feat: add security best-practices (#111)

Author: srodenhuis

docs/for-devs/security-best-practices.md

@@ -0,0 +1,23 @@
+---
+slug: security-best-practices
+title: Security Best Practices
+sidebar_label: Security Best Practices
+---
+
+In addition to the out-of-the-box security capabilities provides by App Platform, it is a responsibility of Teams to keep their applications safe from bad actors. Here is a list of security best-practices Teams should implement:
+
+1. Use [secrets](../for-devs/console/sealed-secrets.md) to secure sensitive data and use a `secretKeyRef` to map an environment variable to the secret data.
+
+2. Drop `ALL` or specific capabilities in the Pod or container `SecurityContext` to ensure all (unused) capabilities are disabled.
+
+3. Make sure containers are running with a read-only root file system by setting the `readOnlyRootFilesystem` to `true` in the Pod or container `SecurityContext`.
+
+4. Prevent pods from sharing the host’s IPC or network namespace by setting the `hostNetwork` parameter to `false`.
+
+5. Avoid running containers in privileged mode by setting the `allowPrivilegeEscalation` parameter to false in the Pod or container `SecurityContext`.
+
+6. Identify and mitigate threats in running containers. See the [Detect threats in running containers](../get-started/labs/detect-threats.md) hands-on lab for more information.
+
+7. Scan running container for vulnerabilities. See the [Scan running containers for vulnerabilities](../get-started/labs/scan-containers.md) hands-on lab for more information.
+
+8. Scan images pushed to the Team's private container registry in Harbor for vulnerabilities. See the [Scan images for vulnerabilities](../get-started/labs/scan-images.md) hands-on lab for more information.

docs/for-ops/security-best-practices.md

@@ -0,0 +1,48 @@
+---
+slug: security-best-practices
+title: Security Best Practices
+sidebar_label: Security Best Practices
+---
+
+The Akamai App Platform comes with many security capabilities. It is up to the platform administrator to make sure these capabilities are enabled and correctly used. The following checklist can be used to make sure security is implemented to follow best-practices when running App PLatform on LKE.
+
+1. **Install the cloud-firewall-controller for LKE**
+
+Using the [cloud-firewall-controller](https://github.com/linode/cloud-firewall-controller) ensures that all nodes in the cluster are added to the same Cloud firewall ruleset.
+
+2. **Limit access to the cluster API server**
+
+Kubernetes API servers should not ordinarily be exposed to the open internet. Use the `Control Plane ACL` for LKE to only allow access to the API server from trusted IP addresses.
+
+3. **Use Object Storage for persistency**
+
+Use the Object Storage Wizard in App Platform to prevent dataloss. In case container logs contain sensitive data, the bucket used by Loki can be encrypted (at rest) using SSE-C (SSE-S3/SSE-KMS is currently not supported).
+
+4. **Enable vulnerability scanning in Harbor**
+
+Enable `Automatically scan images for vulnerabilities` in the Team project settings in Harbor to automatically scan all images on push.
+
+5. **Don't disable network policies for Teams**
+
+By default App Platform enforces the use of network policies (ingress and egress). This means that by default all traffic between Pods in the Team namespace and access to external URLs or IP addresses is forbidden. To allow traffic between Pods or access to external URLs or IP addresses, Teams need to create netwok policies. Disabling network policies increases risks and is not adviced.
+
+6. **Enable observability**
+
+App Platform comes with a fully integrated and pre-configured stack of observability applications for Kubernetes. The observability applications (like Prometheus, Grafana and Alertmanager) are disabled by default. It is adviced to turn on the observability applications to get insights into resource usage and possible issues.
+
+7. **Secure Personally Identifiable Information**
+
+By default (during installation), App Platform will use a self-hosted Keycloak instance as an internal identity provider (IdP). When users are created in App Platform, these users will be stored in Keycloak. The user data in Keycloak is NOT encrypted. When Personally Identifiable Information (PII) needs to be encrypted because of compliance regulations, it is advised to enable disk encryption or configure App Platform to use an external IdP:
+
+- Enable disk encryption on all nodes.
+
+Disk encryption ensures that your data stored on compute instances is secured. In addition to Akamai's information security compliance with standards such as SOC 2, disk encryption provides further protections by keeping data encrypted, even if the disk is removed, decommissioned, or disposed of. See [here](https://techdocs.akamai.com/cloud-computing/docs/local-disk-encryption) for more information on disk encryption.
+
+- **Use an external Identity Provider**
+
+Configure App Platform to use an [external IdP](../for-ops/console/settings/oidc.md).
+
+8. **Configure Keycloak to use 2 factor authentication (MFA)**
+
+When no external IdP is used, it is advised to configure the `otomi` realm to force users to use a MFA app like Google Authenticator, Microsoft Authenticator or Free OTP to use one time passwords (OTP). See [here](https://www.keycloak.org/docs/latest/server_admin/index.html#configuring-authentication_server_administration_guide) for instructions.
+

docs/get-started/labs/scan-containers.md

@@ -1,6 +1,6 @@
 ---
 slug: scan-containers
-title: Scan your running containers for vulnerabilities
+title: Scan running containers for vulnerabilities
 sidebar_label: Scan Containers
 ---
 

docs/get-started/labs/scan-images.md

@@ -1,6 +1,6 @@
 ---
 slug: scan-images
-title: Scan your images for vulnerabilities
+title: Scan images for vulnerabilities
 sidebar_label: Scan Images
 ---
 

sidebar-docs.js

@@ -68,6 +68,7 @@ module.exports = {
           "for-devs/console/shell",
         ],
       },
+      "for-devs/security-best-practices",
     ],
     "For Platform Adminstrators": [
       {
@@ -130,6 +131,7 @@ module.exports = {
         ],
       },
       "for-ops/known-issues",
+      "for-ops/security-best-practices",
     ],
   },
 };