Network security
CloudBox provides network security using secure cloud connections and network isolation. It also integrates with Alibaba Cloud security products to protect services in CloudBox from internal and external network threats.
Secure cloud connection
Connection methods and security
CloudBox can connect to the public cloud over an Express Connect circuit or the Internet.
Express Connect circuit: Uses a dedicated physical connection for each user. This ensures reliable and controllable data transmission. It prevents issues caused by unstable network quality and protects data from interception during transmission.
Internet: Connects to the public cloud over the Internet using Smart Access Gateway (SAG). It is easy to set up. It uses IPsec to encrypt network communications and supports multi-path redundancy and Quality of Service (QoS) control.
Enhanced control plane security
The control plane between CloudBox server endpoints and public cloud access points uses Transport Layer Security (TLS) for bidirectional identity authentication and communication encryption. This ensures the authenticity and legitimacy of communications. The public cloud side provides network access control and security protection measures.
Physical networking and isolation
The following describes the physical networking and isolation of CloudBox within an enterprise:
To provide services to the Internet, CloudBox must connect to the Internet through your corporate Internet gateway and use your public IP addresses. Place CloudBox behind the corporate external firewall. The external firewall manages the outermost layer of network access control. You can use a hybrid cloud firewall or security groups for more granular, inner-layer access control for Alibaba Cloud services. For DDoS traffic from the Internet, you can deploy a device that scrubs traffic or use the Alibaba Cloud Anti-DDoS service.
When CloudBox provides services to the corporate intranet, you do not need to deploy additional network protection devices between CloudBox and the intranet. An internal firewall is not required. If you are concerned about security or have internal compliance requirements, you can deploy an internal firewall between the CloudBox physical device and the corporate intranet. For enterprises whose network plan includes a demilitarized zone (DMZ), this is equivalent to deploying CloudBox in the DMZ.
User local area network security
Your corporate local area network (LAN) connects to the CloudBox Top of Rack (ToR) switch to allow mutual access with your VPC network inside CloudBox. After traffic leaves the CloudBox ToR switch, it enters your physical network. It is not transmitted to the public cloud or the Internet. This network traffic is not authenticated or encrypted. You must use secure application-layer protocols or ensure the security of your LAN to reduce the risk of internal network attacks and data breaches.
For user virtual machines (VMs) in a VPC, use security groups to grant the minimum required permissions for IP address and port access. For more information about security groups, see Security group overview.
Alibaba Cloud services, such as Object Storage Service (OSS) and ApsaraDB RDS, provide secure access protocols such as HTTPS. Use secure protocols to access Alibaba Cloud services.
The following table provides references for some products.
Cloud products
References
Elastic Block Storage
ApsaraDB RDS for MySQL
ApsaraDB RDS for PostgreSQL
Tair (Redis OSS-compatible)
ApsaraDB for MongoDB
Network security products
CloudBox provides the same network security protection capabilities as the public cloud. You can deploy Alibaba Cloud security products to protect services in CloudBox from internal and external network threats. Based on the guidelines for Multi-Level Protection Scheme (MLPS) 2.0 Level 3, you can use the relevant Alibaba Cloud security products for security hardening.
Scenario | Cloud Security Products | Description |
Network border security | Protects ECS instances and Alibaba Cloud services from threats from the Internet. It provides network access control, mitigates vulnerability exploits, prevents SQL injection, ensures API security, provides bot protection, and performs intrusion prevention and traffic audit. Cloud Firewall can also manage traffic between your corporate intranet and VPCs, and manage traffic between ECS instances to achieve micro-segmentation. | |
Intercepts and protects against DDoS flood attacks from the Internet. It effectively mitigates service disruptions caused by attacks. | ||
Host intrusion and malware prevention | Uses an agent on the client (requires you to install the client on your instances) and a central Threat Detection Service platform. It provides network and host intrusion prevention, vulnerability and trojan detection, vulnerability fixing, security configuration checks, security hardening, and security assessments for Alibaba Cloud product configurations. | |
System administration and audit | Provides a unified, efficient, and secure O&M channel. It centrally manages asset permissions and monitors all operation behaviors. This ensures that cloud O&M identities are identifiable, permissions are controllable, threats are blockable, and operations are auditable. | |
Data security | Effectively detects structured and unstructured sensitive data. It provides security audit, data masking, data encryption, and AccessKey pair credential hosting. This resolves data security issues throughout data lifecycle, including secure data transmission, data classification, data audit, and data encryption. It also meets the business requirements for compliance with Chinese national cryptographic standards. |