Sherlocked Security – Container Security Posture Management (CSPM)
Secure your containerized environments from build to runtime across Kubernetes and CI/CD pipelines. Sherlocked Security’s CSPM advisory ensures you ship secure containers with confidence by detecting vulnerabilities, enforcing policies, and enabling runtime protection.
📄 1. Statement of Work (SOW)
- Service Name: Container Security Posture Management (CSPM)
- Client Type: Cloud-Native Startups, Platform Engineering Teams, Enterprises with DevSecOps
- Service Model: Image Security + Orchestration Audit + Runtime Controls
- Compliance Coverage: NIST 800-190, CIS Benchmarks, ISO 27001, PCI-DSS, SOC 2, HIPAA
🎯 Target Environments
- Docker
- Kubernetes (EKS, AKS, GKE, OpenShift)
- CI/CD Integration (GitHub Actions, GitLab CI, Jenkins)
🧠 2. Our Approach
- 🔹 Shift-Left Security + Runtime Protection
- 🔹 Image to Orchestration-Level Coverage
- 🔹 Policy-As-Code + DevOps Integration
Visual Workflow:
[Image Scanning] → [Orchestration Configuration Review] →
[IAM & Secrets Review] → [Runtime Protection Checks] → [Threat Detection Readiness] →
[Remediation Planning] → [Policy Integration & Monitoring]
🧪 3. Methodology
Phase-by-Phase Flow:
[Kickoff] → [Container Image Audit] → [Dockerfile & Base Image Review] →
[K8s Deployment Config Analysis] → [RBAC & Network Policy Audit] → [Runtime Defense Review] →
[Custom Policy Recommendations] → [Fix Guidance + Monitoring Validation]
📦 4. Deliverables to the Client
- ✅ Container Security Posture Matrix
- 🧾 Statement of Work (SOW)
- 📘 Technical Assessment Report:
- Image Vulnerability Findings
- Misconfigured Docker/K8s Resources
- IAM & Secrets Risks
- Network and Runtime Security Gaps
- Severity Ratings (CVSS + Exploitability)
- Screenshot Evidence & Code Snippets
- Fix Recommendations (Manual + IaC)
- Policy Templates (OPA, Kyverno, etc.)
- 📊 Architecture Diagrams (Cluster Maps, Network Flows)
- 📽️ Report Walkthrough Call
- 🔁 Free Retesting Round Post-Fix
- 🛡️ Posture Certificate
🤝 5. What We Need from You
- ✅ Access to Dockerfiles & K8s Manifests
- ✅ Container registry scan access (ECR, DockerHub, GCR)
- ✅ K8s RBAC Roles / Namespace Structure
- ✅ Runtime logs or agent access (optional)
- ✅ Contact from DevSecOps / Platform Team
- ✅ CI/CD pipelines and build steps (if included)
🧰 6. Tools & Technology Stack
- 🧪 Trivy / Grype / Clair (Image Scanning)
- 🧱 kube-bench / KubeAudit (Cluster Checks)
- 🔐 Gitleaks / TruffleHog (Secrets Detection)
- 🧬 Falco / Sysdig (Runtime Security)
- 📜 Kyverno / OPA / Gatekeeper (Policy-as-Code)
- 🚀 GitHub Actions / GitLab CI / Jenkins for Shift-Left
🚀 7. Engagement Lifecycle
- Discovery Call
- Scope Finalization
- Codebase + Cluster Access
- Image & K8s Config Audit
- Runtime Monitoring (Optional)
- Draft Report Submission
- Walkthrough Call + Fix Advisory
- Retesting
- Certificate Issuance
🌟 8. Why Sherlocked Security?
| Feature | Sherlocked Advantage |
|---|---|
| 🧱 Full-Stack Coverage | Image → CI/CD → Orchestration → Runtime |
| 🔁 Policy-As-Code Advisory | OPA, Kyverno, Gatekeeper templates included |
| 📘 Developer-Centric Fix Plans | Inline feedback + code examples |
| 🔁 Free Revalidation Round | Post remediation testing included |
| 🤝 DevSecOps Collaboration | Support via Slack/Teams during engagement |
| 🏆 Certification Issued | On closure with posture improvements verified |
📚 9. Real-World Case Studies
🛑 Exposed Container Daemon in Dev Environment
- Issue: Docker daemon socket exposed via misconfigured volume mount
- Impact: Remote attacker gained root access on host via container escape
🛠️ Kubernetes CSPM for B2B SaaS
- Client: B2B collaboration platform on EKS
- Findings: Unrestricted service accounts, privileged pods, missing network policies
- Our Role: Delivered cluster-wide config audit and Kyverno-based policy templates
- Outcome: Reduced attack surface and improved runtime controls across dev/prod
🛡️ 10. SOP – Standard Operating Procedure
- Kickoff & Scope Finalization
- Dockerfile & Image Scan
- Cluster/Namespace Policy Review
- Secrets & IAM Check
- Runtime Monitoring Audit
- Report Draft Submission
- Fix Assistance & Policy Definition
- Retesting
- Certificate Delivery
📋 11. Sample Container Posture Checklist
- ✅ Scan container images for known vulnerabilities pre-deployment
- ✅ Enforce image signing and trust policies
- ✅ Limit container privileges (no root, no host mounts)
- ✅ Apply network segmentation with namespaces and CNI policies
- ✅ Monitor container behavior at runtime
- ✅ Configure secure registries and access controls
- ✅ Use orchestrator controls (Kubernetes PodSecurity, RBAC, etc.)
- ✅ Limit communication between pods and namespaces
- ✅ Automate vulnerability remediation in the CI/CD pipeline
- ✅ Generate reports for container posture and risks