Anthropic-Cybersecurity-Skills/skills/scanning-kubernetes-manifests-with-kubesec/references/standards.md

Standards and References - Kubesec Manifest Scanning

Industry Standards

CIS Kubernetes Benchmark v1.9

• Section 5.2: Pod Security Standards -- Kubesec validates privileged mode, host namespaces
• Section 5.7: General Policies -- Service account configuration, resource limits
• Maps directly to kubesec scoring checks for container security contexts

NIST SP 800-190: Application Container Security Guide

• Section 3.1: Image vulnerabilities and configuration defects
• Section 3.4: Orchestrator security -- manifest validation before deployment
• Section 4.1: Countermeasures for image vulnerabilities

Kubernetes Pod Security Standards (PSS)

• Privileged: No restrictions (kubesec score = lowest)
• Baseline: Prevents known privilege escalation (kubesec validates hostPID, hostNetwork, privileged)
• Restricted: Best practices enforcement (kubesec validates all recommended controls)

Compliance Mapping

Kubesec Check	CIS Control	NIST 800-190	PCI DSS
Privileged containers	5.2.1	3.4.4	2.2
Host PID namespace	5.2.2	3.4.2	2.2
Host network	5.2.4	3.4.3	1.3
Root execution	5.2.6	3.4.1	7.1
ReadOnlyRootFilesystem	5.2.8	4.1.2	2.2
Resource limits	5.4.1	4.3.1	2.2
Service accounts	5.1.5	3.4.5	7.2

Tool Ecosystem

Complementary Scanning Tools

• Kubescape: NSA/CISA framework compliance scanning
• Checkov: Infrastructure-as-code security scanning (covers Kubernetes)
• Datree: Policy enforcement with custom rules
• OPA/Gatekeeper: Runtime policy enforcement as admission controller

Integration Points

• Pre-commit hooks for developer feedback
• CI/CD pipeline gates to prevent insecure deployments
• Admission webhooks for runtime enforcement
• IDE plugins for shift-left security