Full Report
Unified visibility, posture, and runtime protection for security teams owning their side of the OpenShift shared responsibility model.
Analysis Summary
# Best Practices: OpenShift Security (Shared Responsibility Model)
## Overview
These practices address the "customer side" of the OpenShift shared responsibility model. While OpenShift provides a hardened platform, security teams must proactively manage the security of workloads, identities, configurations, and data across hybrid environments (cloud, on-prem, and air-gapped).
## Key Recommendations
### Immediate Actions
1. **Map the Environment:** Deploy Kubernetes Connectors to interrogate APIs and build a visual inventory of all OpenShift clusters, including cross-environment relationships.
2. **Enable Runtime Sensing:** Deploy runtime sensors (e.g., Wiz Runtime Sensor) to detect active threats, malware, and unauthorized executions in real-time.
3. **Identify High-Risk RBAC:** Scan for excessive permissions and privilege escalation paths within Kubernetes RBAC that could lead to cluster-wide compromise.
4. **Audit Internet Exposure:** Validate which services are exposed via Ingress or LoadBalancers to eliminate accidental public exposure.
### Short-term Improvements (1-3 months)
1. **Implement Admission Control:** Deploy an Admission Controller (like the Wiz Admission Controller) to block insecure images or misconfigured workloads *before* they reach production.
2. **Establish Vulnerability Scanning:** Use sensors and workload scanners to evaluate running containers for known vulnerabilities (CVEs), exposed secrets, and sensitive data.
3. **Assess Configuration Drift:** Monitor for deviations from the established security posture (KSPM) and remediate "drift" where manual changes have bypassed standard CI/CD processes.
### Long-term Strategy (3+ months)
1. **Unified Posture Management:** Consolidate posture management (KSPM), runtime detection, and compliance into a single "graph-based" view to correlate cloud-to-cluster risks.
2. **Supply Chain Security:** Integrate checks for malicious packages (e.g., npm/Miasma attacks) and ensure the integrity of the container supply chain.
3. **Hybrid Connectivity Audit:** Regularly review lateral movement paths between on-prem OpenShift clusters and cloud environments (e.g., on-prem workloads holding cloud API keys).
## Implementation Guidance
### For Small Organizations
- Focus on **"Hardened by Default"**: Rely on OpenShift’s native security features and implement basic KSPM scanning to find low-hanging fruit like "privileged: true" containers.
### For Medium Organizations
- Prioritize **Admission Control**: Shift left by enforcing security gates in the deployment pipeline to prevent your small team from being overwhelmed by runtime alerts.
### For Large Enterprises
- Focus on **Unified Visibility**: Connect disparate environments (VMware-based OpenShift, public cloud, and air-gapped units) into a single security graph to manage risk at scale and satisfy regulatory audits continuously.
## Configuration Examples
*Note: While specific YAML code wasn't in the text, the following are the configuration areas highlighted for focus:*
- **RBAC Policies:** Restrict `cluster-admin` roles and audit `ServiceAccount` permissions.
- **Security Context Constraints (SCC):** Ensure workloads are not running with any SCCs more permissive than `restricted`.
- **Network Policies:** Implement "deny-all" default ingress/egress and whitelist only necessary microservice communication.
## Compliance Alignment
The platform suggests continuous validation against:
- **CIS Red Hat OpenShift Container Platform Benchmark**
- **PCI DSS** (Payment Card Industry)
- **SOC 2**
- **HIPAA**
- **NIST** (800-53 / 800-190)
## Common Pitfalls to Avoid
- **The "Silo" Trap:** Using separate tools for on-prem OpenShift and Cloud Kubernetes, which hides lateral movement paths (e.g., an on-prem cluster with cloud access keys).
- **Compliance as an Audit-only Task:** Treating compliance as a quarterly manual check rather than a continuous, automated posture validation.
- **Ignoring Secrets in Images:** Failing to scan running containers for hardcoded secrets or cloud credentials in environment variables.
## Resources
- **Red Hat OpenShift Shared Responsibility Model:** [redhat[.]com/en/blog/a-guide-to-azure-red-hat-openshifts-built-in-security-features]
- **Wiz Kubernetes Security Report:** [wiz[.]io/reports/kubernetes-security-report-2025]
- **OpenShift Security Documentation:** [docs[.]openshift[.]com]
- **CIS Benchmarks:** [cisecurity[.]org/benchmark/kubernetes]