Skip to content

[D&M] Improve deploy-manage/security landing page #721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 11, 2025
Merged

[D&M] Improve deploy-manage/security landing page #721

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8bf5747
[D&M] Improve deploy-manage/security landing page
leemthompo Mar 10, 2025
428c7e1
Clarify next step sentence
leemthompo Mar 10, 2025
7042967
remove inline feature lists from overview
leemthompo Mar 11, 2025
33ae96a
Merge branch 'main' into dm-security
leemthompo Mar 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
178 changes: 119 additions & 59 deletions deploy-manage/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,102 +75,162 @@ $$$maintaining-audit-trail$$$

# Security

This section covers how to secure your Elastic environment. Learn how to implement TLS encryption, network security controls, and data protection measures.
This overview page helps you understand Elastic's security capabilities across different deployment types. You'll find:

- Key security features for protecting your Elastic deployment
- Security capabilities specific to each deployment type
- Comparison tables showing feature availability and configurability by deployment type
- Links to detailed implementation guides

## Security overview

An Elastic implementation comprises many moving parts: {es} nodes forming the cluster, {kib} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
An Elastic implementation comprises many moving parts: {{es}} nodes forming the cluster, {{kib}} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.

To keep your data secured, Elastic offers comprehensive security features that:
- Prevent unauthorized access to your deployment
- Encrypt communications between components
- Protect data at rest
- Secure sensitive settings and saved objects

Security requirements and capabilities vary by deployment. Features may be managed automatically by Elastic, require configuration, or must be fully self-managed. Refer to [Security by deployment type](#security-by-deployment-type) for details.
:::{note}
The availability and configurability of security features vary by deployment type. Refer to [Security by deployment type](#security-features-by-deployment-type) for a comparison table.
:::

::::{tip}
See the [Deployment overview](/deploy-manage/deploy.md) to understand your options for deploying Elastic.
::::
## Security topics

### Security by deployment type
The documentation is organized into four main areas.

Security features have one of these statuses across deployment types:
:::{note}
Throughout the documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
:::

| Status | Description |
|--------|-------------|
| **Managed** | Handled automatically by Elastic with no user configuration needed |
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
| **Self-managed** | Infrastructure-level security you implement and maintain |
| **N/A** | Not available for this deployment type |
### 1. Secure your hosting environment

The [security of your hosting environment](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:

#### Communication security
- [**Elastic Cloud Hosted and Serverless**](security/secure-your-elastic-cloud-organization.md)
- [**Elastic Cloud Enterprise**](security/secure-your-elastic-cloud-enterprise-installation.md)
- [**Elastic Cloud on Kubernetes**](security/secure-your-eck-installation.md)
- [**Self-managed environments**](security/manually-configure-security-in-self-managed-cluster.md)

| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
|------------------|------------|--------------|-----|-----|--------------|
| **TLS (HTTP Layer)** | Managed | Managed | Configurable | Configurable | Self-managed |
| **TLS (Transport Layer)** | Managed | Managed | Managed | Managed | Self-managed |
### 2. Secure your deployments and clusters

#### Network security
[Secure your deployments](security/secure-your-cluster-deployment.md) with features available across all deployment types:

| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
|------------------|------------|--------------|-----|-----|--------------|
| **IP traffic filtering** | Configurable | Configurable | Configurable | Configurable | Configurable |
| **Private link** | N/A | Configurable | N/A | N/A | N/A |
| **Static IPs** | Configurable | Configurable | N/A | N/A | N/A |
- [**Traffic filtering**](security/traffic-filtering.md): IP filtering, private links, and static IPs
- [**Secure communications**](security/secure-cluster-communications.md): TLS configuration, certificates management
- [**Data protection**](security/data-security.md): Encryption at rest, secure settings, saved objects
- [**Session management**](security/kibana-session-management.md): Kibana session controls
- [**FIPS 140-2 compliance**](security/fips-140-2.md): Federal security standards

#### Data security
### 3. Secure your personal account

| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
|------------------|------------|--------------|-----|-----|--------------|
| **Encryption at rest** | Managed | Managed | Self-managed | Self-managed | Self-managed |
| **Bring your own encryption key** | N/A | Configurable | N/A | N/A | N/A |
| **Keystore security** | Managed | Managed | Configurable | Configurable | Configurable |
| **Saved object encryption** | Managed | Managed | Configurable | Configurable | Configurable |
[Secure your personal account](security/secure-your-personal-account.md) to help prevent unauthorized access:

#### User session security
- Multi-factor authentication and account security best practices

| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
|------------------|------------|--------------|-----|-----|--------------|
| **Kibana Sessions** | Managed | Configurable | Configurable | Configurable | Configurable |
### 4. Secure your clients and integrations

### Using this documentation
[Secure your clients and integrations](security/secure-clients-integrations.md) to ensure secure communication between your applications and Elastic:

Throughout this security documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Each section clearly identifies which deployment types it applies to, and deployment-specific details are separated within each topic.
- [**Client security**](security/httprest-clients-security.md): Best practices for securely connecting applications to {{es}}
- **Integration security**: Secure configuration for Beats, Logstash, and other integrations

To get the most relevant information for your environment, focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
## Security features by deployment type

## Security topics
Security feature availability varies by deployment type, with each feature having one of the following statuses:

This security documentation is organized into four main areas:
| **Status** | **Description** |
|--------|-------------|
| **Managed** | Handled automatically by Elastic with no user configuration needed |
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
| **Self-managed** | Infrastructure-level security you implement and maintain |
| **N/A** | Not available for this deployment type |

% TODO: Add links to the sections below
Select your deployment type below to see what's available and how implementation responsibilities are distributed:

### 1. Secure your hosting environment
::::{tab-set}
:group: deployment-type

The security of your hosting environment forms the foundation of your overall security posture. This section covers environment-specific security controls:
:::{tab-item} Elastic Cloud Hosted
:sync: cloud-hosted

- **Elastic Cloud Hosted and Serverless**: Organization-level SSO, role-based access control, and cloud API keys
- **Elastic Cloud Enterprise**: TLS certificates, role-based access control, and cloud API keys
- **Self-managed environments**: TLS certificates, HTTPS configuration
| **Security Category** | **Security Feature** | **Status** | **Description** |
|------------------|------------|--------------|-------------|
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
| | Private link | Configurable | Establish secure VPC connection |
| | Static IPs | Configurable | Enable fixed IP addresses |
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
| | Bring your own encryption key | Configurable | Implement customer-provided keys |
| | Keystore security | Managed | Automatically protected by Elastic |
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |

### 2. Secure your deployments and clusters
:::

Protect your deployments with features available across all deployment types:
:::{tab-item} Serverless
:sync: serverless

| **Security Category** | **Security Feature** | **Status** | **Description** |
|------------------|------------|--------------|-------------|
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
| | Private link | N/A | X |
| | Static IPs | Configurable | Enable fixed IP addresses |
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
| | Bring your own encryption key | N/A | X |
| | Keystore security | Managed | Automatically protected by Elastic |
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
| **User Session** | Kibana Sessions | Managed | Automatically configured by Elastic |

- **Authentication and access controls**: User management, API keys, authentication protocols, and traffic filtering
- **Data protection**: Encryption, sensitive settings, and document-level security
- **Monitoring and compliance**: Audit logging and security best practices
:::

### 3. Secure your user accounts
:::{tab-item} ECE/ECK
:sync: ece-eck

| **Security Category** | **Security Feature** | **Status** | **Description** |
|------------------|------------|--------------|-------------|
| **Communication** | TLS (HTTP Layer) | Configurable | Configure custom certificates |
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
| | Private link | N/A | X |
| | Static IPs | N/A | X |
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
| | Bring your own encryption key | N/A | X |
| | Keystore security | Configurable | Configure secure settings storage |
| | Saved object encryption | Configurable | Enable encryption for saved objects |
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |

Individual user security helps prevent unauthorized access:
:::

- **Multi-factor authentication**: Add an extra layer of security to your login process
:::{tab-item} Self-managed
:sync: self-managed

| **Security Category** | **Security Feature** | **Status** | **Description** |
|------------------|------------|--------------|-------------|
| **Communication** | TLS (HTTP Layer) | Self-managed | Implement and maintain certificates |
| | TLS (Transport Layer) | Self-managed | Implement and maintain certificates |
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
| | Private link | N/A | X |
| | Static IPs | N/A | X |
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
| | Bring your own encryption key | N/A | X |
| | Keystore security | Configurable | Configure secure settings storage |
| | Saved object encryption | Configurable | Enable encryption for saved objects |
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |

### 4. Secure your clients and integrations
:::

Ensure secure communication between your applications and Elastic:
::::

- **Client security**: Best practices for securely connecting applications to {es}
- **Integration security**: Secure configuration for Beats, Logstash, and other integrations
## Next steps

Refer to the following sections for detailed instructions about securing your hosting environment:

* [Elastic Cloud Hosted and Serverless security setup](/deploy-manage/security/secure-your-elastic-cloud-organization.md)
* [Elastic Cloud Enterprise (ECE) security setup](/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation.md)
* [Elastic Cloud on Kubernetes (ECK) security setup](/deploy-manage/security/secure-your-eck-installation.md)
* [Self-managed cluster security setup](/deploy-manage/security/manually-configure-security-in-self-managed-cluster.md)