How to protect data security on the cloud-Alibaba Cloud Security Guide-阿里云帮助中心

You should prioritize data security when you run your business on the cloud or use cloud services for data storage. Data on the cloud can include business information, technical data, personal information, and operations and maintenance (O&M) data. This data can exist in various forms across different Alibaba Cloud services. Data security is vital to your business, your customers, and public safety. This topic describes how to protect your data across five stages of its lifecycle: collection, transmission, storage, use, and destruction.

1. Classify and categorize data during collection to determine its security level

Data classification is the foundation of data security. A robust classification system greatly improves the effectiveness of your data security measures.

The national standard "Data Security Technology - Rules for Data Classification and Grading" (GB/T 43697-2024) takes effect on October 1, 2024. This standard specifies the principles, framework, methods, and processes for data classification. It also provides guidance on how to classify data across various industries and fields. We recommend that you classify data into three levels from highest to lowest: core data, important data, and general data. This classification is based on the importance of the data and the potential harm that could be caused by a data breach, tampering, or corruption. The following table shows the recommended classification from the national standard.

image (2).png

You can also use the sensitive data classification feature in Alibaba Cloud Data Security Center. You can integrate your data sources with Data Security Center to scan for sensitive data in your assets. Then, you can classify the data using built-in industry templates, such as templates for the internet or Internet of Vehicles industries, or by creating custom templates. Data Security Center supports various data source types, such as RDS, Object Storage Service (OSS), and big data.

2. Encrypt data during transmission to prevent data breaches

All Alibaba Cloud services use the SSL/TLS protocol by default to secure data transmission for customer access, including data reads and uploads.

OSS: OSS supports access over both HTTP and HTTPS by default. We recommend that you force anonymous users to use HTTPS for all requests to resources in the target bucket.
RDS: We recommend that you use a cloud certificate to quickly enable Secure Sockets Layer (SSL) encryption. This encrypts network connectivity and secures the data transmission link.
MaxCompute: API operations use the HTTPS protocol by default. This means that all data interactions through API operations are encrypted with SSL/TLS to ensure security during transmission. We recommend that you keep this setting.
SLB: You can upload your own SSL Certificate to an SLB instance or use the free SSL Certificate provided by Alibaba Cloud. This allows SLB to encrypt and decrypt HTTPS requests to protect data during transmission.

3. Encrypt data at rest to prevent unauthorized use after a data breach

After you classify your data, you should encrypt sensitive data that has a high security level. This serves as the last line of defense against a data breach.

Alibaba Cloud provides data-at-rest encryption for its services and uses Key Management Service (KMS) for centralized key management. You can encrypt data using keys that are automatically generated by KMS or by importing your own keys into KMS. With KMS, you can track key usage and configure automatic key rotation policies.

Disk encryption

You can use the ECS data encryption application. When you create an ECS instance and select a system disk or data disk, or when you create a data disk separately, you can select the encryption option for the disk. After the disk is created, data in the operating system of the ECS instance is automatically encrypted on the host where the disk resides. Disk encryption uses the industry-standard AES-256 encryption algorithm and uses KMS for encryption. You do not need to build and maintain your own key management infrastructure. With the disk encryption feature, data transferred from an ECS instance to a disk is automatically encrypted and then automatically decrypted when it is read. The encryption and decryption operations occur on the host of the ECS instance.

Transparent data encryption (TDE)

After you enable Transparent Data Encryption (TDE) in the console or using an API, TDE performs real-time I/O encryption and decryption on data files. TDE performs data-at-rest encryption at the database layer. This prevents attackers from bypassing the database to read sensitive information from storage. Similar to disk encryption, TDE uses keys that are generated and managed by KMS. When the database starts, it retrieves the Key Encryption Key (KEK) from KMS to decrypt the Data Encryption Key (DEK). The decrypted DEK is then stored in memory to encrypt and decrypt data during read and write operations.

Object Storage Service (OSS)

OSS supports server-side encryption and client-side encryption.

You can use server-side encryption to encrypt data within OSS, with the keys managed by OSS or KMS. This method is ideal for scenarios with high security requirements that do not require frequent access to encryption keys because it simplifies key management. You can encrypt an existing bucket directly or set server-side encryption when you upload files to OSS.

You can use client-side encryption to have the client, such as an application or a user, encrypt data before uploading it to OSS. The decryption process also occurs on the client side. This method is suitable for cross-cloud or multicloud environments, highly sensitive data, compliance requirements, or situations where only a specific entity is authorized to decrypt the data. You can also use KMS to host customer master keys (CMKs) for client-side data encryption. In this case, you do not need to provide any encryption keys to the OSS encryption client. You only need to specify the KMS CMK ID when you upload an object.

4. Mask data during use to reduce its sensitivity

During data processing, exchange, and display, you should mask core data, important data, and high-value business data to reduce the risk of data breaches. Data masking processes sensitive data to hide its real value and replace it with a virtual value, while preserving the original format.

Data masking can be divided into static data masking and dynamic data masking. Static data masking uses masking algorithms to cover, encrypt, or replace sensitive data at rest. Dynamic data masking is used for real-time or online data query scenarios. Data is masked instantly upon query, which typically occurs at the database or middleware layer. This is usually achieved using methods such as field-level masking, row-level masking, and role-based masking.

Alibaba Cloud Data Security Center provides dynamic and static data masking capabilities. After you integrate your data with Data Security Center, you can create masking tasks in the console to mask your data.

5. Back up data during storage and use to ensure data integrity and availability

Data backup is a crucial part of data security management. It helps prevent data loss and corruption and improves business continuity and stability.

Backup content: Ensure that all critical business and personal data are included in backups. Data that is vital to your organization's operations should be prioritized for backup. You should also consider data sensitivity and legal compliance requirements. We recommend that you regularly back up business transaction data, service records, and sensitive data, such as personal names and phone numbers.
Backup cycle: Alibaba Cloud backup products typically allow you to choose a backup cycle by the hour, day, or week. Some data logs support backups at the minute or even sub-second level. You can select an appropriate backup cycle and retention period based on the importance and sensitivity of your business data.

In general, we recommend that you back up critical business data, transaction and activity logs, configuration information, and data subject to compliance requirements on a regular basis. Common backup features include the following:

ECS disk snapshots: Snapshots create a complete copy of the data blocks on a single disk or a disk group (consistency snapshot group) at a specific point in time. We recommend that you use snapshots to back up your disks periodically and retain them for a certain period. This lets you restore the entire disk when needed.
Cloud Backup for OSS: You can use Cloud Backup to back up objects in a bucket. If your objects are accidentally lost, you can restore them using Cloud Backup.
Automatic backup for RDS: RDS supports multiple backup methods. We recommend that you enable automatic backup for important instances to automatically back up data and logs.
Automatic backup for MaxCompute: MaxCompute enables the local backup feature by default. The system automatically backs up historical versions of data, such as data from before it was deleted or modified, and retains them for a specific period. You can quickly restore data within the retention period to prevent data loss from accidental operations.

6. Delete data promptly when it is no longer needed to prevent data breaches

When data is no longer needed, you should delete it promptly to avoid the risk of data breaches. You can delete the data yourself, release ECS instances, delete database instances, or close an account. Alibaba Cloud also deletes the data in accordance with the commitments in the terms of service.