Cis Docker V170 4.12

---
name: cis-docker-v170-4.12
description: "Ensure all signed artifacts are validated"
category: cis-docker
version: "1.7.0"
author: cyberstrike-official
tags: [cis, docker, images, configuration, artifact-validation]
cis_id: "4.12"
cis_benchmark: "CIS Docker Benchmark v1.7.0"
tech_stack: [docker]
cwe_ids: [CWE-345]
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS Docker Benchmark v1.7.0 - Control 4.12

## Profile Applicability

- Level 1 - Docker - Linux

## Description

Validate artifacts signatures before uploading to the package registry.

## Rationale

Cryptographic signature is a tool to verify artifact authenticity. Every artifact is supposed to be signed by its creator in order to verify that it wasn't compromised until it got to the client. Validating artifact signature before delivering it is another level of protection, which checks that the signature hasn't been changed, which means that no one tried or succeeded in tampering with the artifact. That sets trust between the supplier and the client.

## Audit Procedure

Ensure every artifact in the package has been validated with its signature.

## Remediation

Validate every artifact with its signature. It is recommended to do so automatically.

## CIS Controls

**v8:**

- 2.7 Allowlist Authorized Scripts - Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.

**v7:**

- 2.7 Utilize Application Whitelisting - Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.

## Assessment Status

Manual