User security guidelines

These are basic user-level security best practices, that all users of SSC are expected to follow. It is your responsibility as a user of the IaaS services that you understand these recommendations. Contact our support if you have questions.

Username and passwords for instance access is not allowed. All users should use SSH keys.

Recommendations:

  • Generate key-pair using the Horizon cloud interface; or
  • Locally generate the key-pair (4096bit RSA) and import the public key
  • Keep your private key safe.
  • In case of managing passwords and secrets in the VM use Vault (https://www.vaultproject.io/) or similar projects.
  • If you need help, contact at support@cloud.snic.se.

Make use of  “Security Groups” to restrict access to your VMs.

Recommendations:

  • By default all ports should be closed. This is the base state if no rules are defined.
  • Try to restrict port access to smaller network ranges.
  • Avoid the use of common standard ports (80, 8080, or mongoDB ports).
  • Understand the requirements and only open ports for Egress (outgoing) or Ingress (incoming) as appropriate.
  • if you need help, contact at support@cloud.snic.se.

Keep your instances updated

Recommendations:

Virtual Machines:

  • Update distribution packages regularly.
  • Patch your VMs regularly.
  • Avoid libraries, modules and packages that create problems with updates.
  • Distro-sourced software packages may be old/unmaintained, compare with actual project.
  • Use images with currently supported OS versions as much as possible (Ubuntu 18.04 -> Ubuntu 20.04).
  • Avoid long running VMs

Containers:

  • Only use official distributions of the containers.
  • Avoid untrusted third party containers
  • Before starting the container read the container “composed” file.
  • Patch your containers regularly.
  • If possible avoid running privileged containers.  

Network design for different applications in the same tenant

Recommendations:

  • If several distinct projects exist in the same tenant – create distinct private networks and switches to insulate them from each other.
  • Prefer using internal networks for internal instance services, only expose something on the public network if it needs to be accessed from the outside.

Data management

Recommendations:

  • Keep your data separate from you compute units (VM or containers). This way you will not lose the data if the VM gets compromised.
  • If required, it is possible to encrypt the data volumes in SSC. Important: it is not allowed to use SSC for sensitive data.
  • The object storage in SSC allows to create private and public data buckets/containers. Unless required create private data buckets/containers.

Public-facing APIs

Recommendations:

  • Restrict the exposed capabilities of outward-facing databases and APIs.
  • Lock access down not only with security groups but also use non-default API credentials.

Your desktop, laptop or other clients

Recommendations:

  • Use antivirus software with the latest virus definitions.
  • Enable screensaver with password.
  • Use a version of the operating system supported by your vendor.
  • Have the latest security patches installed.
  • Enable automatic security updates.
  • Follow the security recommendations of your organization.