docs: Security model #6031
Open
docs: Security model #6031
+146
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Dan-Heath
requested review from
tmessi,
johanbrandhorst,
louisruch and
mcollao-hc
|
|
||
| - **Eavesdropping on any Boundary communication**. | ||
| All communication between clients, controllers, and workers is protected by TLS or mutually authenticated TLS, ensuring confidentiality and integrity. | ||
| - **Tamerping with data at rest or in transit**. |
There was a problem hiding this comment.
Suggested change
| - **Tamerping with data at rest or in transit**. | |
| - **Tampering with data at rest or in transit**. |
Comment on lines
+55
to
+56
| - Boundary Client Agent specifics: | ||
| - The Client Agent stores session credentials and related information in memory and in the user's OS-dependent keyring. |
There was a problem hiding this comment.
The client agent doesn't use the keyring, but the CLI does. The client agent only stores credentials in-memory, they are never persisted to anything.
| - Brokered credentials may be returned to the user's device and displayed in plain text. | ||
| - Boundary Client Agent specifics: | ||
| - The Client Agent stores session credentials and related information in memory and in the user's OS-dependent keyring. | ||
| Boundary persists auth tokens to platform-specific keyring storage. |
There was a problem hiding this comment.
Suggested change
| Boundary persists auth tokens to platform-specific keyring storage. | |
| Boundary CLI persists auth tokens to platform-specific keyring storage. |
| - The Client Agent stores session credentials and related information in memory and in the user's OS-dependent keyring. | ||
| Boundary persists auth tokens to platform-specific keyring storage. | ||
| If an attacker can read the memory of the Client Agent process or has compromised the OS user account under which the Client Agent is running and authenticated, they may be able to access these active session credentials. | ||
| - The Client Agent's security relies on the OS user context; an OS user can only connect to sessions managed by the Client Agent if they are the same OS user that authenticated the agent. |
There was a problem hiding this comment.
Suggested change
| - The Client Agent's security relies on the OS user context; an OS user can only connect to sessions managed by the Client Agent if they are the same OS user that authenticated the agent. | |
| - The Client Agent's security relies on the OS user context; an OS user can only connect to sessions managed by the Client Agent if they are the same OS user that initiated the DNS lookup that created the session. |
There was a problem hiding this comment.
Technically, on MacOS, we use the most recently authenticated user, since we can't tell who is making the DNS request. We may want to differentiate between Windows and MacOS here to be explicit.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds security model documentation to the Boundary docs to better explain what is and isn't considered part of the threat model. This information is documented for other HashiCorp products in a similar format.
This update also combines the HCP Boundary security model document with the more general Boundary information. Once this is published, we would remove the standalone HCP version.
View the preview deployment
PCI review checklist
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.