docs: add new security doc to best practices section (#15805)

EdwardAngert · EdwardAngert · spikecurtis · web-flow · commit 74f07ec9ae7b · 2024-12-16T20:47:38.000Z
[preview](https://coder.com/docs/@bp-security/tutorials/best-practices/security-best-practices) --------- Co-authored-by: EdwardAngert <2408959-EdwardAngert@users.noreply.gitlab.com> Co-authored-by: EdwardAngert <17991901+EdwardAngert@users.noreply.github.com> Co-authored-by: Spike Curtis <spike@coder.com>
diff --git a/docs/admin/monitoring/index.md b/docs/admin/monitoring/index.md
@@ -1,7 +1,7 @@
 # Monitoring Coder
 
-Learn about our the tools, techniques, and best practices to monitor Coder your
-Coder deployment.
+Learn about our the tools, techniques, and best practices to monitor your Coder
+deployment.
 
 ## Quick Start: Observability Helm Chart
 
diff --git a/docs/admin/security/database-encryption.md b/docs/admin/security/database-encryption.md
@@ -185,3 +185,7 @@ To delete all encrypted data from your database, perform the following actions:
 - Decryption may fail if newly encrypted data is written while decryption is in
   progress. If this happens, ensure that all active coder instances are stopped,
   and retry.
+
+## Next steps
+
+- [Security - best practices](../../tutorials/best-practices/security-best-practices.md)
diff --git a/docs/admin/security/index.md b/docs/admin/security/index.md
@@ -1,4 +1,11 @@
-# Security Advisories
+# Security
+
+<children></children>
+
+For other security tips, visit our guide to
+[security best practices](../../tutorials/best-practices/security-best-practices.md).
+
+## Security Advisories
 
 > If you discover a vulnerability in Coder, please do not hesitate to report it
 > to us by following the instructions
diff --git a/docs/admin/security/secrets.md b/docs/admin/security/secrets.md
@@ -1,17 +1,20 @@
 # Secrets
 
-<blockquote class="info">
-This article explains how to use secrets in a workspace. To authenticate the
-workspace provisioner, see <a href="../users">this</a>.
-</blockquote>
+Coder is open-minded about how you get your secrets into your workspaces. For
+more information about how to use secrets and other security tips, visit our
+guide to
+[security best practices](../../tutorials/best-practices/security-best-practices.md#secrets).
 
-Coder is open-minded about how you get your secrets into your workspaces.
+This article explains how to use secrets in a workspace. To authenticate the
+workspace provisioner, see the
+<a href="../provisioners.md#authentication">provisioners documentation</a>.
 
 ## Wait a minute...
 
-Your first stab at secrets with Coder should be your local method. You can do
-everything you can locally and more with your Coder workspace, so whatever
-workflow and tools you already use to manage secrets may be brought over.
+Your first attempt to use secrets with Coder should be your local method. You
+can do everything you can locally and more with your Coder workspace, so
+whatever workflow and tools you already use to manage secrets may be brought
+over.
 
 Often, this workflow is simply:
 
@@ -111,3 +114,7 @@ workspace.
 
 Refer to our [HashiCorp Vault Integration](../integrations/vault.md) guide for
 more information on how to integrate HashiCorp Vault with Coder.
+
+## Next steps
+
+- [Security - best practices](../../tutorials/best-practices/security-best-practices.md)
diff --git a/docs/manifest.json b/docs/manifest.json
@@ -761,6 +761,11 @@
 					"description": "Guides to help you make the most of your Coder experience",
 					"path": "./tutorials/best-practices/index.md",
 					"children": [
+						{
+							"title": "Security - best practices",
+							"description": "Make your Coder deployment more secure",
+							"path": "./tutorials/best-practices/security-best-practices.md"
+						},
 						{
 							"title": "Organizations - best practices",
 							"description": "How to make the best use of Coder Organizations",
diff --git a/docs/tutorials/best-practices/security-best-practices.md b/docs/tutorials/best-practices/security-best-practices.md
