Document secure deployment

[lucasgonze]

Secure Deployment Documentation

Problem

Secure software is secure by default. At deployment time there are a number of configuration choices that influence risk. Deployers lack guidance in what these are.

Solution

There should be documentation for deployers on steps they should take to ensure security.

For example, deployers should ensure that there is a verified boot and the AGW is locked down, and it is wise to have a managed OS.

Security guidance should appear where it is relevant and useful. There can be a centralized document, but the same tips may be available in context relevant to particular features.

Non-goals

It is out of scope to change the underlying software.

[lucasgonze]

Prior art on the Confluence:

• https://docs.magmacore.org/docs/lte/setup_deb#deployment
• https://docs.magmacore.org/docs/orc8r/deploy_faq#deployment-faqs
• https://docs.magmacore.org/docs/lte/configure_agw_ha#deployment

[lucasgonze]

Topic brainstorming:

• physical security
• TPU/ TZ/ TEE
• ACLs/ account role restrictions
• (potentially SOX compliance)
• periodic access review
• signed builds
• Pen test
• review of security bulletins / deployment of patches (esp packages included)

[lucasgonze]

Docusaurus on deployment and configuration (https://docs.magmacore.org/docs/lte/configure_agw_ha) could be used to create a checklist.

Logging is relevant to deployment security. https://docs.magmacore.org/docs/orc8r/debug_logs

[ShubhamTatvamasi]

When I was testing a deployment of Orc8r on AWS, I discovered few sets of ports that we have to open in security group for the deployment. Maybe we can use this info in our security docs.
https://github.com/ShubhamTatvamasi/magma-galaxy/blob/master/docs/aws.md

[lucasgonze]

Two important developments in the life of this ticket:

1. Got support in TSC meeting to add this project to the roadmap. The "proposal" phase of work is over.
2. Future work should use the confidential ticket in the security repo because there will likely be secrets found along the way

If/when I come back to this ticket it will be to declare victory.

[lucasgonze]

Work on this task is now in https://github.com/magma/security/issues/104.