Cloud Security

[jon-athan-hall]

I moved the checklist for Cloud Security from #100 over to this ticket. We'll have to revisit when the time comes. Unless Heroku is sort of our cloud?

• Ensure all services have minimum ports open. While security through obscurity is no protection, using non-standard ports will make it a little bit harder for attackers.

• Host backend database and services on private VPCs that are not visible on any public network. Be very careful when configuring AWS security groups and peering VPCs which can inadvertently make services visible to the public.

• Isolate logical services in separate VPCs and peer VPCs to provide inter-service communication.

• Ensure all services only accept data from a minimal set of IP addresses.

• Restrict outgoing IP and port traffic to minimize APTs and “botification”.

• Always use AWS IAM roles and not root credentials.

• Use minimal access privilege for all ops and developer staff.

• Regularly rotate passwords and access keys according to a schedule.

[johnhutch]

At the moment, heroku is all we have, and it's not exactly a cloud service. However, carrier wave will be using amazon s3, which IS cloud, so I'll be sure to revisit this as I work on #83