# Hardening Konnect: A 24-Point Deployment Checklist

Most API gateway deployments have at least one of these: HTTP still running somewhere. A database password in a config file. No rate limiting on admin-facing routes. No audit logs.

None of these are exotic. All of them are how breaches start.

**What we’re covering:**

1. - Network & Transport Security
2. - Secrets & Credential Management
3. - Authentication & Access Control
4. - Gateway Hardening
5. - Observability & Defense
6. - Resilience & Infrastructure

Each section ends with a hands-on lab.

**Who should attend**

Dev and Ops teams running Konnect in production, or planning to. Security engineers validating their API gateway posture. Anyone who's wondered what 'hardened deployment' actually means in practice.

**No prior security expertise required.**

**Key takeaways:**

• - A 24-point hardening checklist mapped to your actual Konnect deployment — not a generic Kong Gateway guide.

• - Working API commands for every admin task: vault setup, RBAC scoping, rate limiting, and audit log export — ready to drop into your runbooks.

• - A clear line between what Kong manages for you (control plane, HA, cert rotation) and what you own (data plane config, org security settings) — so you know exactly where to focus.