From 262f4fa2d3d1b4874f335fd84318031c235e9d90 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Sep 2025 19:16:00 +0800 Subject: [PATCH] misc: removed unnecessary section in security architecture --- .../platform/gateways/security.mdx | 71 ------------------- 1 file changed, 71 deletions(-) diff --git a/docs/documentation/platform/gateways/security.mdx b/docs/documentation/platform/gateways/security.mdx index db2c25f40..dc70aa36f 100644 --- a/docs/documentation/platform/gateways/security.mdx +++ b/docs/documentation/platform/gateways/security.mdx @@ -131,74 +131,3 @@ The architecture provides tenant isolation through multiple certificate authorit - Each organization's traffic flows through isolated certificate-authenticated channels - Relay servers route traffic based on certificate validation without content access - Gateway validates all incoming connections against Organization Gateway Client CA - -## Security Best Practices - -### Gateway Security - -- **One identity per gateway** - Create a unique machine identity for each gateway -- **Minimal permissions** - Assign only the permissions each gateway actually needs -- **Rotate credentials** - Set up regular credential rotation (quarterly recommended) -- **Monitor authentication** - Watch for unusual authentication activity -- **Deploy close to resources** - Place gateways as close as possible to your private resources -- **Use multiple gateways** - Deploy multiple gateways for redundancy and load distribution - -### Relay Security - -- **Deploy close to gateways** - Minimize latency between gateways and relays -- **Use multiple regions** - Deploy relays in multiple regions for redundancy -- **Monitor performance** - Track connection counts and throughput -- **Regular updates** - Keep relay servers updated and patched -- **Network isolation** - Use security groups and network ACLs to restrict access -- **Monitor network traffic** - Watch for unusual patterns - -### Network Security - -- **Gateway outbound only** - Gateways only need outbound connections (port 2222 to relays, port 443 to Infisical API) -- **Relay inbound** - Relays need inbound SSH (2222) and TCP with TLS (8443) -- **No inbound for gateways** - Never open inbound ports for gateways -- **Use security groups** in cloud environments to restrict access -- **Implement network ACLs** to limit traffic to specific IP ranges -- **Monitor network traffic** for unusual patterns -- **Regular security updates** for the relay server - -## Compliance Considerations - -### Data Sovereignty - -- **Customer-deployed relays** - Deploy relays in your preferred geographic region -- **Air-gapped environments** - Use self-hosted relays for completely isolated deployments -- **Custom network policies** - Implement organization-specific security requirements - -### Security Controls - -- **Certificate-based authentication** - No shared secrets, uses SSH certificates -- **End-to-end encryption** - All traffic is encrypted in transit -- **Tenant isolation** - Each organization's traffic is completely isolated -- **No data storage** - Relay servers only route traffic, never store data -- **Automatic reconnection** - Handles network interruptions gracefully - -## Troubleshooting Security Issues - -### Common Security Issues - -**Authentication failures:** - -- Verify machine identity credentials are correct -- Check token expiration and renewal -- Ensure authentication method is properly configured - -**Network security issues:** - -- Verify firewall rules allow required connections -- Check for network ACLs blocking traffic -- Monitor for unusual network patterns - -### Security Monitoring - -**Key metrics to monitor:** - -- Gateway connection status and health -- Authentication success/failure rates -- Network connectivity and latency -- Unusual traffic patterns or access attempts