Use automation for workload security protection
In cloud-native environments, security for workloads such as containers, virtual machines, and Serverless functions must shift from reactive response to proactive prevention. Automating tasks such as unified base image management, vulnerability remediation, patch updates, system maintenance, and configuration audits significantly reduces risks from human error. This automation also shortens security response times and helps meet compliance requirements.
Priority
Medium
Discouraged practices
Manually managing base images. This leads to different teams using different image versions and a lack of a unified security baseline.
Relying on manual scans and fixes. This practice results in long remediation cycles, incomplete fixes, and potential lateral movement by attackers.
Without an automated patching policy, patch updates rely on manual intervention by Operations and Maintenance (O&M) engineers or ad-hoc notifications.
Depending on manual checks for configuration audits. This allows configuration errors, such as open ports or weak passwords, to remain undetected and create security risks.
Implementation guide
Centrally manage base images. Automate the build process for secure and compliant base images, and enable their batch distribution and use. In large-scale deployments, enterprises often face challenges. For example, if different business units build images in their own Alibaba Cloud accounts, it prevents the enforcement of a unified security baseline, introduces business risks, and makes it difficult to distribute images across multiple regions and accounts. Alibaba Cloud recommends using a golden image solution. Build images in a separate, shared account for centralized control. Restrict the image IDs that application accounts can use to prevent the use of non-compliant images. Use resource sharing and automation to quickly distribute images in batches to all Alibaba Cloud accounts and improve efficiency. For more information, see Golden image solution for multiple accounts.
Use Security Center for automated vulnerability management.
Configure automatic vulnerability scan tasks to detect vulnerabilities.
Use the Task Hub in Security Center to create vulnerability remediation plans. Automate remediation for specific vulnerability types, severity levels, and server groups.
Use the Patch Management feature of CloudOps Orchestration Service (OOS) to automate operations and maintenance (O&M) for system patches. This feature meets O&M requirements for centralized scanning, monitoring, and installation of host patches. For more information, see Automate host OS patch O&M using OOS.
Enterprises often have compliance requirements for their IT assets. These requirements mandate that ECS host instances maintain consistent system and software configuration baselines for items such as host kernel parameters, host time zones, and software versions. You can use CloudOps Orchestration Service with ECS Cloud Assistant to automate O&M for host system and software configurations in the cloud. This combination of services meets O&M requirements for centralized scanning, monitoring, and remediation of these configurations. For more information, see Automate host system and software configuration O&M using OOS.
Use CloudConfig to automatically scan for and remediate configuration issues in your cloud resources. This lets you promptly detect and fix resource configuration errors to prevent security risks. For a practical example, see Continuously remediate non-compliant resources.