'Security overview for web sites' page suggestions

[galund]

Some suggestions/critique regarding the security overview for web sites page:

general:

• there's a lot on this page, and in some cases the info could be better put on a more specific page (that may or may not exist yet)
• we should think about who we expect to be using this page, and when, in the development lifecycle

Specific:

Points 2 and 3 are about DNS and we have a page about DNS - tweaks in progress at the moment: we could move this guidance in there

point 2 - written quite generically, but can we not write specific guidance about how to configure Route 53?

point 7 seems to have a non-sequitur about access control in a point about CDNs (which is a really good point, but with point 8 could definitely live in a whole page about serving static assets properly)

point 14 re having a cut-down backup static origin: as far as services GDS will build is concerned, ISTM this is likely only to be worthwhile for GOV.UK proper, but maybe I'm having an imagination failure