Operating systems and software can have security vulnerabilities, such as buffer overflows and privilege escalation, that are introduced during development. You should promptly fix high-risk security vulnerabilities on your ECS instances.
Security risks
A security vulnerability is a flaw introduced into an operating system or software during its design and development. Attackers can exploit these flaws to run malicious code, steal data, escalate privileges, or even take full control of a server. After OS and application vendors release security advisories and patches, attackers often develop exploits based on the patch information. Promptly fix high-risk vulnerabilities according to vendor advisories to prevent attacks that target publicly disclosed vulnerabilities.
Best practices
Monitor system and application vulnerabilities
Use Security Center to discover and view vulnerabilities:
-
Risk discovery: After you enable host security protection, Security Center continuously scans your servers and applications for known vulnerabilities and other security risks.
-
Alert notifications: By configuring Notification Settings, Security Center can send notifications to designated recipients when it detects a security risk on an asset. This helps you respond to security events promptly and protect your assets.
Stay updated on the latest security developments and fix vulnerabilities promptly to prevent potential losses. Also, regularly review the official Alibaba Cloud Security notices to stay informed about the latest vulnerability updates.
Fix vulnerabilities
Fix vulnerabilities with Security Center
Console
Vulnerability fixing is a paid feature. After you view and handle vulnerabilities, you can then fix them.
-
Log on to the Security Center console.
-
In the left-side navigation pane, choose . Click the number under High-priority Vulnerabilities (CVE). A value of 0 indicates that no high-risk vulnerabilities exist. Find vulnerabilities that have a status of Not Fixed and a severity level of High.
-
In the Repair column, click Fix. Follow the prompts to enter information such as the snapshot retention time and then click Fix Now. After the task is successfully created, click YES.
-
After the fix task starts, the vulnerability status changes to Fixing.
After the task is complete, click Verify or wait for the next vulnerability scan cycle. Confirm that the vulnerability status changes to Handled or that the vulnerability disappears from the list. If the fix fails, you can troubleshoot the issue based on the provided information.
API
-
Call the ModifyOperateVul operation to handle detected vulnerabilities.
-
Call the OperateVuls operation to fix Linux software vulnerabilities.
For more API operations related to vulnerability management, see Vulnerability fixing.
Automate OS vulnerability fixes with OOS
This method can be used to fix only OS vulnerabilities. For urgent security vulnerabilities or application vulnerabilities, use Security Center to manage application vulnerabilities and fix high-risk vulnerabilities.
Console
-
Log on to the ECS console - Instances, select the target instance, and go to its details page.
-
On the instance details page, go to the Scheduled and Automated Task Management tab. On the Auto-update Patches card, click Auto-update Patches.
-
Configure the execution policy as prompted.
-
Scheduled Task Type: We recommend that you select Recurring Execution and set the schedule to an off-peak time. For example, the CRON expression
0 0 2 ? * *schedules the task to run at 2:00 AM every day. -
Reboot Required: Choose this option carefully based on your business needs. Some core patches require a system reboot to take effect. We recommend that you set this to Yes to ensure patches are fully applied and schedule the execution during an ECS scheduled maintenance window. If you select Allow Instance Reboot when installing a patch, the system automatically reboots the instance if the patch requires it.
-
-
After you complete the configuration, click Next. Confirm the information and click OK. The system automatically creates and runs the O&M task based on the policy.
Vulnerabilities may not be fixed immediately after you enable this feature. They will be fixed according to the execution schedule that you configured.
API
Call the StartExecution operation of Operation Orchestration Service (OOS). Set the TemplateName parameter to ACS-ECS-ScheduleApplyPatchBaseline to specify the automatic patch update task. Use the Parameters parameter to control the patch scope, execution time, and other settings.
Compliance capabilities
Vulnerability scan
After you enable host security protection, the free edition of Security Center is activated and performs periodic vulnerability scans, by default every two days. You can view the scan results on the Vulnerabilities page:
-
Log on to the Security Center console.
-
In the left-side navigation pane, choose . In the upper-left corner of the console, select the region of the assets you want to protect.
-
On the Vulnerabilities page, you can manually scan for vulnerabilities or configure automatic vulnerability scans.
Check for vulnerable instances
Security Center
-
Log on to the Security Center console.
-
In the left-side navigation pane, choose . Click the Cloud Service Configuration Risk tab. Find the check item named Computers with unpatched high-risk system vulnerabilities and click Scan in the Action column.
A Not Passed status indicates that there are instances with unfixed high-risk system vulnerabilities. You can click Details to view them. For more information, see Cloud Security Posture Management (CSPM) overview.
Remediate high-risk vulnerabilities
Remediate vulnerabilities by using Security Center
For detailed steps, see Use Security Center to manage application vulnerabilities and fix high-risk vulnerabilities.
Remediate vulnerabilities with OOS
For detailed steps, see Enable an OOS patch baseline to automatically fix high-risk OS vulnerabilities.