Do not allow sensitive account login to front-end UI
Do not allow login with sensitive accounts (accounts that can be used internally such as backend/middleware/database) to any front-end user interface.
OWASP Cheat Sheets · all subjects
authentication/account_types
7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Do not use same authentication solution for internal and external access
Do not use the same authentication solution (such as IDP or Active Directory) used internally for unsecured access such as public access or DMZ.
Set unprivileged user in container via docker run -u option
Run containers with the -u option specifying a non-root user ID. Example: docker run -u 4000 alpine. This prevents privilege escalation attacks by ensuring the container process runs as an unprivileged user rather than root.
Set unprivileged user in Dockerfile with USER directive
In the Dockerfile, create an unprivileged user and group, then use the USER directive to run the container as that user. Example: FROM alpine, RUN groupadd -r myuser && useradd -r -g myuser myuser, then USER myuser after any root-required operations like package installation.
Enable user namespace support with --userns-remap=default
Enable user namespace support on the Docker daemon using --userns-remap=default configuration. This provides an additional layer of user isolation for running unprivileged containers.
Kubernetes Security Context runAsUser configuration
In Kubernetes, configure the Security Context with the runAsUser field to specify the user ID for pod containers. Example: securityContext: runAsUser: 4000. As a cluster administrator, configure the Restricted pod security standard level with the built-in Pod Security admission controller for hardened defaults.
Implement access control lists with acl module
Use the `acl` npm module to implement access control lists (ACL) for authorization. Create roles and assign users to those roles following the principle of least privilege, ensuring each user role only accesses resources they must use.