Managed Security Service
Click to view/download the PDF version
1. Overview
Managed Security Service is a managed security operations service for cloud customers. This service is provided by the Alibaba Cloud security team and is based on years of technical experience. If your security team is understaffed, you can delegate some or all of your security tasks to the Alibaba Cloud security team. Alibaba Cloud security experts help you design security solutions and manage daily security tasks to protect your cloud-based business.
2. Service scope
No. | Service category | Scope of work | Notes |
1 | Security consulting service | Customize cloud security recommendations based on cloud security best practices and your business characteristics. Answer your security questions online. | Led by Alibaba Cloud. Requires customer cooperation. |
2 | Security assessment | Fully assess the security of your Alibaba Cloud assets. This includes cloud platform components, network security, host security, and application security. | Led by Alibaba Cloud. Requires customer cooperation. |
3 | Security hardening guidance | Guide you to harden the network, hosts, and application software of your cloud systems based on best practices. This does not include application code-level hardening. | Guidance from Alibaba Cloud. You perform the actual hardening tasks. |
4 | Security detection | Perform a quarterly security scan of your cloud assets. | Alibaba Cloud |
5 | Security monitoring and inspection | Perform daily security inspections and monitoring for security events and vulnerabilities on your cloud assets to promptly identify security risks. | Alibaba Cloud |
6 | Security event emergency response | Assists with incident response after a system intrusion. | Led by Alibaba Cloud. Requires customer cooperation. |
7 | Security product operations guidance | Guide you to configure and use Alibaba Cloud Security products. | Guidance from Alibaba Cloud. You perform the actual configuration. |
8 | Security escort | Help cloud customers better protect core business services during special periods. | Led by Alibaba Cloud. Requires customer cooperation. |
3. Prerequisites
To ensure the effectiveness of Managed Security Service and the security of your cloud systems, the following prerequisites must be met:
Define the scope of cloud assets that require Managed Security Service and authorize Alibaba Cloud to scan and assess them.
Grant necessary permissions to Alibaba Cloud security personnel, such as a RAM user account and access to Bastionhost or servers. These permissions are required for them to perform their work.
Security event monitoring depends on Threat Detection Service. If you have not enabled Threat Detection Service, the effectiveness of security monitoring and inspection services will be limited.
4. Service content
Managed Security Service includes three versions: Server Security Hosting, Managed Security Service Enterprise Edition, and Security Escort.
Server Security Hosting provides server security operations and management for individual or small business customers. The service scope is limited to the servers you purchase.
Managed Security Service Enterprise Edition is a managed security operations service for enterprise customers. The service scope covers all cloud assets under your account.
Security Escort is an online support service from the Alibaba Cloud Managed Security Service team. It is a standalone service that must be purchased separately.
The service content differs between Server Security Hosting and Managed Security Service Enterprise Edition. See the following table.
Service content | Server Security Hosting | Enterprise Security Hosting |
Security consulting service | Included | Included |
Security assessment | Not included | Included |
Security hardening guidance | Included | Included |
Security detection | Not included | Included |
Security monitoring and inspection | Included | Included |
Security event emergency response | Included | Included |
Security product operations guidance | Not included | Included |
4.1 Security consulting service
Managed Security Service provides the following consulting services:
A dedicated Managed Security Service DingTalk group is created for each customer for real-time online communication about security issues.
For the Enterprise Edition, an annual security recommendation plan is designed based on your business and the security status of your cloud assets.
4.2 Security assessment
We use multiple security check methods to collect accurate data and analyze security issues from a technical perspective. This provides a comprehensive understanding of the security risks in your information system and the network security threats that you face.
The Alibaba Cloud Managed Security Service team assesses your business security status based on your security needs. The team identifies gaps between your current security posture and security best practices, and proposes corresponding solutions.
The security risk assessment service includes the following:
Assessment category | Assessment content description | Method |
Cloud platform security assessment | l Assess cloud platform account security. l Assess whether cloud platform access control is reasonable. l Assess whether there is any sensitive information leakage, such as AccessKey information leakage. | Manual check |
Cloud platform component security assessment | Perform a security assessment of the cloud platform components you use, such as RDS and OSS, to analyze security risks. | Manual check |
Network security assessment | l Assess the reasonableness of network security group division. l Check the reasonableness of network access control policies. l Scan and detect vulnerable ports open to the public network. l Analyze network-layer security attacks and threats. | Manual check and tool-based scan |
Host security assessment | l Use a scanner to comprehensively detect security vulnerabilities in host operating systems and application software. l Use baseline checks based on best practices to find configuration weaknesses in operating systems and application software. l Manually analyze and validate the results from automated scanning tools. | Manual check and tool-based scan |
Application security assessment | l Use a scanner to find OWASP Top 10 security vulnerabilities in websites and security vulnerabilities in business application code. l Manually perform security tests on sites and conduct security analysis and validation of issues found by the scanner. l Perform security assessments for other non-web applications. l Develop a remediation plan and guide you to fix security vulnerabilities. | Manual check and tool-based scan |
4.3 Security hardening guidance
Based on the findings of the security assessment and security best practices, the Managed Security Service team provides security hardening guidance. The team customizes a security hardening plan based on your application deployment environment and business requirements, and guides you through hardening your production environment. The security hardening plan covers the following aspects:
Network security policy adjustments, such as network architecture adjustments and security group policy hardening
Harden cloud products such as RDS and OSS
Perform security baseline hardening and patch upgrades for ECS operating systems
Harden application software such as Apache and Nginx
Due to the dependencies and complexity of your production environment, the Managed Security Service team does not perform direct hardening operations. If you require a fully managed security operations service, you must purchase the security hardening service separately in addition to Managed Security Service Enterprise Edition. You must also authorize the Managed Security Service team to perform operations in your production environment.
4.4 Security detection
New security risks can arise over time from business changes, 0-day vulnerabilities in operating systems or applications, code adjustments, or configuration changes. Therefore, periodic security detection is essential for the long-term security of your business systems.
Managed Security Service Enterprise Edition performs a quarterly security scan for you. The scan includes, but is not limited to, the following:
Open port status of all cloud assets
Host operating system security vulnerability detection
Application software security vulnerability detection
Web application security vulnerability detection
4.5 Security monitoring and inspection
The Alibaba Cloud Managed Security Service team provides daily security monitoring and inspection services. We help you analyze and manage daily security events and provide solutions to maintain a high level of security for your systems.
The security inspection feature depends on Alibaba Cloud Security products. We recommend that you enable the paid version of Threat Detection Service.
Monitoring and inspection item | Content |
Security products and policies | Enabled status, authorization status, configuration status, and compliance of security products and policies |
Network security layer | Access traffic trends |
Anomalous network access behavior | |
DDoS and CC attack behavior | |
ECS operating system layer | Open port status of ECS instances, such as non-business ports like 22, 3389, and 3306 being directly exposed to the Internet |
Configuration weaknesses of ECS instances, such as weak security tokens or direct logon with the root account | |
Brute-force attack events against logon protocols and remote logon events | |
Application middleware vulnerabilities, such as Tomcat or JBoss vulnerabilities | |
Other anomalous server events | |
Application security layer | Business availability monitoring |
Webshell events | |
Monitoring for website trojans, hidden links, and tampering | |
Web application security vulnerabilities |
4.6 Security event emergency response
If your information system experiences a cyberattack, we provide professional 24/7 remote emergency response services. We follow a process of containment, eradication, and recovery to help you quickly respond to and resolve information security events, restore your business, and implement subsequent security improvements to prevent future incidents and reduce business impact.
4.7 Security product operations guidance
For customers without dedicated security personnel, we provide professional guidance on Alibaba Cloud Security products. We help you manage and optimize security product policies based on security threats to build a robust security defense system.
4.8 Security escort
During major events such as large-scale sales promotions, new product launches, major news releases, or Initial Public Offerings (IPOs), and during important conferences, the external business systems of enterprises or government agencies often become key targets for competitors and hackers. A serious information security event during these critical periods can have a severe impact on the organization. Therefore, special protection is required for core systems during these periods to ensure the secure operation of their online business.
Security Escort is an online support service from the Alibaba Cloud Managed Security Service team. It helps cloud customers protect their core business services during critical periods, defend against various cyberattacks, and ensure the stable operation of their core business during events and conferences. The Security Escort service must be purchased separately and is priced based on person-days according to your needs.
5. Service SLA
We provide online support through a DingTalk group during business hours (5×8), with a response time of less than 20 minutes. We provide 24/7 phone support, with a response time of less than 30 minutes after you place a call.
Security consulting and emergency response services are provided through remote support.
The scope of Managed Security Service includes the Alibaba Cloud public cloud assets that you have specified in advance.
On-premises assets or cloud assets that you have not specified and authorized for security assessment in advance are not within the scope of the service.
The security hardening service must be purchased separately and is priced based on the number of ECS instances.
The security hardening service includes hardening for the cloud platform, cloud resources, and operating systems. It does not include business-layer code hardening.
The number of emergency response services is limited. Server Security Hosting provides no more than two emergency response services per year. Managed Security Service Enterprise Edition provides no more than four emergency response services per year.
6. Customer responsibilities
Assign a project contact person to assist the Alibaba Cloud security team.
Provide necessary authorizations, including an Alibaba Cloud RAM user account.
Implement security measures and deploy necessary security products based on the recommendations of Alibaba Cloud security experts.
7. Project changes
If either you or Alibaba Cloud requests a change to the project objectives, service content, implementation plan, or deliverables that may affect the contract price or other terms, a project change must be negotiated.
If the number of your ECS instances increases significantly and reaches a new pricing tier for Managed Security Service Enterprise Edition, you must upgrade your Managed Security Service Enterprise Edition promptly.
8. Acceptance criteria
The Managed Security Service Enterprise Edition provides security reports as specified in the Statement of Work (SOW) and Service-Level Agreement (SLA).
9. Completion flag
The project is considered complete when the Managed Security Service order expires.