in progress

Author: katarzyna-koltun-mx

content/en/docs/workstation/wks-security.md

@@ -12,28 +12,28 @@ Security is one of the most important aspects of a deployment, because misconfig
 
 This document describes the common aspects you should consider when deploying the Mendix Workstation Client in production.
 
-## Assigning Workspace Roles {#workspace-roles}
+## Assignment of Workspace Roles {#workspace-roles}
 
-Workspace roles should be assigned following the Principle of Least Privilege. Always grant users the minimum permissions necessary for them to successfully complete their tasks. Roles can be reassigned at any time if responsibilities change. To help maintain a secure deployment, consider the following guidelines:
+Workspace roles should be assigned following the principle of least privilege. Always grant users the minimum permissions necessary for them to successfully complete their tasks. You can reassign the roles at any time if responsibilities change. To help maintain a secure deployment, consider the following guidelines:
 
-- Assign the View Only role to untrusted users
-- Use caution when granting the Workspace Admin role
-  - Workspace Admins can unintentionally disrupt production, for example by deleting an app or modifying its public key
-  - Workspace Admins can allow Workstation Clients to access malicious apps
-- Conduct regular permissions audits to make sure that temporary privilege elevations are reverted once they are no longer necessary
+* Assign the View Only role to untrusted users
+* Use caution when granting the Workspace Admin role
+    * Workspace Admins can unintentionally disrupt production, for example by deleting an app or modifying its public key
+    * Workspace Admins can allow Workstation Clients to access malicious apps
+* Conduct regular permissions audits to make sure that temporary privilege elevations are reverted once they are no longer necessary
 
 ## Setting up Stations {#setup-stations}
 
 Setting up stations involves a variety of options, some of which have important security implications. To help ensure a secure deployment, follow these best practices:
 
-- Keep stations lean by disabling unused apps and deleting unused devices
-  - Any unused device represents a potential attack surface (e.g., a forgotten card reader that leaks a token, or a tcp device that exposes a device on the network)
-  - Any unused but enabled app may gain unintended access to devices that were not meant to be exposed to it
-- Verify that all devices configured on a station are safe for all enabled applications
-  - Devices are shared across all applications in a station. If a device should not be accessible by a particular app, it should not be present on that station.
-- Configure File devices carefully
-  - File devices are powerful and can pose security risks if misconfigured
-  - Restrict the allowed folder and permissions as much as possible. The Workstation Client enforces these restrictions within the allowed folder and its subfolders.
+* Keep stations lean by disabling unused apps and deleting unused devices
+    * Any unused device represents a potential attack surface (e.g., a forgotten card reader that leaks a token, or a tcp device that exposes a device on the network)
+    * Any unused but enabled app may gain unintended access to devices that were not meant to be exposed to it
+* Verify that all devices configured on a station are safe for all enabled applications
+    * Devices are shared across all applications in a station. If a device should not be accessible by a particular app, it should not be present on that station.
+* Configure File devices carefully
+    * File devices are powerful and can pose security risks if misconfigured
+    * Restrict the allowed folder and permissions as much as possible. The Workstation Client enforces these restrictions within the allowed folder and its subfolders.
 
 ## Restricting Configuration Folder Access {#config-access}
 
@@ -43,8 +43,8 @@ By default, the Windows global installer for the Workstation Client grants the B
 
 The BUILTIN\Users group includes all standard user accounts on the system. Restricting its write access helps prevent the following:
 
-- Compromised accounts from modifying configuration files
-- Unauthorized users from deregistering the station, temporary halting production
+* Compromised accounts from modifying configuration files
+* Unauthorized users from deregistering the station, temporary halting production
 
 By delegating permissions to a more tightly controlled group, you ensure that only authorized accounts have the ability to modify the configuration and to use the Workstation Client.