4 ms·
Does the NSA/CISA advice differ significantly from CIS? KubeBench does a great job of CIS assessment.
by ButterWashed 5y ago
Does the NSA/CISA advice differ significantly from CIS? KubeBench does a great job of CIS assessment.
- lsandler 5y agoCIS is very prescriptive. It gives you a list of very specific checks with very little context. NSA, on the other hand, explains the problems and potential attack vectors allowing you to adjust and extend the checks to your specific needs.
- chmod-777 5y agoThere is also an implementation difference between the two, while KubeBench requires installation within the cluster, Kubescape runs as CLI from any computer using Kube API, so it can be added to any CI/CD pipeline very easily, also the latest version enables you to scan YAML files before you deploy them so you know early on whether you are compliant.
- raesene9 5y agoThe NSA doesn't really do a full coverage of Kubernetes security hardening, but does touch on a lot of the same ground as the CIS benchmark. It also covers some areas that aren't in-scope of the CIS benchmark, at a high level.