"Reducing the blast radius" docs page

[ptgott]

Details

Per a meeting with @klizhentas, this will be a page within a new /docs/setup section related to security. It will focus on how to limit the potential damage any Teleport security breaches. Each topic will explain a best practice for setting up Teleport to contain certain kinds of attack, and will describe the attack vectors it will protect your Teleport deployment from.

Topics include:

• Making MFA mandatory
• Turn on per-session MFA for everything
• Dual-authorization administrative access set up for root accounts. Uses MFA and requires approval from two people to assume that role.
• Set up deny rules in Teleport RBAC that will prohibit anyone who is not from a team from ever becoming, or even requesting, an admin role.