Privacy and Security Dos and Don’ts

[Ryan.Paredez]

What do I need to know about security protocols in the AppDynamics Community? 

The Community exists as a forum for AppDynamics' technical community to share information and knowledge. To support that exchange, we each need to act on the awareness of our mutual responsibility to consider the information we share. 

Use this post as a guide—along with your own judgment and your organization's security and privacy policy—when starting or contributing to discussions in the community.  And do also let your fellow members know if they’ve accidentally shared information that could have security or privacy risks.

In this article…

Security Dos | Security Don'ts | Personally Identifiable Information (PII) | Security Don't Examples | Additional Resources

---

Security Dos

We encourage safe community engagement while making sure everyone is being safe about it. Here are a few security “Dos” to keep in mind and follow.

• Remember! This is a public community; anyone can see what you write even if they are not signed in
  
• Know your organization's security and privacy policies
  
• Redact any sensitive information in whatever you share
  
• Before you hit “post,” review what you’re about to share. Ask yourself: “Could this information create a risk for any individuals, or for your company?”
  
  Have doubts? Review the Security Don’ts.
  
  
• Watch out for each other!  If you see a message that seems to have content that could be a security or privacy risk, send the poster a Private Message or reach out to a Community Manager. You can also mark the post or reply as inappropriate content and we’ll take care of it.

Security Don’ts

The Don’ts list is much longer than the Dos, but we promise these are important points! We highly suggest you read and understand them. 

We’ve aimed to make it thorough though it can’t cover every possibility — so use your best judgment.

• Don’t share log files. If you need to, make sure they're sanitized, with all sensitive data removed
• Don’t share password-protected code 
• Don’t share tokens, passwords, or any authentication details
• Don’t share keys — including, but not limited to the examples below under Example of Security Don’ts
• Don’t share authorization details (e.g., Authorization: Basic; Authorization: Bearer)
• Don’t share server names
• Don't share your Controller username 
• Don’t share your Controller account name
• Don’t share IP addresses
• Don’t share anything your company considers proprietary or confidential

Personally Identifiable Information (PII)

PII can be any data that could potentially identify a specific individual. Be respectful of others by not sharing anyone's personally identifiable information (PII) in the Community. We recommend not sharing yours either. 

Examples of PII may include (but are not limited to):

Email addresses	Full names	Company name
Phone Numbers	Date of birth	Government Identifier numbers
User IDs	Home/work address	IP addresses

Examples of Security Don’ts 

Description	Examples of 'Security Don'ts'
.NET Agent log file	1488 ApDynamics.Coordinator 1 8 Info ConfigurationManager Site = default website Default App Pool = ASP.NET v4.0 DefaultAppPool App / = ASP.NET v4.0 DefaultAppPool App /myappAPI = AppAPIAppPool App /myappXYZ = ASP.NET v4.0 DefaultAppPool App /customLookup = ASP.NET v4.0 CustLookup App /myAppUI = MyappUI App Pool 4565 instrumentedprocess.exe Info ConfigurationChannel [Name:windows-process-id, Value:7084] 4565 instrumentedprocess.exe Info ConfigurationChannel [Name:dotnet-os-ver, Value:Microsoft Windows NT 6.1.7601 4565 instrumentedprocess.exe Info ConfigurationChannel [Name:clr-architecture, Value:x86] 4565 instrumentedprocess.exe Info ConfigurationChannel [Name:process-identity, Value:NT AUTHORITY\SYSTEM] 4565 instrumentedprocess.exe Info ConfigurationChannel [Name:configuration-file, Value:D:\Program Files (x86)\MyCompany\bin\InstrumentedProcess.exe.config] 4565 instrumentedprocess.exe Info RegistrationChannel setting agent version [4.5.13.0 compatible with 4.4.1.0] 4565 instrumentedprocess.exe Info RegistrationChannel setting unique host information Host Name [InternalServerName] 4565 instrumentedprocess.exe Info LifetimeManager .NET Version: 4.0.30319.42000 4565 instrumentedprocess.exe Info ManagedAgentAPI mscorlib version: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 4565 instrumentedprocess.exe Info ManagedAgentAPI mscorlib file version: 4.7.3416.0 built by: NET472REL1LAST_B 4565 instrumentedprocess.exe Info XMLConfigManager Default IP Address Resolver found IP addresses [[70.38.194.155]] 4565 instrumentedprocess.exe Info XMLConfigManager XML Controller Info Resolver found controller host [mycompany.saas.appdynamics.com] 4565 instrumentedprocess.exe Info ManagedAgentAPI CLR bitness is not 64-bit 4565 instrumentedprocess.exe Info XMLConfigManager XML Controller Info Resolver found controller port [443]
AWS Access Keys	AKIAIOSFODNN7EXAMPLE AWS_ACCESS_KEY_ID=xxxx
AWS Secret Access Key	wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY AWS_SECRET_ACCESS_KEY=yyyy
Authorization	Authorization: Basic Authorization: Bearer
RSA Private Keys	----BEGIN RSA PRIVATE KEY----  (Key data would be here) ----END RSA PRIVATE KEY----
SSH (OPENSSH) Keys	----BEGIN OPENSSH PRIVATE KEY----  (Key data would be here) ----END OPENSSH PRIVATE KEY----
SSH (DSA) Private Keys	----BEGIN DSA PRIVATE KEY---- (Key data would be here) ----END DSA PRIVATE KEY----
SSH (EC) Private Keys	----BEGIN EC PRIVATE KEY---- (Key data would be here) ----END EC PRIVATE KEY----
PGP Private Key Block	----BEGIN PGP PRIVATE KEY BLOCK----  (Key data would be here) ----END PGP PRIVATE KEY BLOCK----
Server Names	Named according to your company's schema
Controller Username	The URL that provides access to your AppDynamics' instance
Controller Account Name	https://<account-name>.saas.appdynamics.com/controller/#/accountName=<account-name>
IP Addresses	172.16.254.1

Additional Resources

• Who are your Community Managers?
• Terms of Use
• Code of Conduct