@cryptotaxi247 / netdata-1 / commits / 85bc75167

delete docs/netdata-security.md and replace links to proper points (#17094)

Fotis Voutsas committed Mar 4, 2024 at 13:33 UTC 85bc75167eb86841d26515d317725a3b54835dbb

10 files changed +19 -449

docs/category-overview-pages/deployment-strategies.md

+1 -1

@@ -237,7 +237,7 @@ On both Netdata Parent and all Child Agents, edit `stream.conf` with `/etc/netda

237

238 We strongly recommend the following configuration changes for production deployments:

239

240 -1. Understand Netdata's [security and privacy design](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md) and

240 +1. Understand Netdata's [security and privacy design](https://github.com/netdata/netdata/blob/master/docs/security-and-privacy-design/README.md) and

241 [secure your nodes](https://github.com/netdata/netdata/blob/master/docs/category-overview-pages/secure-nodes.md)

242

243 To safeguard your infrastructure and comply with your organization's security policies.

docs/configure/common-changes.md

+1 -1

@@ -131,7 +131,7 @@ click on the link to your preferred notification method to find documentation fo

131 While the Netdata Agent is both [open and secure by design](https://www.netdata.cloud/blog/netdata-agent-dashboard/), we

132 recommend every user take some action to administer and secure their nodes.

133

134 -Learn more about the available options in the [security design documentation](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md).

134 +Learn more about the available options in the [security design documentation](https://github.com/netdata/netdata/blob/master/docs/security-and-privacy-design/README.md).

135

136 ## Reduce resource usage

137

docs/guides/using-host-labels.md

+1 -1

@@ -141,7 +141,7 @@ child system. It's a vastly simplified way of accessing critical information abo

141 > kernel and operating system versions, you should secure streaming connections with SSL. See the [streaming

142 > documentation](https://github.com/netdata/netdata/blob/master/src/streaming/README.md#securing-streaming-communications) for details. You may also want to use

143 > [access lists](https://github.com/netdata/netdata/blob/master/src/web/server/README.md#access-lists) or [expose the API only to LAN/localhost

144 -> connections](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md#expose-netdata-only-in-a-private-lan).

144 +> connections](https://github.com/netdata/netdata/blob/master/docs/category-overview-pages/secure-nodes.md#expose-netdata-only-in-a-private-lan).

145

146 You can also use `_is_parent`, `_is_child`, and any other host labels in both health entities and metrics

147 exporting. Speaking of which...

docs/metrics-storage-management/enable-streaming.md

+1 -1

@@ -80,7 +80,7 @@ protect them from the internet by making their UI accessible only via an nginx p

80 for the parent and even each child, if necessary.

82 Both children and the parent are connected to the cloud, to enable infrastructure observability,

83 -[without transferring the collected data](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md).

83 +[without transferring the collected data](https://github.com/netdata/netdata/blob/master/docs/security-and-privacy-design/README.md).

84 Requests for data are always serverd by a connected Netdata agent. When both a child and a parent are connected,

85 the cloud will always select the parent to query the user requested data.

docs/netdata-security.md deleted

-429

@@ -1,429 +0,0 @@

1 -# Security and privacy design

2 -

3 -This document serves as the relevant Annex to the [Terms of Service](https://www.netdata.cloud/service-terms/),

4 -the [Privacy Policy](https://www.netdata.cloud/privacy/) and

5 -the Data Processing Addendum, when applicable. It provides more information regarding Netdata’s technical and

6 -organizational security and privacy measures.

7 -

8 -We have given special attention to all aspects of Netdata, ensuring that everything throughout its operation is as

9 -secure as possible. Netdata has been designed with security in mind.

10 -

11 -## Netdata's Security Principles

12 -

13 -### Security by Design

14 -

15 -Netdata, an open-source software widely installed across the globe, prioritizes security by design, showcasing our

16 -commitment to safeguarding user data. The entire structure and internal architecture of the software is built to ensure

17 -maximum security. We aim to provide a secure environment from the ground up, rather than as an afterthought.

18 -

19 -### Compliance with Open Source Security Foundation Best Practices

20 -

21 -Netdata is committed to adhering to the best practices laid out by the Open Source Security Foundation (OSSF).

22 -Currently, the Netdata Agent follows the OSSF best practices at the passing level. Feel free to audit our approach to

23 -the [OSSF guidelines](https://bestpractices.coreinfrastructure.org/en/projects/2231)

24 -

25 -Netdata Cloud boasts of comprehensive end-to-end automated testing, encompassing the UI, back-end, and agents, where

26 -involved. In addition, the Netdata Agent uses an array of third-party services for static code analysis, static code

27 -security analysis, and CI/CD integrations to ensure code quality on a per pull request basis. Tools like Github's

28 -CodeQL, Github's Dependabot, our own unit tests, various types of linters,

29 -and [Coverity](https://scan.coverity.com/projects/netdata-netdata?tab=overview) are utilized to this end.

30 -

31 -Moreover, each PR requires two code reviews from our senior engineers before being merged. We also maintain two

32 -high-performance environments (a production-like kubernetes cluster and a highly demanding stress lab) for

33 -stress-testing our entire solution. This robust pipeline ensures the delivery of high-quality software consistently.

34 -

35 -### Regular Third-Party Testing and Isolation

36 -

37 -While Netdata doesn't have a dedicated internal security team, the open-source Netdata Agent undergoes regular testing

38 -by third parties. Any security reports received are addressed immediately. In contrast, Netdata Cloud operates in a

39 -fully automated and isolated environment with Infrastructure as Code (IaC), ensuring no direct access to production

40 -applications. Monitoring and reporting is also fully automated.

41 -

42 -### Security Vulnerability Response

43 -

44 -Netdata has a transparent and structured process for handling security vulnerabilities. We appreciate and value the

45 -contributions of security researchers and users who report vulnerabilities to us. All reports are thoroughly

46 -investigated, and any identified vulnerabilities trigger a Security Release Process.

47 -

48 -We aim to fully disclose any bugs as soon as a user mitigation is available, typically within a week of the report. In

49 -case of security fixes, we promptly release a new version of the software. Users can subscribe to our releases on GitHub

50 -to stay updated about all security incidents. More details about our vulnerability response process can be

51 -found [here](https://github.com/netdata/netdata/security/policy).

52 -

53 -### Adherence to Open Source Security Foundation Best Practices

54 -

55 -In line with our commitment to security, we uphold the best practices as outlined by the Open Source Security

56 -Foundation. This commitment reflects in every aspect of our operations, from the design phase to the release process,

57 -ensuring the delivery of a secure and reliable product to our users. For more information

58 -check [here](https://bestpractices.coreinfrastructure.org/en/projects/2231).

59 -

60 -## Netdata Agent Security

61 -

62 -### Security by Design

63 -

64 -Netdata Agent is designed with a security-first approach. Its structure ensures data safety by only exposing chart

65 -metadata and metric values, not the raw data collected. This design principle allows Netdata to be used in environments

66 -requiring the highest level of data isolation, such as PCI Level 1. Even though Netdata plugins connect to a user's

67 -database server or read application log files to collect raw data, only the processed metrics are stored in Netdata

68 -databases, sent to upstream Netdata servers, or archived to external time-series databases.

69 -

70 -### User Data Protection

71 -

72 -The Netdata Agent is programmed to safeguard user data. When collecting data, the raw data does not leave the host. All

73 -plugins, even those running with escalated capabilities or privileges, perform a hard-coded data collection job. They do

74 -not accept commands from Netdata, and the original application data collected do not leave the process they are

75 -collected in, are not saved, and are not transferred to the Netdata daemon. For the “Functions” feature, the data

76 -collection plugins offer Functions, and the user interface merely calls them back as defined by the data collector. The

77 -Netdata Agent main process does not require any escalated capabilities or privileges from the operating system, and

78 -neither do most of the data collecting plugins.

79 -

80 -### Communication and Data Encryption

81 -

82 -Data collection plugins communicate with the main Netdata process via ephemeral, in-memory, pipes that are inaccessible

83 -to any other process.

84 -

85 -Streaming of metrics between Netdata agents requires an API key and can also be encrypted with TLS if the user

86 -configures it.

87 -

88 -The Netdata agent's web API can also use TLS if configured.

89 -

90 -When Netdata agents are claimed to Netdata Cloud, the communication happens via MQTT over Web Sockets over TLS, and

91 -public/private keys are used for authorizing access. These keys are exchanged during the claiming process (usually

92 -during the provisioning of each agent).

93 -

94 -### Authentication

95 -

96 -Direct user access to the agent is not authenticated, considering that users should either use Netdata Cloud, or they

97 -are already on the same LAN, or they have configured proper firewall policies. However, Netdata agents can be hidden

98 -behind an authenticating web proxy if required.

99 -

100 -For other Netdata agents streaming metrics to an agent, authentication via API keys is required and TLS can be used if

101 -configured.

102 -

103 -For Netdata Cloud accessing Netdata agents, public/private key cryptography is used and TLS is mandatory.

104 -

105 -### Security Vulnerability Response

106 -

107 -If a security vulnerability is found in the Netdata Agent, the Netdata team acknowledges and analyzes each report within

108 -three working days, kicking off a Security Release Process. Any vulnerability information shared with the Netdata team

109 -stays within the Netdata project and is not disseminated to other projects unless necessary for fixing the issue. The

110 -reporter is kept updated as the security issue moves from triage to identified fix, to release planning. More

111 -information can be found [here](https://github.com/netdata/netdata/security/policy).

112 -

113 -### Protection Against Common Security Threats

114 -

115 -The Netdata agent is resilient against common security threats such as DDoS attacks and SQL injections. For DDoS,

116 -Netdata agent uses a fixed number of threads for processing requests, providing a cap on the resources that can be

117 -consumed. It also automatically manages its memory to prevent overutilization. SQL injections are prevented as nothing

118 -from the UI is passed back to the data collection plugins accessing databases.

119 -

120 -Additionally, the Netdata agent is running as a normal, unprivileged, operating system user (a few data collections

121 -require escalated privileges, but these privileges are isolated to just them), every netdata process runs by default

122 -with a nice priority to protect production applications in case the system is starving for CPU resources, and Netdata

123 -agents are configured by default to be the first processes to be killed by the operating system in case the operating

124 -system starves for memory resources (OS-OOM - Operating System Out Of Memory events).

125 -

126 -### User Customizable Security Settings

127 -

128 -Netdata provides users with the flexibility to customize agent security settings. Users can configure TLS across the

129 -system, and the agent provides extensive access control lists on all its interfaces to limit access to its endpoints

130 -based on IP. Additionally, users can configure the CPU and Memory priority of Netdata agents.

131 -

132 -## Netdata Cloud Security

133 -

134 -Netdata Cloud is designed with a security-first approach to ensure the highest level of protection for user data. When

135 -using Netdata Cloud in environments that require compliance with standards like PCI DSS, SOC 2, or HIPAA, users can be

136 -confident that all collected data is stored within their infrastructure. Data viewed on dashboards and alert

137 -notifications travel over Netdata Cloud, but are not stored—instead, they're transformed in transit, aggregated from

138 -multiple agents and parents (centralization points), to appear as one data source in the user's browser.

139 -

140 -### User Identification and Authorization

141 -

142 -Netdata Cloud requires only an email address to create an account and use the service. User identification and

143 -authorization are conducted either via third-party integrations (Google, GitHub accounts) or through short-lived access

144 -tokens sent to the user’s email account. Email addresses are stored securely in our production database on AWS and are

145 -also used for product and marketing communications. Netdata Cloud does not store user credentials.

146 -

147 -### Data Storage and Transfer

148 -

149 -Although Netdata Cloud does not store metric data, it does keep some metadata for each node connected to user spaces.

150 -This metadata includes the hostname, information from the `/api/v1/info` endpoint, metric metadata

151 -from `/api/v1/contexts`, and alerts configurations from `/api/v1/alarms`. This data is securely stored in our production

152 -database on AWS and copied to Google BigQuery for analytics purposes.

153 -

154 -All data visible on Netdata Cloud is transferred through the Agent-Cloud link (ACLK) mechanism, which securely connects

155 -a Netdata Agent to Netdata Cloud. The ACLK is encrypted and safe, and is only established if the user connects/claims

156 -their node. Data in transit between a user and Netdata Cloud is encrypted using TLS.

157 -

158 -### Data Retention and Erasure

159 -

160 -Netdata Cloud maintains backups of customer content for approximately 90 days following a deletion. Users have the

161 -ability to access, retrieve, correct, and delete personal data stored in Netdata Cloud. In case a user is unable to

162 -delete personal data via self-services functionality, Netdata will delete personal data upon the customer's written

163 -request, in accordance with applicable data protection law.

164 -

165 -### Infrastructure and Authentication

166 -

167 -Netdata Cloud operates on an Infrastructure as Code (IaC) model. Its microservices environment is completely isolated,

168 -and all changes occur through Terraform. At the edge of Netdata Cloud, there is a TLS termination and an Identity and

169 -Access Management (IAM) service that validates JWT tokens included in request cookies.

170 -

171 -Netdata Cloud does not store user credentials.

172 -

173 -### Security Features and Response

174 -

175 -Netdata Cloud offers a variety of security features, including infrastructure-level dashboards, centralized alerts

176 -notifications, auditing logs, and role-based access to different segments of the infrastructure. The cloud service

177 -employs several protection mechanisms against DDoS attacks, such as rate-limiting and automated blacklisting. It also

178 -uses static code analysers to prevent other types of attacks.

179 -

180 -In the event of potential security vulnerabilities or incidents, Netdata Cloud follows the same process as the Netdata

181 -agent. Every report is acknowledged and analyzed by the Netdata team within three working days, and the team keeps the

182 -reporter updated throughout the process.

183 -

184 -### User Customization

185 -

186 -Netdata Cloud uses the highest level of security. There is no user customization available out of the box. Its security

187 -settings are designed to provide maximum protection for all users. We are offering customization (like custom SSO

188 -integrations, custom data retention policies, advanced user access controls, tailored audit logs, integration with other

189 -security tools, etc.) on a per contract basis.

190 -

191 -### Deleting Personal Data

192 -

193 -Users who wish to remove all personal data (including email and activities) can delete their cloud account by logging

194 -into Netdata Cloud and accessing their profile.

195 -

196 -## User Privacy and Data Protection

197 -

198 -Netdata Cloud is built with an unwavering commitment to user privacy and data protection. We understand that our users'

199 -data is both sensitive and valuable, and we have implemented stringent measures to ensure its safety.

200 -

201 -### Data Collection

202 -

203 -Netdata Cloud collects minimal personal information from its users. The only personal data required to create an account

204 -and use the service is an email address. This email address is used for product and marketing communications.

205 -Additionally, the IP address used to access Netdata Cloud is stored in web proxy access logs.

206 -

207 -### Data Usage

208 -

209 -The collected email addresses are stored in our production database on Amazon Web Services (AWS) and copied to Google

210 -BigQuery, our data lake, for analytics purposes. These analytics are crucial for our product development process. If a

211 -user accepts the use of analytical cookies, their email address and IP are stored in the systems we use to track

212 -application usage (Google Analytics, Posthog, and Gainsight PX). Subscriptions and Payments data are handled by Stripe.

213 -

214 -### Data Sharing

215 -

216 -Netdata Cloud does not share any personal data with third parties, ensuring the privacy of our users' data, but Netdata

217 -Cloud does use third parties for its services, including, but not limited to, Google Cloud and Amazon Web Services for

218 -its infrastructure, Stripe for payment processing, Google Analytics, Posthog and Gainsight PX for analytics.

219 -

220 -### Data Protection

221 -

222 -We use state-of-the-art security measures to protect user data from unauthorized access, use, or disclosure. All

223 -infrastructure data visible on Netdata Cloud passes through the Agent-Cloud Link (ACLK) mechanism, which securely

224 -connects a Netdata Agent to Netdata Cloud. The ACLK is encrypted, safe, and is only established if the user connects

225 -their node. All data in transit between a user and Netdata Cloud is encrypted using TLS.

226 -

227 -### User Control over Data

228 -

229 -Netdata provides its users with the ability to access, retrieve, correct, and delete their personal data stored in

230 -Netdata Cloud. This ability may occasionally be limited due to temporary service outages for maintenance or other

231 -updates to Netdata Cloud, or when it is technically not feasible. If a customer is unable to delete personal data via

232 -the self-services functionality, Netdata deletes the data upon the customer's written request, within the timeframe

233 -specified in the Data Protection Agreement (DPA), and in accordance with applicable data protection laws.

234 -

235 -### Compliance with Data Protection Laws

236 -

237 -Netdata Cloud is fully compliant with data protection laws like the General Data Protection Regulation (GDPR) and the

238 -California Consumer Privacy Act (CCPA).

239 -

240 -### Data Transfer

241 -

242 -Data transfer within Netdata Cloud is secure and respects the privacy of the user data. The Netdata Agent establishes an

243 -outgoing secure WebSocket (WSS) connection to Netdata Cloud, ensuring that the data is encrypted when in transit.

244 -

245 -### Use of Tracking Technologies

246 -

247 -Netdata Cloud uses analytical cookies if a user consents to their use. These cookies are used to track the usage of the

248 -application and are stored in systems like Google Analytics, Posthog and Gainsight PX.

249 -

250 -### Data Breach Notification Process

251 -

252 -In the event of a data breach, Netdata has a well-defined process in place for notifying users. The details of this

253 -process align with the standard procedures and timelines defined in the Data Protection Agreement (DPA).

254 -

255 -We continually review and update our privacy and data protection practices to ensure the highest level of data safety

256 -and privacy for our users.

257 -

258 -## Compliance with Regulations

259 -

260 -Netdata is committed to ensuring the security, privacy, and integrity of user data. It complies with both the General

261 -Data Protection Regulation (GDPR), a regulation in EU law on data protection and privacy, and the California Consumer

262 -Privacy Act (CCPA), a state statute intended to enhance privacy rights and consumer protection for residents of

263 -California.

264 -

265 -### Compliance with GDPR and CCPA

266 -

267 -Compliance with GDPR and CCPA are self-assessment processes, and Netdata has undertaken thorough internal audits and

268 -controls to ensure it meets all requirements.

269 -

270 -As per request basis, any customer may enter with Netdata into a data processing addendum (DPA) governing customer’s

271 -ability to load and permit Netdata to process any personal data or information regulated under applicable data

272 -protection laws, including the GDPR and CCPA.

273 -

274 -### Data Transfers

275 -

276 -While Netdata Agent itself does not engage in any cross-border data transfers, certain personal and infrastructure data

277 -is transferred to Netdata Cloud for the purpose of providing its services. The metric data collected and processed by

278 -Netdata Agents, however, stays strictly within the user's infrastructure, eliminating any concerns about cross-border

279 -data transfer issues.

280 -

281 -When users utilize Netdata Cloud, the metric data is streamed directly from the Netdata Agent to the users’ web browsers

282 -via Netdata Cloud, without being stored on Netdata Cloud's servers. However, user identification data (such as email

283 -addresses) and infrastructure metadata necessary for Netdata Cloud's operation are stored in data centers in the United

284 -States, using compliant infrastructure providers such as Google Cloud and Amazon Web Services. These transfers and

285 -storage are carried out in full compliance with applicable data protection laws, including GDPR and CCPA.

286 -

287 -### Privacy Rights

288 -

289 -Netdata ensures user privacy rights as mandated by the GDPR and CCPA. This includes the right to access, correct, and

290 -delete personal data. These functions are all available online via the Netdata Cloud User Interface (UI). In case a user

291 -wants to remove all personal information (email and activities), they can delete their cloud account by logging

292 -into https://app.netdata.cloud and accessing their profile, at the bottom left of the screen.

293 -

294 -### Regular Review and Updates

295 -

296 -Netdata is dedicated to keeping its practices up-to-date with the latest developments in data protection regulations.

297 -Therefore, as soon as updates or changes are made to these regulations, Netdata reviews and updates its policies and

298 -practices accordingly to ensure continual compliance.

299 -

300 -While Netdata is confident in its compliance with GDPR and CCPA, users are encouraged to review Netdata's privacy policy

301 -and reach out with any questions or concerns they may have about data protection and privacy.

302 -

303 -## Anonymous Statistics

304 -

305 -The anonymous statistics collected by the Netdata Agent are related to the installations and not to individual users.

306 -This data includes community size, types of plugins used, possible crashes, operating systems installed, and the use of

307 -the registry feature. No IP addresses are collected, but each Netdata installation has a unique ID.

308 -

309 -Netdata also collects anonymous telemetry events, which provide information on the usage of various features, errors,

310 -and performance metrics. This data is used to understand how the software is being used and to identify areas for

311 -improvement.

312 -

313 -The purpose of collecting these statistics and telemetry data is to guide the development of the open-source agent,

314 -focusing on areas that are most beneficial to users.

315 -

316 -Users have the option to opt out of this data collection during the installation of the agent, or at any time by

317 -removing a specific file from their system.

318 -

319 -Netdata retains this data indefinitely in order to track changes and trends within the community over time.

320 -

321 -Netdata does not share these anonymous statistics or telemetry data with any third parties.

322 -

323 -By collecting this data, Netdata is able to continuously improve their service and identify any issues or areas for

324 -improvement, while respecting user privacy and maintaining transparency.

325 -

326 -## Internal Security Measures

327 -

328 -Internal Security Measures at Netdata are designed with an emphasis on data privacy and protection. The measures

329 -include:

330 -

331 -1. **Infrastructure as Code (IaC)** :

332 - Netdata Cloud follows the IaC model, which means it is a microservices environment that is completely isolated. All

333 - changes are managed through Terraform, an open-source IaC software tool that provides a consistent CLI workflow for

334 - managing cloud services.

335 -2. **TLS Termination and IAM Service** :

336 - At the edge of Netdata Cloud, there is a TLS termination, which provides the decryption point for incoming TLS

337 - connections. Additionally, an Identity Access Management (IAM) service validates JWT tokens included in request

338 - cookies or denies access to them.

339 -3. **Session Identification** :

340 - Once inside the microservices environment, all requests are associated with session IDs that identify the user making

341 - the request. This approach provides additional layers of security and traceability.

342 -4. **Data Storage** :

343 - Data is stored in various NoSQL and SQL databases and message brokers. The entire environment is fully isolated,

344 - providing a secure space for data management.

345 -5. **Authentication** :

346 - Netdata Cloud does not store credentials. It offers three types of authentication: GitHub Single Sign-On (SSO),

347 - Google SSO, and email validation.

348 -6. **DDoS Protection** :

349 - Netdata Cloud has multiple protection mechanisms against Distributed Denial of Service (DDoS) attacks, including

350 - rate-limiting and automated blacklisting.

351 -7. **Security-Focused Development Process** :

352 - To ensure a secure environment, Netdata employs a security-focused development process. This includes the use of

353 - static code analysers to identify potential security vulnerabilities in the codebase.

354 -8. **High Security Standards** :

355 - Netdata Cloud maintains high security standards and can provide additional customization on a per contract basis.

356 -9. **Employee Security Practices** :

357 - Netdata ensures its employees follow security best practices, including role-based access, periodic access review,

358 - and multi-factor authentication. This helps to minimize the risk of unauthorized access to sensitive data.

359 -10. **Experienced Developers** :

360 - Netdata hires senior developers with vast experience in security-related matters. It enforces two code reviews for

361 - every Pull Request (PR), ensuring that any potential issues are identified and addressed promptly.

362 -11. **DevOps Methodologies** :

363 - Netdata's DevOps methodologies use the highest standards in access control in all places, utilizing the best

364 - practices available.

365 -12. **Risk-Based Security Program** :

366 - Netdata has a risk-based security program that continually assesses and mitigates risks associated with data

367 - security. This program helps maintain a secure environment for user data.

368 -

369 -These security measures ensure that Netdata Cloud is a secure environment for users to monitor and troubleshoot their

370 -systems. The company remains committed to continuously improving its security practices to safeguard user data

371 -effectively.

372 -

373 -## PCI DSS

374 -

375 -PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all

376 -companies that accept, process, store or transmit credit card information maintain a secure environment.

377 -

378 -Netdata is committed to providing secure and privacy-respecting services, and it aligns its practices with many of the

379 -key principles of the PCI DSS. However, it's important to clarify that Netdata is not officially certified as PCI

380 -DSS-compliant. While Netdata follows practices that align with PCI DSS's key principles, the company itself has not

381 -undergone the formal certification process for PCI DSS compliance.

382 -

383 -PCI DSS compliance is not just about the technical controls but also involves a range of administrative and procedural

384 -safeguards that go beyond the scope of Netdata's services. These include, among other things, maintaining a secure

385 -network, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an

386 -information security policy.

387 -

388 -Therefore, while Netdata can support entities with their data security needs in relation to PCI DSS, it is ultimately

389 -the responsibility of the entity to ensure full PCI DSS compliance across all of their operations. Entities should

390 -always consult with a legal expert or a PCI DSS compliance consultant to ensure that their use of any product, including

391 -Netdata, aligns with PCI DSS regulations.

392 -

393 -## HIPAA

394 -

395 -HIPAA stands for the Health Insurance Portability and Accountability Act, which is a United States federal law enacted

396 -in 1996. HIPAA is primarily focused on protecting the privacy and security of individuals' health information.

397 -

398 -Netdata is committed to providing secure and privacy-respecting services, and it aligns its practices with many key

399 -principles of HIPAA. However, it's important to clarify that Netdata is not officially certified as HIPAA-compliant.

400 -While Netdata follows practices that align with HIPAA's key principles, the company itself has not undergone the formal

401 -certification process for HIPAA compliance.

402 -

403 -HIPAA compliance is not just about technical controls but also involves a range of administrative and procedural

404 -safeguards that go beyond the scope of Netdata's services. These include, among other things, employee training,

405 -physical security, and contingency planning.

406 -

407 -Therefore, while Netdata can support HIPAA-regulated entities with their data security needs and is prepared to sign a

408 -Business Associate Agreement (BAA), it is ultimately the responsibility of the healthcare entity to ensure full HIPAA

409 -compliance across all of their operations. Entities should always consult with a legal expert or a HIPAA compliance

410 -consultant to ensure that their use of any product, including Netdata, aligns with HIPAA regulations.

411 -

412 -## Conclusion

413 -

414 -In conclusion, Netdata Cloud's commitment to data security and user privacy is paramount. From the careful design of the

415 -infrastructure and stringent internal security measures to compliance with international regulations and standards like

416 -GDPR and CCPA, Netdata Cloud ensures a secure environment for users to monitor and troubleshoot their systems.

417 -

418 -The use of advanced encryption techniques, role-based access control, and robust authentication methods further

419 -strengthen the security of user data. Netdata Cloud also maintains transparency in its data handling practices, giving

420 -users control over their data and the ability to easily access, retrieve, correct, and delete their personal data.

421 -

422 -Netdata's approach to anonymous statistics collection respects user privacy while enabling the company to improve its

423 -product based on real-world usage data. Even in such cases, users have the choice to opt-out, underlining Netdata's

424 -respect for user autonomy.

425 -

426 -In summary, Netdata Cloud offers a highly secure, user-centric environment for system monitoring and troubleshooting.

427 -The company's emphasis on continuous security improvement and commitment to user privacy make it a trusted choice in the

428 -data monitoring landscape.

429 -

docs/quickstart/infrastructure.md

+1 -1

@@ -143,7 +143,7 @@ sudo ./edit-config netdata.conf

143 Our [configuration basics doc](https://github.com/netdata/netdata/blob/master/docs/configure/nodes.md) contains more information about `netdata.conf`, `edit-config`,

144 along with simple examples to get you familiar with editing your node's configuration.

145

146 -After you've learned the basics, you should [secure your infrastructure's nodes](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md) using

146 +After you've learned the basics, you should [secure your infrastructure's nodes](https://github.com/netdata/netdata/blob/master/docs/security-and-privacy-design/README.md) using

147 one of our recommended methods. These security best practices ensure no untrusted parties gain access to the metrics

148 collected on any of your nodes.

149

packaging/docker/README.md

+1 -1

@@ -257,7 +257,7 @@ volumes:

257 ### With SSL/TLS enabled HTTP Proxy

258

259 For a permanent installation on a public server, you

260 -should [secure the Netdata instance](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md). This

260 +should [secure the Netdata instance](https://github.com/netdata/netdata/blob/master/docs/category-overview-pages/secure-nodes.md). This

261 section contains an example of how to install Netdata with an SSL reverse proxy and basic authentication.

262

263 You can use the following `docker-compose.yml` and Caddyfile files to run Netdata with Docker. Replace the domains and

packaging/installer/methods/ansible.md

+1 -1

@@ -130,7 +130,7 @@ hostname of the node, the playbook disables that local dashboard by setting `web

130 security boost by not allowing any unwanted access to the local dashboard.

131

132 You can read more about this decision, or other ways you might lock down the local dashboard, in our [node security

133 -doc](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md).

133 +doc](https://github.com/netdata/netdata/blob/master/docs/security-and-privacy-design/README.md).

134

135 > Curious about why Netdata's dashboard is open by default? Read our [blog

136 > post](https://www.netdata.cloud/blog/netdata-agent-dashboard/) on that zero-configuration design decision.

packaging/installer/methods/synology.md

+11 -12

@@ -27,23 +27,22 @@ will install the content into `/opt/netdata`, making future removal safe and sim

27 When Netdata is first installed, it will run as _root_. This may or may not be acceptable for you, and since other

28 installations run it as the `netdata` user, you might wish to do the same. This requires some extra work:

30 -1. Create a group `netdata` via the Synology group interface. Give it no access to anything.

31 -2. Create a user `netdata` via the Synology user interface. Give it no access to anything and a random password. Assign

30 +1. Create a group `netdata` via the Synology group interface. Give it no access to anything.

31 +2. Create a user `netdata` via the Synology user interface. Give it no access to anything and a random password. Assign

32 the user to the `netdata` group. Netdata will chuid to this user when running.

33 -3. Change ownership of the following directories, as defined in

34 - [Netdata Security](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md#security-design):

33 +3. Change ownership of the following directories:

36 -```sh

37 -chown -R root:netdata /opt/netdata/usr/share/netdata

38 -chown -R netdata:netdata /opt/netdata/var/lib/netdata /opt/netdata/var/cache/netdata

39 -chown -R netdata:root /opt/netdata/var/log/netdata

40 -```

35 + ```sh

36 + chown -R root:netdata /opt/netdata/usr/share/netdata

37 + chown -R netdata:netdata /opt/netdata/var/lib/netdata /opt/netdata/var/cache/netdata

38 + chown -R netdata:root /opt/netdata/var/log/netdata

39 + ```

41 4. Restart Netdata

44 -```sh

45 -/etc/rc.netdata restart

46 -```

43 + ```sh

44 + /etc/rc.netdata restart

45 + ```

47 ## Create startup script

src/aclk/README.md

+1 -1

@@ -24,7 +24,7 @@ you. This is why **we don't store any metric data in Netdata Cloud**.

25 All the data that you see in the web browser when using Netdata Cloud, is actually streamed directly from the Netdata Agent to the Netdata Cloud dashboard. The data passes through our systems, but it isn't stored.

27 -However, to be able to offer the stunning visualizations and advanced functionality of Netdata Cloud, it does store a limited number of _metadata_. Read more about our [security and privacy design](https://github.com/netdata/netdata/blob/master/docs/netdata-security.md).

27 +However, to be able to offer the stunning visualizations and advanced functionality of Netdata Cloud, it does store a limited number of _metadata_. Read more about our [security and privacy design](https://github.com/netdata/netdata/blob/master/docs/security-and-privacy-design/README.md).

29 ## Enable and configure the ACLK