Centralized vulnerability management
Vulnerabilities are a common weakness that attackers exploit. Vulnerability management includes identifying, assessing, prioritizing, and remediating vulnerabilities, along with continuous scanning. Managing vulnerabilities in the cloud reduces server weaknesses and exposure to risks. This improves your overall security.
Priority
High
Bad practices
Lacking a comprehensive vulnerability management plan. A plan should cover detection frequency, assessment standards, remediation workflows and responsibilities, and emergency response procedures.
Managing vulnerabilities for each account separately in a multi-account architecture. This approach increases management costs and prevents a consistent security baseline across the organization.
Remediating vulnerabilities without first considering factors such as the risk level and scope of impact. This can disrupt the stability of your online business.
Implementation guide
Understand the shared responsibility model for cloud security. In this model, Alibaba Cloud secures the cloud platform and manages its vulnerabilities. You are responsible for vulnerabilities in your own workloads.
You can use Security Center to manage workload vulnerabilities. The vulnerability management feature in Security Center automatically discovers your servers and assets. You can configure automatic vulnerability scan tasks to detect vulnerabilities. Security Center also provides a comprehensive score and priority for each vulnerability. This score is based on factors such as risk level, exploitability, and exposure duration.
For operating system vulnerabilities, you can use Security Center to apply one-click fixes. Before you apply a fix, review the remediation notes. Create a snapshot of the operating system to allow for a rollback.
For application vulnerabilities, you can use Security Center to view remediation suggestions, vulnerability details, and the scope of impact. You can also use the Application Protection feature. This feature is based on Runtime Application Self-Protection (RASP) technology. It identifies and blocks attacks based on real-time context. It protects your web application processes on hosts from application vulnerabilities, 0-day vulnerabilities, and In-memory webshell attacks.
For container image vulnerabilities, you can use Security Center to check for vulnerabilities and weaknesses in the images.
For emergency vulnerabilities, you can use Security Center to quickly scan your assets. Emergency vulnerabilities are high-risk or 0-day vulnerabilities that are identified in intelligence reports from the Alibaba Cloud security team. Security Center detects whether your servers are affected by these high-risk vulnerabilities. It can also integrate with the firewall's virtual patching feature for rapid defense. This provides proactive prevention and real-time emergency response.
In a multi-account architecture, you can use the multi-account management feature of Security Center. This feature lets you centrally manage security and configure protections for multiple Alibaba Cloud accounts and resource accounts. It also detects security risks in each member account in real time.
Manage base images centrally to ensure they are secure. In large-scale deployments, organizations often face challenges because different business units might build images in their own accounts. This practice prevents a unified security baseline and creates security risks. Distributing images across multiple regions and accounts is also difficult. Alibaba Cloud recommends a golden image strategy. Build and manage images centrally in a dedicated shared account, and restrict which image IDs application accounts can use. This prevents the use of non-compliant images. You can use resource sharing and automation to distribute images to all Alibaba Cloud accounts quickly and in batches. This improves efficiency. For more information, see Multi-account Golden Image Solution.
Automate patch management and vulnerability remediation.
You can use the Task Hub in Security Center to create scheduled vulnerability remediation tasks. This lets you automate fixes for specific vulnerability types, risk levels, and server groups.
You can automate Operations and Maintenance (O&M) for system patches. This allows for centralized scanning, monitoring, and installation of host patches. For more information, see Automate O&M for host operating system patches using OOS.