Non-sysadmin here, I could only find some generic info on ISO 27002/27001, what does it say about containerized applications?
Comment on Drop OSS - an open-source, self-hosted alternative to platforms like Steam and Epic.
corsicanguppy@lemmy.ca 3 days ago
The server part seems to be container-only. That’s a shame if you’re aware of iso27002 or SLSA.
joulethief@discuss.tchncs.de 3 days ago
NewOldGuard@lemmy.ml 3 days ago
?? Containers can be ISO 27002 compliant, they don’t have a control against them to my knowledge
warmaster@lemmy.world 3 days ago
I’ve seen similar comments regarding this. I’m a noob selfhoster. I would be very grateful if you could explain the concept.
gccalvin@lemmy.world 3 days ago
ISO 27002 is a guidance and reference document for the ISO 27001 standard. There is no ISO 27002 certification. Organizations that wish to be ISO 27001 certified only have to follow the requirements listed in the ISO 27001 standard, not ISO 27002.
Regardless, I just reviewed the latest releases (ISO 27001:2022 and ISO 27002:2022). There is no mention of containers or containerization within ISO 27001. Containerization and virtualization are both mentioned within the 27002 reference, as a potential method of isolating confidential data. If anything, the document is recommending the use of containers as a preventive control measure.