cyberstrikeus 4.12 Ensure all signed artifacts are validated (Manual)
Profile Applicability
- Level 1 - Docker - Linux
Description
Validate artifacts signatures before uploading to the package registry.
Rationale
Cryptographic signature is a tool to verify artifact authenticity. Every artifact is supposed to be signed by its creator in order to verify that it wasn't compromised until it got to the client. Validating artifact signature before delivering it is another level of protection, which checks that the signature hasn't been changed, which means that no one tried or succeeded in tampering with the artifact. That sets trust between the supplier and the client.
Audit Procedure
Ensure every artifact in the package has been validated with its signature.
Remediation
Validate every artifact with its signature. It is recommended to do so automatically.
CIS Controls
v8
2.7 Allowlist Authorized Scripts
Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.
v7
2.7 Utilize Application Whitelisting
Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.