Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
OpenShift must protect against or limit the effects of all types of Denial-of-Service (DoS) attacks by employing organization-defined security safeguards by including a default resource quota.
Description
Discussion Text
DNS attacks that are internal to the container platform (exploited or otherwise malicious applications) can have a limited blast radius by adhering to least privilege RBAC and Network access:
https://docs.openshift.com/container-platform/4.8/post_installation_configuration/network-configuration.html#post-install-configuring-network-policy
Additionally, applications can even be limited using OpenShift Service Mesh Operator.
DoS attacks coming from outside the cluster (ingress) can also be limited using an external cloud load balancer or by using 3scale API Gateway:
https://docs.openshift.com/container-platform/4.8/security/container_security/security-platform.html
Resource quotas must be set on a given namespace or across multiple namespaces. Using resource quotas will help to mitigate a DoS attack by limiting how much CPU, memory, and pods may be consumed in a project. This helps protect other projects (namespaces) from being denied resources to process.
https://docs.openshift.com/container-platform/4.8/applications/quotas/quotas-setting-per-project.html
https://docs.openshift.com/container-platform/4.8/post_installation_configuration/network-configuration.html#post-install-configuring-network-policy
Additionally, applications can even be limited using OpenShift Service Mesh Operator.
DoS attacks coming from outside the cluster (ingress) can also be limited using an external cloud load balancer or by using 3scale API Gateway:
https://docs.openshift.com/container-platform/4.8/security/container_security/security-platform.html
Resource quotas must be set on a given namespace or across multiple namespaces. Using resource quotas will help to mitigate a DoS attack by limiting how much CPU, memory, and pods may be consumed in a project. This helps protect other projects (namespaces) from being denied resources to process.
https://docs.openshift.com/container-platform/4.8/applications/quotas/quotas-setting-per-project.html
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.