Security framework overview
CloudBox is covered by the security guarantees and legal disclaimers of the Alibaba Cloud public cloud. It provides comprehensive security protection for infrastructure, network, data, and compliance.
Overview of security capabilities
Security capability | Description |
CloudBox physical devices are deployed in your data center. You are responsible for the security of the data center environment and the physical CloudBox devices. CloudBox also provides hardware reinforcement for the infrastructure, such as environmental monitoring, physical interface hardening, and system disk encryption, to further reduce physical security risks. | |
CloudBox uses secure and controllable network connections to connect to the public cloud. When connecting to an on-premises network, traffic must pass through your vSwitch. You can use measures such as Access Control Lists (ACLs) and firewalls to enhance security. CloudBox also supports integration with Alibaba Cloud security products, such as Security Center and Anti-DDoS, to protect services in CloudBox from internal and external network security threats. | |
CloudBox and related cloud products provide capabilities to ensure data security for data transmission, data storage, data access, data backup, and data protection. | |
Use Resource Access Management (RAM) for access control. RAM supports identity authentication using methods such as AccessKeys. It also supports using access policies to control account permissions for accessing and operating cloud resources to ensure the secure use of cloud resources. | |
Alibaba Cloud provides various services for monitoring and log auditing, such as Cloud Monitor and ActionTrail. These services help you monitor the usage of your cloud resources and the status of your business in real time. They also help you respond promptly to abnormal alerts. |
Shared responsibility
CloudBox follows the shared responsibility model of the Alibaba Cloud public cloud. However, you are also responsible for ensuring the security of the physical environment, facilities, and the on-premises network environment.
Alibaba Cloud security responsibilities
Alibaba Cloud is responsible for the security of its infrastructure, including the distributed cloud operating system and cloud service products. Alibaba Cloud also provides technical capabilities to help you protect your cloud applications and data. Alibaba Cloud's responsibilities include the following:
Security of the cloud platform software on CloudBox: Ensuring the security of cloud service products and their underlying dependencies, promptly discovering and fixing security vulnerabilities, properly configuring the cloud platform, continuously performing risk assessments, and detecting and preventing intrusions against the platform and cloud service products.
Network border security for the connection between CloudBox and the central cloud: Preventing intrusions into the central cloud or CloudBox through the cloud connection.
Access control and maintenance management security: Ensuring that daily remote operations and maintenance (O&M) and data privacy comply with the standards and procedures of the Alibaba Cloud public cloud and do not involve your business data. Taking measures to ensure the security of your business data during device repair, scale-out, and decommissioning.
Providing security products and solutions for authentication, authorization, auditing, security protection, and data protection.
User security responsibilities
CloudBox physical servers are deployed in your on-premises data center, and you are responsible for creating the public network entry point. In addition to your security responsibilities for the public cloud, you are also responsible for ensuring the security of the physical environment, facilities, and the on-premises network environment.
Security organization and personnel: Defining responsible departments, owners, and contacts to strengthen network security threat monitoring and response. Defining security policies and creating internal security management systems and operational procedures to ensure their implementation.
Physical and environmental security: Ensuring the security of the physical environment where CloudBox operates. This includes implementing access control, monitoring, and other preventive measures to prevent adjacent network and physical attacks or damage. It also includes preventing damage to the physical link of the cloud connection, retaining logs, and cooperating with Alibaba Cloud audits.
Network communication security: When you connect to the public network, you are responsible for protecting against security threats from the Internet. You must maintain the security of virtual networks, virtual servers, self-built applications, and your own data. You must also maintain security policies, fix vulnerabilities, and implement network and information security protection measures in accordance with classified protection requirements, industry security standards, and Alibaba Cloud security best practices.
Configuration security: Correctly understanding and using the features of cloud products, and following the security configuration recommendations for cloud products to prevent security risks caused by insecure configurations and usage.
Data protection: Implementing security management measures for your business data, such as data classification and protection, and fulfilling compliance obligations such as data export assessments.
Access control and maintenance management security: Maintaining user identities and roles, managing resource access permissions, and safeguarding cloud resource access credentials. Content security: You are responsible for managing the security of content stored and transmitted on CloudBox to prevent it from being used for criminal activities or for disseminating illegal information.
Security compliance and standards adherence
Alibaba Cloud is responsible for ensuring security compliance and standards adherence at the CloudBox product level. You are responsible for ensuring security compliance and standards adherence at the business system level built on CloudBox.
Classified protection compliance
CloudBox meets the Level 3 requirements of the Classified Protection of Cybersecurity scheme for the secure computing environment.
Security certifications
CloudBox has obtained multiple certifications from internationally recognized certification bodies. These certifications cover information security and privacy, quality and service management, business continuity, and cloud security. They include ISO 27001, ISO 27701, ISO 27017, ISO 27018, CSA STAR, ISO 9001, ISO 20000, ISO 22301, BS10012, ISO 27799, and ISO 29151.