---
title: Best practices for secure operation
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ps7.staging.ubuntu.com/ceph/docs/secure-operation
---

*Submit*

# Best practices for secure operation

Maintaining security is an ongoing process. This section aims to give a brief overview of best practices for secure operations.

### [Vulnerability Management](https://ps7.staging.ubuntu.com/ceph/docs/secure-operation#p-179248-vulnerability-management)

* Monitor Advisories: Actively track Common Vulnerabilities and Exposures (CVEs) and security advisories for Ceph, Juju, Ubuntu/Host OS, Kernel, and related software. Use resources like Ubuntu Security Notices (USNs) and the Ceph announce list.
* Patch Management: Implement a robust process for testing and applying security patches promptly. Prioritize critical vulnerabilities. Use Juju for orchestrated upgrades of Ceph charms.

### [Incident Response](https://ps7.staging.ubuntu.com/ceph/docs/secure-operation#p-179248-incident-response)

* Develop a Plan: Have a clearly documented Incident Response (IR) plan tailored to your Charmed Ceph environment.
* Define Steps: The plan should cover standard IR phases, e.g.:
  + How to detect incidents (monitoring, logs, reports).
  + Isolating affected systems/components.
  + Removing the threat and fixing the vulnerability.
  + Safely restoring services and data.
  + Post-incident analysis to improve defenses.
* Practice: Regularly test the plan through drills/simulations.

### [Perform Audits](https://ps7.staging.ubuntu.com/ceph/docs/secure-operation#p-179248-perform-audits)

* Regular Checks: Conduct periodic security audits of the cluster.
* Validate Controls: Verify configurations (encryption, network rules), permissions (Cephx caps, Juju roles, OS access), and access controls frequently.

### [Perform Upgrades](https://ps7.staging.ubuntu.com/ceph/docs/secure-operation#p-179248-perform-upgrades)

* Stay Current: Regularly upgrade Ceph (point releases often contain security fixes), Juju, Snapd, and the underlying OS to benefit from the latest security patches and features.
* Schedule Proactively: Plan and schedule updates, especially for security vulnerabilities. Test upgrades in a staging environment before applying to production. Follow documented upgrade procedures for Ceph and Juju.

### [Release Notes](https://ps7.staging.ubuntu.com/ceph/docs/secure-operation#p-179248-release-notes)

* Always read the release notes for Ceph, Juju, Ubuntu, and related components before performing upgrades or making significant configuration changes.
* Release notes contain information about security enhancements, bug fixes (including security fixes), potential breaking changes, and known issues that might impact security or stability.

---

[Previous

Best practices for secure deployment](https://ps7.staging.ubuntu.com/ceph/docs/secure-deployment)
[Next

Cryptography](https://ps7.staging.ubuntu.com/ceph/docs/cryptographic-technologies-in-charmed-ceph)

This page was last modified 1 year, 6 days ago. [Help improve this document in the forum](https://discourse.ubuntu.com/t/best-practices-for-secure-operation/69023).