# Plan Security Before you deploy Confluent Platform with Confluent for Kubernetes, plan how you handle authentication, authorization, network encryption, and sensitive configuration data. Confluent supports the following processes to enforce security: - Authentication - Authorization - Network encryption - Sensitive configuration data ## Authentication Choose one of the following methods for Apache Kafka® client authentication: * mTLS * Simple Authentication and Security Layer (SASL)/PLAIN * SASL/PLAIN with Lightweight Directory Access Protocol (LDAP), where the identity can come from your LDAP server ## Authorization Use Confluent role-based access control (RBAC) for authorization, with user and group identity coming from the LDAP server. ## Network encryption Use Transport Layer Security (TLS) to encrypt both of the following: * Internal traffic between Confluent Platform components * External traffic from clients to Confluent Platform components ## Sensitive configuration data Manage credentials, certificates, and other sensitive configuration values using Kubernetes Secrets. For details, see [Provide and Manage Sensitive Data for Confluent Platform in Confluent for Kubernetes](co-credentials.md#co-credentials). ## Production best practices As a best practice for security, enable mTLS or SASL/PLAIN with LDAP for authentication, RBAC for authorization, and TLS encryption for both internal and external traffic in production deployments. For a tutorial scenario to configure these security settings, see [Production recommended secure setup](https://github.com/confluentinc/confluent-kubernetes-examples/tree/master/security/production-secure-deploy).