description of Change | Author |
+| --- | --- | --- | --- |
+| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |