Security

Security best practices and configuration.

Authentication Security

Password Requirements

• Minimum 12 characters
• Mix of uppercase, lowercase, numbers, symbols
• No common passwords

Two-Factor Authentication

Enable 2FA for all users:

auth:
  require_2fa: true
  totp:
    issuer: "Ops Atlas"

Network Security

HTTPS Only

Always use HTTPS in production:

server:
  force_https: true
  hsts:
    enabled: true
    max_age: 31536000

Firewall Rules

Only expose necessary ports:

# Allow only HTTPS
ufw allow 443/tcp
ufw allow 22/tcp  # SSH
ufw deny 3000/tcp # Block direct access

Data Security

Encryption at Rest

Database encryption:

database:
  encryption:
    enabled: true
    key: ${ENCRYPTION_KEY}

Secrets Management

Never store secrets in:

• Code repositories
• Docker images
• Log files

Use:

• Environment variables
• Secret managers (Vault, AWS Secrets Manager)
• Kubernetes secrets

Audit Logging

Enable audit logs:

audit:
  enabled: true
  log_level: info
  events:
    - login
    - logout
    - deployment
    - config_change

Security Headers

Default security headers:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'

Vulnerability Scanning

Regularly scan for vulnerabilities:

# Scan Docker image
trivy image opsatlas/ops-atlas:latest

# Scan dependencies
npm audit
mvn dependency-check:check

Incident Response

If you discover a security vulnerability:

1. Do not disclose publicly
2. Email security@opsatlas.io
3. We'll respond within 48 hours
4. Coordinated disclosure after fix