Canonical catalogue of security requirements for containers and images (CNT-001 to CNT-012), with applicability by risk level and acceptance criteria for the selection of base images, hardening, signing, scanning, runtime policies and access to registries.
Dynamic testing at runtime to detect vulnerabilities by simulating external interactions.
Minimisation, hardening and effective verification of permissions in images and containerised environments
Instrumentation of the application for real-time observation of vulnerabilities during execution.
Identification and definition of the technical and operational domains to be monitored in modern systems.
Responsibilities of SecOps (Security Operations) in SbD-ToE
Selection, hardening and validation of secure base images for containers
Organisational policy that defines the security requirements for the building, scanning, signing, runtime configuration and management of container images, including securityContext hardening, admission policies in Kubernetes, network isolation and runtime monitoring, proportional to the criticality level (L1, L2, L3).
Effective application and verification of security, isolation and control practices for containerised workloads
Operational patterns for serving self-hosted AI models (vLLM, Ollama, TGI, llama.cpp, NVIDIA Triton) — workload isolation, weight management, protection of inference, AI-specific container hardening.
Automatic application of formal policies to block non-compliant executions, without replacing human decision