> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/gridgain/gridgain-9/security.md).

# Security

Secure a GridGain 9 cluster with SSL/TLS encryption, user authentication, role-based authorization, row-level security, and data encryption at rest.

This section describes how to secure a GridGain 9 cluster. It covers encrypting communication with SSL/TLS, authenticating users, controlling access with role-based authorization and row-level security, issuing JWT tokens, the full list of user permissions and roles, and encrypting data at rest with transparent data encryption.

## User Security

By default, all users can perform any updates on the cluster, or [upload arbitrary code to the cluster](/docs/gridgain/gridgain-9/gridgain9-development/distributed-computing-and-services/code-deployment.md) and perform remote code execution with [distributed computing](/docs/gridgain/gridgain-9/gridgain9-development/distributed-computing-and-services/distributed-computing/about-distributed-computing.md). To improve security, we recommend configuring [user roles](/docs/gridgain/gridgain-9/security/authentication-and-authorization/user-permissions-and-roles.md) and [enabling authorization](/docs/gridgain/gridgain-9/security/authentication-and-authorization/authentication.md#basic-authentication) on the cluster.

## Communication

By default, nodes use plain-text communication that is vulnerable to malicious actions. GridGain separates communications between cluster nodes and communication with clients.

### Node to Node Communication

Communication between nodes usually happens within the same data center. We recommend the following to improve the security of your cluster:

* Enable SSL for cluster communication with the `ignite.network.ssl` [node configuration](/docs/gridgain/gridgain-9/reference/configuration/node-configuration-parameters.md#network-configuration).
* Run the cluster in a trusted and isolated network.

### Node to Client Communication

Communication to clients is exposed to the internet. Only the client port (10800 by default) is exposed. To secure interaction with your clients:

* Enable SSL for client communication with the `ignite.clientConnector.ssl` [node configuration](/docs/gridgain/gridgain-9/reference/configuration/node-configuration-parameters.md#client-connector-configuration).
* Enable [authentication](/docs/gridgain/gridgain-9/security/authentication-and-authorization/authentication.md) on the cluster.

## In This Section

{% columns %}
{% column %}
{% content-ref url="/pages/vXTvSKVYCQpHHQjpIoJG" %}
[Authentication and Authorization](/docs/gridgain/gridgain-9/security/authentication-and-authorization.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Control who can connect to a GridGain 9 cluster and what they may do — authentication, JWT tokens, role-based authorization, permissions and roles, and row-level security.
{% endcolumn %}
{% endcolumns %}

{% columns %}
{% column %}
{% content-ref url="/pages/n0B5agEoJDPAMJ0Z2j4J" %}
[Encryption and Transport Security](/docs/gridgain/gridgain-9/security/encryption-and-transport.md)
{% endcontent-ref %}
{% endcolumn %}

{% column %}
Protect GridGain 9 data in transit and at rest — SSL/TLS for nodes and clients, and transparent data encryption.
{% endcolumn %}
{% endcolumns %}