<commit_before>---
layout: markdown_page
title: Security Handbook
---

## Best Practices<a name="best-practices"></a>

1. **Never reuse** a password you use on a company account, not for another
   GitLab service nor for a personal account.
1. Set up [1Password] as your password manager and set a **strong and unique**
   master password.
1. Use 1Password to [generate strong passwords] for any new accounts.
1. When signing up for a new service ask yourself which team members you need to
   **share access** with.
   - If the service has a built-in way of creating individual user accounts, use that functionality and keep your credentials to yourself by storing them in 'Your Vault'.
   - If not, then store your credentials in an appropriate company 1Password vault so that your colleagues can sign in using your credentials.
   - At times, there will be credentials that you need which are _not_ stored in a shared vault on 1Password, for example if they are tied to a single individual's Google account. To find those credentials, locate the 'secure note' in the team's Shared vault with the name of the service you are trying to access. That note lists whom you should contact to gain access.
1. If 2FA should be on for the new user account, make sure to store recovery codes in the login, and consider using [auto-generated TOTP] if useful.
1. If you need to give more people access to credentials [move them](https://discussions.agilebits.com/discussion/comment/133692/#Comment_133692) to a vault that they can access. Never duplicate credentials! If needed put them in the 'shared' vault that the whole company can access or make a suggestion to create a new vault in the "1password Shared Folders" Google Sheet. Do not share passwords on a per person basis by sharing them via 1password, this makes it hard to reason about the sharing and doesn't change when the responsibilities change.
1. When asked security questions (what is your favorite pet, etc.) do not answer truthfully since that is easy to research. Make up an answer and write both the question and answer in 1password.
1. Do not share credentials via email, issue comments, chat etc. This includes
   email addresses to login and API keys. Use 1Password vaults for this. You
   will be invited to applicable vaults after joining the company.
1. If you want to see you vaults or ask to be added to a new one please leave
   a comment in the "1password Shared Folders" Google Doc.
1. If you're missing an appropriate vault [make a suggestion to mark the relevant cell](https://support.google.com/docs/answer/6033474?hl=en) in the
   "1password Shared Folders" Google SHeet.
1. Refer to the items with NAME_OF_SITE credentials in VAULT_NAME. For example:
   "for access please see the AOL credentials in the Luddite vault".
1. Do not
   store credentials in a vault if everyone has their own user account for the
   service.
1. Do not let your password manager store the **master password**. It is okay to
   store the login.
1. Enable two-factor authentication (2FA) with 1Password [auto-generated TOTP] for your Google, Slack, GitLab.com, and dev.gitlab.org accounts. The nice thing about 1Password is that it migrates when you have a new phone, unlike Google Authenticator.
1. You can also consider using a [Yubikey](https://about.gitlab.com/2016/06/22/gitlab-adds-support-for-u2f/) with GitLab.<commit_msg>Further clarification of types of account access, and how to gain access<commit_after>---
layout: markdown_page
title: Security Handbook
---

## Best Practices<a name="best-practices"></a>

1. **Never reuse** a password you use on a company account, not for another
   GitLab service nor for a personal account.
1. Set up [1Password] as your password manager and set a **strong and unique**
   master password.
1. Use 1Password to [generate strong passwords] for any new accounts.
1. When signing up for a new service ask yourself which team members you need to
   **share access** with. There are three types of account access for these services:
   1. Individual accounts (created manually for you, such as Slack, Google): keep your credentials to yourself by storing them in your 'Personal' vault.
   1. Shared accounts (services that don't allow individual accounts or where it is too expensive): store your credentials in an appropriate company 1Password vault so that your colleagues can sign in using your credentials.
   1. OAuth accounts (authentication through GitLab or Google, such as for checkmk monitoring and grafana).

The 'Shared' vault (to which all team members have access) has a secure note for _each_ service that uses individual or OAuth account access. The note lists whom you should contact to gain access to the service.
1. If 2FA should be on for the new user account, make sure to store recovery codes in the login, and consider using [auto-generated TOTP] if useful.
1. If you need to give more people access to credentials [move them](https://discussions.agilebits.com/discussion/comment/133692/#Comment_133692) to a vault that they can access. Never duplicate credentials! If needed put them in the 'shared' vault that the whole company can access or make a suggestion to create a new vault in the "1password Shared Folders" Google Sheet. Do not share passwords on a per person basis by sharing them via 1password, this makes it hard to reason about the sharing and doesn't change when the responsibilities change.
1. When asked security questions (what is your favorite pet, etc.) do not answer truthfully since that is easy to research. Make up an answer and write both the question and answer in 1password.
1. Do not share credentials via email, issue comments, chat etc. This includes
   email addresses to login and API keys. Use 1Password vaults for this. You
   will be invited to applicable vaults after joining the company.
1. If you want to see you vaults or ask to be added to a new one please leave
   a comment in the "1password Shared Folders" Google Doc.
1. If you're missing an appropriate vault [make a suggestion to mark the relevant cell](https://support.google.com/docs/answer/6033474?hl=en) in the
   "1password Shared Folders" Google SHeet.
1. Refer to the items with NAME_OF_SITE credentials in VAULT_NAME. For example:
   "for access please see the AOL credentials in the Luddite vault".
1. Do not
   store credentials in a vault if everyone has their own user account for the
   service.
1. Do not let your password manager store the **master password**. It is okay to
   store the login.
1. Enable two-factor authentication (2FA) with 1Password [auto-generated TOTP] for your Google, Slack, GitLab.com, and dev.gitlab.org accounts. The nice thing about 1Password is that it migrates when you have a new phone, unlike Google Authenticator.
1. You can also consider using a [Yubikey](https://about.gitlab.com/2016/06/22/gitlab-adds-support-for-u2f/) with GitLab.
{'fraction_non_alphanumeric': 0.05536231884057971, 'fraction_numerical': 0.01681159420289855, 'mean_word_length': 4.15, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '235517', 'n_tokens_mistral': 1820, 'n_tokens_neox': 1722, 'n_words': 1063}