Skip to content

Commit c1d6208

Browse files
shainaraskaseedugon
shainaraskas
and
eedugon
authored
Fix security top-level overviews (#902)
made the security overview page much shorter pages to review: * [security overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/902/deploy-manage/security) * [self-managed cluster security overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/902/deploy-manage/security/secure-your-cluster-deployment) * [encryption overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/902/deploy-manage/security/data-security) and some small style polish things todo: * explain when to use [self-managed config](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/security/manually-configure-security-in-self-managed-cluster) instructions * clarify [cipher suites](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/security/enabling-cipher-suites-for-stronger-encryption) (I suspect these are only applicable to self-managed and maybe eck, and then they just work out of the box for other deployment methods) * [secure settings generic/eck split](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/security/secure-settings) * [the ECE security overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation) * [private link traffic filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/security/private-link-traffic-filters) * clarify [secure http communications](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/security/secure-http-communications) --------- Co-authored-by: Edu González de la Herrán <[email protected]>
1 parent c7cc2d4 commit c1d6208

18 files changed

+246
-347
lines changed

‎deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ Currently you can’t use SSO to login directly from {{ecloud}} into Kibana endp
119119

120120
Kibana does not currently support restoring a snapshot of their indices across Elastic Cloud deployments.
121121

122-
* [Kibana uses encryption keys](/deploy-manage/security/secure-your-cluster-deployment.md#security-configure-settings) in various places, ranging from encrypting data in some areas of reporting, alerts, actions, connector tokens, ingest outputs used in Fleet and Synthetics monitoring to user sessions.
122+
* [Kibana uses encryption keys](/deploy-manage/security/secure-your-cluster-deployment.md) in various places, ranging from encrypting data in some areas of reporting, alerts, actions, connector tokens, ingest outputs used in Fleet and Synthetics monitoring to user sessions.
123123
* Currently, there is not a way to retrieve the values of Kibana encryption keys, or set them in the target deployment before restoring a snapshot. As a result, once a snapshot is restored, Kibana will not be able to decrypt the data required for some features to function properly in the target deployment.
124124
* If you have already restored a snapshot across deployments and now have broken Kibana saved objects in the target deployment, you will have to recreate all broken configurations and objects, or create a new setup in the target deployment instead of using snapshot restore.
125125

‎deploy-manage/security.md‎

Lines changed: 48 additions & 242 deletions
Large diffs are not rendered by default.

‎deploy-manage/security/_snippets/audit-logging.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Audit logging is a powerful feature that helps you monitor and track security-related events within the {{stack}}. By enabling audit logs, you can gain visibility into authentication attempts, authorization decisions, and other system activity.
2+
3+
Audit logging also provides forensic evidence in the event of an attack, and can be enabled independently for {{es}} and {{kib}}.
4+
5+
[Learn how to enable audit logging](/deploy-manage/security/logging-configuration/security-event-audit-logging.md).

‎deploy-manage/security/_snippets/cluster-communication-network.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
* [Manage TLS certificates](/deploy-manage/security/secure-cluster-communications.md): TLS certificates apply security controls to network communications. Elastic uses TLS certificates to secure communications in two places:
2+
* **The HTTP layer**: Used for communication between your cluster or deployment and the internet.
3+
* **The transport layer**: Used mainly for inter-node communications, and in certain cases for cluster to cluster communication.
4+
* In self-managed {{es}} clusters, you can also [Configure Kibana and Elasticsearch to use mutual TLS](/deploy-manage/security/secure-http-communications.md#elasticsearch-mutual-tls).
5+
* [Enable cipher suites for stronger encryption](/deploy-manage/security/enabling-cipher-suites-for-stronger-encryption.md): The TLS and SSL protocols use a cipher suite that determines the strength of encryption used to protect the data. You may want to enable the use of additional cipher suites, so you can use different cipher suites for your TLS communications or communications with authentication providers.
6+
* [Restrict connections using traffic filtering](/deploy-manage/security/traffic-filtering.md): Traffic filtering allows you to limit how your deployments can be accessed. Add another layer of security to your installation and deployments by restricting inbound traffic to only the sources that you trust. Restrict access based on IP addresses or CIDR ranges, or secure connectivity through AWS PrivateLink, Azure Private Link, or GCP Private Service Connect.
7+
* [Allow or deny {{ech}} IP ranges](/deploy-manage/security/elastic-cloud-static-ips.md): {{ecloud}} publishes a list of IP addresses used by its {{ech}} services for both incoming and outgoing traffic. Users can use these lists to configure their network firewalls as needed to allow or restrict traffic related to {{ech}} services.

‎deploy-manage/security/_snippets/cluster-comparison.md‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
Security feature availability varies by deployment type, with each feature having one of the following statuses:
2+
3+
| Status | Description |
4+
|--------|-------------|
5+
| **Managed** | Handled automatically by Elastic with no user configuration needed |
6+
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
7+
| **Self-managed** | Infrastructure-level security you implement and maintain |
8+
| **N/A** | Not available for this deployment type |
9+
10+
Select your deployment type below to see what's available and how implementation responsibilities are distributed:
11+
12+
::::{tab-set}
13+
:group: deployment-type
14+
15+
:::{tab-item} {{ech}}
16+
:sync: cloud-hosted
17+
18+
| Category | Security feature | Status | Description |
19+
|------------------|------------|--------------|-------------|
20+
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
21+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
22+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
23+
| | Private link | Configurable | Establish secure VPC connection |
24+
| | Static IPs | Configurable | Enable fixed IP addresses |
25+
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
26+
| | Bring your own encryption key | Configurable | Implement customer-provided keys |
27+
| | Keystore security | Managed | Automatically protected by Elastic |
28+
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
29+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
30+
31+
:::
32+
33+
:::{tab-item} {{serverless-full}}
34+
:sync: serverless
35+
36+
| Category| Security feature | Status | Description |
37+
|------------------|------------|--------------|-------------|
38+
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
39+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
40+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
41+
| | Private link | N/A | X |
42+
| | Static IPs | Configurable | Enable fixed IP addresses |
43+
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
44+
| | Bring your own encryption key | N/A | X |
45+
| | Keystore security | Managed | Automatically protected by Elastic |
46+
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
47+
| **User Session** | Kibana Sessions | Managed | Automatically configured by Elastic |
48+
49+
:::
50+
51+
:::{tab-item} ECE/ECK
52+
:sync: ece-eck
53+
54+
| Category| Security feature | Status | Description |
55+
|------------------|------------|--------------|-------------|
56+
| **Communication** | TLS (HTTP Layer) | Configurable | Configure custom certificates |
57+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
58+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
59+
| | Private link | N/A | X |
60+
| | Static IPs | N/A | X |
61+
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
62+
| | Bring your own encryption key | N/A | X |
63+
| | Keystore security | Configurable | Configure secure settings storage |
64+
| | Saved object encryption | Configurable | Enable encryption for saved objects |
65+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
66+
67+
:::
68+
69+
:::{tab-item} Self-managed
70+
:sync: self-managed
71+
72+
| Category| Security feature | Status | Description |
73+
|------------------|------------|--------------|-------------|
74+
| **Communication** | TLS (HTTP Layer) | Self-managed | Implement and maintain certificates |
75+
| | TLS (Transport Layer) | Self-managed | Implement and maintain certificates |
76+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
77+
| | Private link | N/A | X |
78+
| | Static IPs | N/A | X |
79+
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
80+
| | Bring your own encryption key | N/A | X |
81+
| | Keystore security | Configurable | Configure secure settings storage |
82+
| | Saved object encryption | Configurable | Enable encryption for saved objects |
83+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
84+
85+
:::
86+
::::

‎deploy-manage/security/_snippets/cluster-data.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
* [Secure your settings](/deploy-manage/security/secure-settings.md): Some of the settings that you configure in Elastic are sensitive, such as passwords, and relying on file system permissions to protect these settings is insufficient. Learn how to configure secure settings in the {{es}} keystore or {{kib}} keystore.
2+
* [Secure saved objects](/deploy-manage/security/secure-saved-objects.md): {{kib}} stores entities such as dashboards, visualizations, alerts, actions, and advanced settings as saved objects, which are kept in a dedicated, internal {{es}} index. If such an object includes sensitive information, for example a PagerDuty integration key or email server credentials used by the alert action, {{kib}} encrypts it and makes sure it cannot be accidentally leaked or tampered with. You can configure and rotate the saved object encryption key for additional security.
3+
* [Encrypt data at rest](/deploy-manage/security/data-security.md): By default, {{ecloud}} already encrypts your {{ech}} deployment data, Serverless project data, and snapshots at rest. If you’re using ECH, then you can reinforce this mechanism by providing your own encryption key, also known as [Bring Your Own Key (BYOK)](/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md).
4+
5+
::::{note}
6+
Other deployment types don’t implement encryption at rest out of the box. For self-managed clusters, to implement encryption at rest, the hosts running the cluster must be configured with disk-level encryption, such as `dm-crypt`. In addition, snapshot targets must ensure that data is encrypted at rest as well.
7+
8+
Configuring `dm-crypt` or similar technologies is outside the scope of this documentation, and issues related to disk encryption are outside the scope of support.
9+
::::

‎deploy-manage/security/_snippets/cluster-user-session.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[Manage {{kib}} sessions](/deploy-manage/security/kibana-session-management.md) to control the timeout and lifespan of logged-in sessions to {{kib}}, as well as the number of concurrent sessions each user can have.

‎deploy-manage/security/_snippets/complete-security.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
::::{note}
2+
As part of your overall security strategy, you can also do the following:
3+
4+
* Prevent unauthorized access with [password protection and role-based access control](/deploy-manage/users-roles.md).
5+
* Control access to dashboards and other saved objects in your UI using [Spaces](/deploy-manage/manage-spaces.md).
6+
* Connect a local cluster to a [remote cluster](/deploy-manage/remote-clusters.md) to enable [cross-cluster replication](/deploy-manage/tools/cross-cluster-replication.md) and [cross-cluster search](/solutions/search/cross-cluster-search.md).
7+
* Manage [API keys](/deploy-manage/api-keys.md) used for programmatic access to Elastic.
8+
::::

‎deploy-manage/security/data-security.md‎

Lines changed: 9 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,38 +2,28 @@
22
applies_to:
33
deployment:
44
ess: ga
5-
ece: ga
6-
eck: ga
7-
self: ga
85
serverless: ga
96
---
107

118
# Encrypt your deployment data
129

13-
(orphan now, we should put this content somewhere)
10+
{{ech}} deployments and {{serverless-full}} projects are already encrypted at rest by default. This includes their data, objects, and settings.
1411

15-
Add another layer of security by defining custom encryption rules for your cluster's data, {{kib}} saved objects, and settings.
12+
For {{serverless-full}} projects, security is fully-managed by Elastic.
1613

17-
**In {{ecloud}}**:
14+
For {{ech}} deployments, instead of the default, Elastic-managed encryption, you can choose to use a [customer-managed encryption key](encrypt-deployment-with-customer-managed-encryption-key.md) to encrypt your {{ech}} deployments.
1815

19-
{{ech}} deployments and serverless projects are already encrypted at rest by default. This includes their data, objects, and settings. For serverless projects, security is fully-managed by Elastic. For {{ech}} deployments, some settings are available for you to customize the default security measures in place:
20-
21-
- Instead of the default, Elastic-managed encryption, you can choose to use a [customer-managed encryption key](encrypt-deployment-with-customer-managed-encryption-key.md) from one of our supported providers' KMS to encrypt your {{ech}} deployments.
22-
- Store sensitive settings using the [{{es}} keystore](secure-settings.md).
23-
24-
**In {{ece}}, {{eck}} and self-managed installations**:
25-
26-
There is no encryption at rest out of the box for deployments orchestrated using [{{ece}}](secure-your-elastic-cloud-enterprise-installation.md) and [{{eck}}](secure-your-eck-installation.md), and for [self-managed clusters](manually-configure-security-in-self-managed-cluster.md). You must instead configure disk-level encryption on your hosts.
2716

2817
:::{note}
18+
There is no encryption at rest out of the box for deployments orchestrated using [{{ece}}](secure-your-elastic-cloud-enterprise-installation.md) and [{{eck}}](secure-your-eck-installation.md), or for [self-managed clusters](manually-configure-security-in-self-managed-cluster.md). You must instead configure disk-level encryption on your hosts.
19+
2920
Configuring dm-crypt or similar technologies is outside the scope of the Elastic documentation, and issues related to disk encryption are outside the scope of support.
3021
:::
3122

32-
However, some native features are available for you to protect sensitive data and objects:
23+
24+
:::{tip}
25+
As an alternative to or in addition to encryption at rest, you can also use the following features to encrypt sensitive data and objects:
3326

3427
- Store sensitive settings using the [{{es}} or {{kib}} keystores](secure-settings.md).
3528
- Enable [encryption for {{kib}} saved objects](secure-saved-objects.md).
36-
- Customize [{{kib}} session parameters](kibana-session-management.md).
37-
38-
39-
29+
:::

‎deploy-manage/security/elastic-cloud-static-ips.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@ mapped_pages:
88

99
# {{ecloud}} Static IPs [ec-static-ips]
1010

11-
{{ecloud}} provides a range of static IP addresses that enable you to allow or deny IP ranges. There are two types of static IP addresses, [ingress](#ec-ingress) and [egress](#ec-egress), and they each have their own set of use cases. In general, static IPs can be used to introduce network controls (for example, firewall rules) for traffic that goes to and from {{ecloud}} deployments over the Internet. Use of static IPs is not applicable to private cloud service provider connections (for example, AWS/Azure PrivateLink, GCP Private Service Connect). It is important to note that static IP addresses are [subject to change](#ec-warning), and not all [cloud provider regions](#ec-regions) are currently fully supported for ingress and egress static IPs.
11+
{{ecloud}} provides a range of static IP addresses that enable you to allow or deny IP ranges. There are two types of static IP addresses, [ingress](#ec-ingress) and [egress](#ec-egress), and they each have their own set of use cases. In general, static IPs can be used to introduce network controls (for example, firewall rules) for traffic that goes to and from {{ecloud}} deployments over the Internet. Use of static IPs is not applicable to private cloud service provider connections (for example, AWS/Azure PrivateLink, GCP Private Service Connect).
1212

13+
Static IP addresses are [subject to change](#ec-warning), and not all [cloud provider regions](#ec-regions) are currently fully supported for ingress and egress static IPs. For this reason, we generally do not recommend that you use firewall rules to allow or restrict certain IP ranges. Consider using [private link](/deploy-manage/security/private-link-traffic-filters.md) traffic filters for deployment endpoints on {{ech}}. However, in situations where using Private Link services do not meet requirements (for example, secure traffic **from** {{ecloud}}), static IP ranges can be used.
1314

14-
## Ingress Static IPs: Traffic To {{ecloud}} [ec-ingress]
15+
16+
## Ingress Static IPs: Traffic to {{ecloud}} [ec-ingress]
1517

1618
Suitable usage of ingress static IPs to introduce network controls:
1719

@@ -118,7 +120,7 @@ Not suitable usage of egress static IPs to introduce network controls:
118120
::::{warning}
119121
:name: ec-warning
120122

121-
Static IP ranges are subject to change. You will need to update your firewall rules when they change to prevent service disruptions. We will announce changes at least 8 weeks in advance (see [example](https://status.elastic.co/incidents/1xs411x77wgh)). Please subscribe to the [{{ecloud}} Status Page](https://status.elastic.co/) to remain up to date with any changes to the Static IP ranges which you will need to update at your side.
123+
Static IP ranges are subject to change. You will need to update your firewall rules when they change to prevent service disruptions. We will announce changes at least 8 weeks in advance (see [example](https://status.elastic.co/incidents/1xs411x77wgh)). Please subscribe to the [{{ecloud}} status page](https://status.elastic.co/) to remain up to date with any changes to the Static IP ranges which you will need to update at your side.
122124
::::
123125

124126

0 commit comments

Comments
 (0)