Skip to content

SECURITY.md

Latest commit

 

History

History
131 lines (98 loc) · 5.83 KB

SECURITY.md

File metadata and controls

131 lines (98 loc) · 5.83 KB
Raw

FluidStack Security Compliance

This document outlines FluidStack's security capabilities and compliance with Brev's security requirements.

🔑 SSH Access Requirements

FluidStack instances must support SSH server functionality and SSH key-based authentication for Brev access.

SSH Implementation Status

  • SSH Server: FluidStack instances include SSH server (OpenSSH) pre-installed and running
  • SSH Key Authentication: FluidStack supports SSH public key injection during instance provisioning
  • Key Management: Public SSH keys are configured in ~/.ssh/authorized_keys during instance setup
  • Network Access: SSH access operates within FluidStack's project-level network isolation model

✅ FULLY COMPLIANT

Disk Encryption

  • Encryption at Rest: Hardware-level self-encrypting drives (SEDs)
  • Implementation: Automatic encryption without performance overhead
  • Coverage: All data stored on FluidStack infrastructure
  • Standard: Industry-standard encryption algorithms

Transit Encryption

  • Protocol: SSL/TLS encryption for all network traffic
  • Coverage: All API communications and data transfer
  • Implementation: Automatic encryption for all connections

Network Isolation

  • Project-Level Isolation: Dedicated L3 networks per project
  • Technology: VXLAN and eBPF for network segmentation
  • Isolation Scope: Hardware, network, and storage levels
  • Multi-Tenancy: Single-tenant by default, no shared clusters

Physical Security

  • Data Centers: Tier-3 facilities with 24/7 surveillance
  • Access Controls: Biometric access controls and mantrap entry systems
  • Monitoring: Continuous monitoring with CCTV coverage
  • Personnel: Restricted access to authorized personnel only

Compliance Certifications

  • HIPAA: Health Insurance Portability and Accountability Act
  • GDPR: General Data Protection Regulation
  • ISO27001: Information Security Management System
  • SOC 2 TYPE I: Service Organization Control 2

⚠️ PARTIAL COMPLIANCE

Network Security Model

  • ✅ Outbound Traffic: Instances can egress to public internet (compliant)
  • ✅ Project Isolation: Strong isolation between projects (compliant)
  • ❓ Inbound Traffic: "Deny all inbound by default" behavior not explicitly documented
  • ❓ Instance-Level Firewalls: No API endpoints for individual instance firewall rules

Firewall Management

  • Limitation: Security managed at project/cluster level, not per-instance
  • API Gap: No dedicated firewall rule management endpoints in Infrastructure API
  • Workaround: Project-level isolation provides security boundary
  • Impact: May not provide granular instance-level firewall control

❌ LIMITATIONS

Granular Network Control

  • Missing Feature: Individual instance firewall rule management
  • Alternative: Project-level network isolation
  • API Support: No explicit firewall rule endpoints found
  • Security Model: Relies on project boundaries for isolation

Network Security APIs

  • Firewall Rules: No API endpoints for creating/managing firewall rules
  • Security Groups: No security group concept or API
  • Network ACLs: No network access control list management

Security Implementation Notes

Default Security Posture

✅ Data encrypted at rest (hardware-level SEDs)
✅ Data encrypted in transit (SSL/TLS)
✅ Project-level network isolation (VXLAN/eBPF)
✅ Physical security (Tier-3 data centers)
❓ Instance-level firewall rules (not documented)
❓ "Deny all inbound" default behavior (needs verification)

Recommended Security Practices

  1. Project Organization: Use separate projects for different security zones
  2. Network Design: Leverage project-level isolation for security boundaries
  3. Access Control: Implement application-level security controls
  4. Monitoring: Use FluidStack's audit logging and monitoring features

Security Verification Required

Before production deployment, verify:

  1. Default Inbound Policy: Confirm if inbound traffic is denied by default
  2. Firewall APIs: Check for any undocumented firewall management endpoints
  3. Network Behavior: Test actual network isolation and traffic patterns
  4. Security Controls: Validate project-level isolation effectiveness

Risk Assessment

Low Risk

  • Data Encryption: Excellent hardware-level encryption
  • Physical Security: Strong data center security controls
  • Compliance: Multiple enterprise certifications
  • Network Isolation: Strong project-level isolation

Medium Risk

  • Firewall Management: Limited granular network control
  • API Limitations: No explicit firewall rule management
  • Documentation Gaps: Some security behaviors not explicitly documented

Mitigation Strategies

  1. Application Security: Implement security controls at the application layer
  2. Project Design: Use project boundaries as security zones
  3. Network Architecture: Design applications to work within project isolation model
  4. Monitoring: Implement comprehensive logging and monitoring

Conclusion

FluidStack provides excellent foundational security with hardware-level encryption, strong network isolation, and comprehensive compliance certifications. However, it may not provide the granular instance-level firewall management that some security models require.

Recommendation: FluidStack is suitable for workloads that can leverage project-level security isolation. For applications requiring fine-grained instance-level firewall controls, additional verification and testing is recommended.

References