add more risks for not having max lifetime

add risk for not having max lifetime based on @louwersj see #13

Author: wurstbrot

data/BuildandDeployment.yml

@@ -238,8 +238,8 @@ Patch Management:
     level: 2
     samm2: o-environment-management|B|1
   Usage of a maximum lifetime (age) for images:
-    risk: Vulnerabilities in images of running containers stay for too long and might get exploited.
-    measure: The periodically builded images are deployed minimum every 30 days (better hourly/daily/weekly). Meaning an image is not in production for longer than 30 days.
+    risk: Vulnerabilities in images of running containers stay for too long and might get exploited. Long running containers have potential memory leaks. A compromised container might get killed by restarting the container (e.g. in case the attacker has not reached the persistence layer).
+    measure: The periodically builded images are deployed minimum every 30 days (better hourly/daily/weekly). Meaning an image is not in production for longer than 30 days. 
     difficultyOfImplementation:
       knowledge: 3
       time: 4