Skip to content

RTS-61: require disk encryption and 2FA App #142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zyzniewski-reef wants to merge 2 commits into
base: master
Choose a base branch
from
Open

RTS-61: require disk encryption and 2FA App #142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
db7fde8
RTS-61: require disk encryption and 2FA App
zyzniewski-reef Aug 6, 2025
075b447
RTS-61: more security guidelines
zyzniewski-reef Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ If you plan to connect your mobile device to any work-related accounts, first ma

2FA is mandatory everywhere it is possible to use it (more explanation below).
We recommend Twilio's [Authy](https://authy.com/) because it has a PIN code and end-to-end encrypted cloud backup.
We require using an Authenticator App - email-based 2FA is forbidden.

Frequently Asked Questions:

Expand Down
7 changes: 3 additions & 4 deletions docs/Developer_environment_setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
# Developer Environment Setup

This guide will show how to set up a standard, secure work environment for software development.
This is very important as we want to prevent unauthorized access to our data (the code, secret keys, customers' sensitive information) in case of theft or loss of hardware. With that in mind, it is required to have some form of access protection and to never leave the computer unattended without locking it.

## Ensure you have a Secure Work Environment

For Secure Work Environment we recommend a Virtual Machine or dual-boot with [Full Disk Encryption](Storage_Encryption.md#full-disk-encryption) enabled.
For Secure Work Environment we require either a Virtual Machine or a multi-user setup, with [Full Disk Encryption](Storage_Encryption.md#full-disk-encryption) enabled in both cases.
Copy link
Copy Markdown

@kacper-wolkiewicz-reef kacper-wolkiewicz-reef Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do I understand correctly that:

  1. dual-boot = 2 different OS instances on either one or many physical drives,
  2. multi-user setup = 1 OS instance with many users.

If that's the case, is from now dual boot forbidden? My setup for now is that I have one SSD drive dedicated only to Reef work, and other SSD drive for other things.

Copy link
Copy Markdown
Author

@zyzniewski-reef zyzniewski-reef Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's still under heavy discussion, but in my opinion, dual-boot is a form of multi-user setup. The idea is to have a separate account for work-related stuff and another for everything else (which dual-boot satisfies).

This ensures a clear segregation between your professional and personal digital spaces, preventing accidental cross-access or data leaks involving customer data.

If you have previously used your reef.pl email address (or any associated) on a personal environment, make sure to remove it from all devices and accounts.
Expand All @@ -16,16 +17,14 @@ Solely encrypting the home directory would leave these sensitive data vulnerable
Lastly, Docker containers, which store and run client code, are to be considered secret.
Accessing these containers from personal environments is prohibited to maintain a robust security structure, preventing any potential cross-access and preserving the integrity of our client's data.

As for personal/work separation, we recommend using a separate machine (Virtual or physical) or dual-booting.
It is not recommended, but you may use multi-user setup to isolate personal and work-related applications, but take special care as it is hard to prevent personal accounts, with for example, `docker` access from accessing ANY other account on the system.

# System setup

If you are undecided, by default we recommend going with Virtual Machine setup.

As for the work environment Operating System, we recommend using a Linux-based system.
Guide itself is written with Ubuntu-based distros (e.g. [Linux Mint](https://www.linuxmint.com/download.php)) in mind.
Using such will help save time, but in the end, it is individual's responsibility to maintain a productive working environment.
For Windows users, Microsoft Defender Antivirus must be enabled.

## 1. Virtual Machine setup

Expand Down
2 changes: 1 addition & 1 deletion docs/Storage_Encryption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Due to the large space utilization of our projects, the minimum storage size is

### Virtual machine

In any Virtual Machine, you can achieve FDE-like setup by putting the VM image on an Encrypted Volume created using [VeraCrypt or similar software](#volume-encryption).
In any Virtual Machine, you can achieve FDE-like setup by putting the VM image on an Encrypted Volume created using [VeraCrypt or similar software](#volume-encryption) or directly in VirtualBox by using the [VirtualBox Extension Pack](https://docs.oracle.com/en/virtualization/virtualbox/7.0/user/AdvancedTopics.html#diskencryption).

### Windows

Expand Down