Security Best Practices

Enable multi-factor authentication (MFA) for all users in your organization.

slyd account mfa enable --user=all

Assign the minimum necessary permissions to each user based on their role.

slyd permissions create --role="data-scientist" \
  --allow="instances:read,instances:create" \
  --deny="billing:*,instances:delete"

Follow the principle of least privilege by giving users only the permissions they need to perform their tasks.

Establish a regular schedule for rotating API keys to minimize the impact of potential key exposure.

# List current API keys
slyd api-keys list

# Create a new key
slyd api-keys create --name="project-x-$(date +%Y-%m-%d)"

# Transition your applications to use the new key, then delete the old one
slyd api-keys delete --id=old-key-id

Use SSH keys for authentication and disable password-based login.

# When creating a new instance, specify your SSH key
slyd instance create --type=cpu-standard --ssh-key=~/.ssh/id_rsa.pub

# For existing instances, disable password authentication 
slyd instance exec my-instance "sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config && sudo systemctl restart sshd"

Regularly update the operating system and installed software to patch security vulnerabilities.

# Update all instances in a project
slyd instance exec-all --project=my-project "sudo apt update && sudo apt upgrade -y"

# Or schedule regular updates using the SLYD scheduler
slyd scheduler create --name="weekly-updates" \
  --schedule="0 2 * * 0" \
  --command="instance exec-all --project=my-project 'sudo apt update && sudo apt upgrade -y'"

Configure firewall rules to restrict traffic to only the necessary ports and sources.

# Allow SSH only from specific IP ranges
slyd firewall create --instance=my-instance \
  --allow-ssh-from="192.168.1.0/24,10.0.0.0/8"

# Open specific port for an application
slyd firewall allow --instance=my-instance \
  --port=8080 --protocol=tcp --source="0.0.0.0/0"

Use SLYD's secure tunneling feature for sensitive applications rather than exposing them directly to the internet.

Enable disk encryption for instances that store sensitive information.

# Create an instance with encrypted storage
slyd instance create --type=gpu-standard \
  --name=ml-training \
  --disk-encryption=aes256

Integrate security testing into your CI/CD pipeline to catch vulnerabilities before deployment.

• Perform static application security testing (SAST) to identify code vulnerabilities
• Conduct dependency scanning to detect vulnerable libraries
• Implement dynamic application security testing (DAST) for runtime vulnerabilities
• Use container scanning for containerized applications

Use SLYD's built-in secrets management to securely store and access sensitive information.

# Store a secret
slyd secrets create --name="db-password" --value="my-secure-password"

# Use the secret in your application
slyd instance exec my-instance \
  "export DB_PASSWORD=$(slyd secrets get db-password) && ./start-app.sh"

Follow container security best practices when deploying containerized applications.

• Use minimal base images to reduce the attack surface
• Run containers with non-root users whenever possible
• Scan container images for vulnerabilities before deployment
• Implement resource limits to prevent denial-of-service attacks

# Deploy a container with security constraints
slyd container deploy --image=my-app:latest \
  --non-root --read-only-fs \
  --memory-limit=512M --cpu-limit=1.0

Classify your data based on sensitivity and apply appropriate security controls.

Implement encryption for data at rest and in transit.

• Use TLS/SSL for all network communications
• Enable disk encryption for storage volumes containing sensitive data
• Use application-level encryption for highly sensitive information

# Create an encrypted storage volume
slyd storage create --name=sensitive-data \
  --size=100G --encryption=aes256 \
  --attach-to=my-instance --mount-point=/data

Implement policies for secure data handling throughout its lifecycle.

• Define retention periods for different types of data
• Implement secure data deletion when data is no longer needed
• Use data masking or anonymization for non-production environments

# Set up automatic data retention policies
slyd storage policy create --volume=sensitive-data \
  --retention-period=90d \
  --deletion-method=secure-wipe

Set up comprehensive monitoring to detect potential security incidents.

# Enable enhanced security monitoring
slyd monitoring create --name=security-alerts \
  --type=security --level=enhanced \
  [email protected]

• Monitor unusual access patterns or login attempts
• Track resource usage to detect potential cryptomining attacks
• Set up alerting for suspicious network activity
• Implement log analysis for early threat detection

Configure detailed logging to support security monitoring and incident investigation.

# Set up centralized logging
slyd logging configure --instance=* \
  --level=detailed \
  --retention=90d \
  --forward-to=log-aggregator

Develop and practice an incident response plan to handle security breaches.

# Isolate a compromised instance
slyd network isolate --instance=compromised-instance

# Create a forensic snapshot before remediation
slyd snapshot create --instance=compromised-instance \
  --name=forensic-$(date +%Y%m%d) --forensic-mode

SLYD supports various compliance requirements, but you'll need to configure your resources appropriately.

# Apply HIPAA compliance template to an instance
slyd compliance apply --template=hipaa --instance=healthcare-app

Maintain thorough documentation and conduct regular security audits.

• Document your security configurations and controls
• Perform regular compliance assessments
• Generate audit reports for regulatory requirements

# Generate a compliance report
slyd compliance report --framework=pci-dss \
  --period="last-quarter" --output=pdf \
  [email protected]