Data security

Local data residency

Local data residency means that CloudBox ensures transparency when your service data is processed and transmitted within your corporate domain. CloudBox notifies you of potential data transfers to the public cloud and provides methods to prevent them. User service data is any data that you generate, process, store, upload, download, or distribute using CloudBox services. This includes data in databases, disks, Object Storage Service (OSS), and logs, along with your images and data in memory.

The following figure shows a CloudBox deployment.

The following sections describe specific scenarios where CloudBox involves cross-domain data transmission:

• Cross-domain transmission of CloudBox system data

  CloudBox system data includes configuration data, O&M data, status data, log data, authentication and authorization data, billing and metering data, and downstream control commands generated by the cloud operating system and cloud products. CloudBox must exchange this data with the public cloud to provide services.

  CloudBox provides a Communication Checklist that lists and clarifies this communication data. An independent third-party organization has verified the communications in a real-world environment against the Communication Checklist and provides test reports stamped by ITSEC, CMA, ILAC, and CNAS. If needed, you can obtain the Communication Checklist and test reports from the CloudBox product team.

  CloudBox records system data communication logs. You can subscribe to and query these audit logs in the CloudBox console.

• Cross-domain data transmission caused by product features

  Cloud product features such as data backup, replication, and data sharing may transfer user service data to the public cloud. The following table lists scenarios where some cloud products transmit user service data across domains. Before you use other cloud products, consult the CloudBox product team about their cross-domain data transmission behavior.

  Product	Features that cause cross-domain data transmission	Method for local data residency
  Elastic Compute Service	ECS snapshot and custom image features. When you use snapshots or custom images, if you have not purchased OSS resources in CloudBox, public cloud OSS resources are used for storage. This causes disk data to be uploaded to the public cloud.	Purchase OSS resources in CloudBox to store snapshots or custom images in a local OSS on CloudBox bucket.
  ApsaraDB RDS for MySQL	RDS backup and recovery feature. After an RDS instance is created, if you have not purchased OSS resources in CloudBox, data and logs are automatically backed up to OSS in the same region of the public cloud. This feature is enabled by default and cannot be disabled. This causes data to be transmitted to the public cloud.	Purchase OSS resources in CloudBox to store backup files in a local OSS on CloudBox bucket.
  Tair (Redis OSS-compatible)	Redis backup and recovery feature. After a high-availability Redis instance is created, if you have not purchased OSS resources in CloudBox, Redis data is automatically and periodically backed up to public cloud OSS. You can also perform manual backups. The automatic backup feature is enabled by default and cannot be disabled. This causes data to be transmitted to the public cloud.	Purchase OSS resources in CloudBox to store backup files in a local OSS on CloudBox bucket.
  ApsaraDB for MongoDB	MongoDB backup and recovery feature. After a MongoDB instance is created, if you have not purchased OSS resources in CloudBox, data is automatically and periodically backed up to public cloud OSS. You can also perform manual backups. The automatic backup feature is enabled by default and cannot be disabled. This causes data to be transmitted to the public cloud.	Purchase OSS resources in CloudBox to store backup files in a local OSS on CloudBox bucket.

• User-initiated cross-domain data transmission

  For disaster recovery, cloud products that store user service data provide features to migrate, replicate, clone, back up, and share services and data. You must initiate these operations. During an operation, you must specify a destination region and zone, such as when you clone an ECS instance, or other parameters that point to a specific target, such as a destination database. If the target is not an object within CloudBox, such as a public cloud zone or database, the service or data is transmitted to the public cloud. It is important to understand the meaning of these target parameters and recognize that your operations may cause data to be migrated or transmitted to the public cloud.

  The products and features involved include but are not limited to the following operations:

  Product	Operations that cause cross-domain data transmission
  Elastic Compute Service	Clone instance Disk disaster recovery Change instance type across zones Share custom image
  ApsaraDB RDS for MySQL	Migrate to another zone Data migration solutions overview Cross-region data recovery
  Tair (Redis OSS-compatible)	Data migration Data synchronization
  ApsaraDB for MongoDB	Migrate to another zone Data migration and synchronization

• Cross-domain data transmission caused by cross-domain user service deployment

  If you enable services and deploy applications in both the public cloud and CloudBox, business data must be transmitted between them. In this scenario, you must plan the deployment and storage locations for your services and data, along with their access relationships. You must also configure data plane identity authentication, access control, and security policies to prevent unexpected cross-domain data transmission.

• CloudBox server decommissioning and data cleanup

  User service data stored in CloudBox is written to physical storage media. When you unsubscribe from a service or return a device for factory repair, server software is used to erase the physical storage media before the device is decommissioned. If a server or disk fails and the disk cannot be erased on-site, the device is shipped back to an Alibaba Cloud factory. With your consent, the data is physically erased or destroyed through a secure process.

Authentication and control for data resource access

Verifying the identity of users who access data resources and restricting their access permissions helps prevent data breaches from unauthorized or escalated access. For example, if you set an OSS Bucket to public read, anyone can download the files in the bucket.

Most cloud products, such as OSS, provide identity authentication and access control features based on Resource Access Management (RAM). Other products, such as ApsaraDB RDS for MySQL, provide these features within the application. You must configure identity authentication and access control policies according to the documentation for RAM and the specific cloud product to prevent unauthorized access to your data.

Data storage encryption

To improve the security of your stored data, CloudBox provides encryption features based on the capabilities of various cloud products. The following table provides references for some products:

Data backup

Backing up your data is essential for disaster recovery. Most cloud products in CloudBox that store user data have backup features. These features typically allow you to seamlessly back up data from CloudBox to the public cloud. The following table provides references for some products:

Database protection

Databases manage data in advanced and complex ways. Improper configuration and protection can lead to data breaches. Common attacks include brute-force attacks, SQL injection, and application vulnerabilities. You should provide additional protection for your databases.

• Alibaba Cloud DataBase Audit helps you monitor and audit cloud database products and self-managed databases. It records and sends alerts for risky database behaviors, such as SQL injection and risky operations, to protect your core data. It provides comprehensive security diagnosis, maintenance, and management for databases. DataBase Audit uses a bypass listener mode and can be deployed independently of the database. This deployment method does not affect database performance. For more information, see DataBase Audit.

• Alibaba Cloud Firewall also provides features to detect and block database attacks. It addresses threats such as brute-force attacks, database application vulnerabilities, malicious file read/write operations, command execution, information theft, and data exfiltration. For more information, see Best practices for database protection.

Ransomware prevention

Ransomware typically spreads through email, Trojans, and other methods. It encrypts files on a local computer and then extorts the user by holding the data hostage.

Security Center provides real-time interception for common ransomware, cryptomining viruses, and DDoS Trojans. It offers one-click defense against known ransomware. It also uses bait folders to detect and remove unknown ransomware. Additionally, you can use the Write Once Read Many (WORM) feature of OSS to ensure that data cannot be deleted or modified. You can also enable versioning to prevent data in OSS from being accidentally deleted or overwritten.

Confidential computing

CloudBox supports optional server models for confidential computing. These include hardware platforms such as Intel SGX, Intel TDX, AMD SEV-SNP, and Hygon CSV. You can use ECS instances that support confidential computing to protect private data in scenarios such as data transactions, blockchain, joint risk control, joint marketing, joint model training, and model training and inference. You can also combine these instances with transparent encryption for data in transit and at rest to process highly sensitive data. Examples include sensitive data simulation, enterprise office cloud, and financial data processing.