How to choose security products-Alibaba Gov Cloud-阿里云帮助中心

Alibaba Gov Cloud offers a wide range of security products, which can make it difficult to choose the right one for your needs. This document compares the main security products and provides descriptions and recommendations to guide your selection.

Comparison of security products

The following tables compare the main security products. Review the descriptions in the "Device and software name" column to see if a product meets your needs. If it does, you can use the priority level to help you make a selection. The priority levels are:

Essential: Highly recommended. Not using this product can lead to significant security risks.
Extremely High: Recent security hot spots that require immediate attention to prevent security risks.
High: A key area for security attacks and defenses. You can perform the configuration yourself if you are familiar with system architecture.
Medium: Does not affect your core business, but some business features will be unavailable.

Table 1. Priority: Essential cloud products
No.	Device and software name	Technical parameters/Configuration/Performance	Priority
1	Threat Detection Service (visual analytics, alerting and early warning)	Specification: Supports a total of 40 Elastic Compute Service (ECS) instances. Features: Provides security alerts, cloud-based virus and web shell scanning, abnormal logon alerts, zombie detection, data leak detection, security visualization, log analysis, and threat intelligence.	Essential
2	Web Application Firewall	Normal business request QPS: 5,000 Clean bandwidth (off-cloud/on-cloud): 130 Mbps / 200 Mbps Protects 10 domain names	Essential
3	Bastionhost (essential for access management)	Specification: Supports 50 assets and 50 concurrent connections.	Essential
4	Server Guard (core of host security protection)	Protects 40 ECS instances. Virus scan: Uses multiple virus detection engines to support one-click isolation of web shells and virus files. It can automatically scan for and remove some common ransomware and DDoS Trojans. Vulnerability management: Covers Windows, Linux, and Web-CMS vulnerabilities and supports one-click fixes. Baseline check: Supports one-click checks for security baselines, such as weak security tokens, systems, accounts, permissions, and web servers. This improves host security hardening. Intrusion detection: Driven by big data. It combines a rules engine with machine learning algorithms and associated security detection models to ensure threat detection capabilities.	Essential
5	DataBase Audit (essential for database services)	Supports 5 database instances. Policy elements: where: IP address, username, port number, database type. who: instance, schema. what: table, field, view, package. when: start/end time, execution duration. how: client tool. Range: number of rows modified, deleted, or queried. ResultSet: returned result set. other: keyword, client tools and applications, error code, number of associated tables, and more. SQL injection detection and alerting: Detects and sends alerts for SQL injection behaviors. Risky logon detection and alerting: Detects and sends alerts for logons from risky client IPs, MAC addresses, or client programs, and for logons by specific database users at specific times. Risky operation detection and alerting: Detects and sends alerts for high-risk SQL operations on specific data tables by specific users or groups. Sensitive statement detection and alerting: Supports sensitive object detection. It does not send alerts for trusted statements but sends alerts for sensitive statements.	Essential
6	Cloud Firewall (basic security component)	Supports 200 ECS instances by default and can be extended to support up to 5,000 instances. Provides 200 Mbps of protection bandwidth, which can be extended to 2 Gbps. Supports firewall security controls for both inbound and outbound traffic access. Supports domain name-based access control. Supports micro-segmentation at the ECS granularity level. It provides visualization, control, and management of business relationships. Supports the intrusion prevention system (IPS) feature. Supports event logs, traffic logs, and system logs, which are stored for 6 months. Supports network traffic analysis for access from the Internet to your services. Supports analysis of outbound connections from your services. Supports analysis of blocked access attempts.	Essential

Table 2. Priority: Very High cloud products
No.	Device and software name	Technical parameters/Configuration/Performance	Priority
1	Anti-DDoS Pro and Anti-DDoS Premium (DDoS protection is a recent security focus)	Provides 30 G of basic protection and up to 300 G of elastic protection.	Very High
2	Website Threat Scan (highly recommended for website services)	Includes scan authorization for 10 second-level domains or IPs. Scans 100,000 URLs daily for content risks. Supports in-depth website vulnerability detection and emergency vulnerability detection. Monitors webpage content risks, such as website defacement, junk content, trojans, and hidden links. It supports image, text, and source code formats.	Very High
3	Cloud Hardware Security Module (HSM) (essential for data encryption in government services using national cryptographic standards)	Cloud HSM is based on hardware security modules certified by the China State Cryptography Administration. It provides a cloud-based solution for data encryption and decryption. You can securely manage keys and use various encryption algorithms to reliably encrypt and decrypt your cloud service data. Data communication protocol: TCP/IP Concurrent connections: 64 SM1 encryption performance: 4,000 times/second SM2 signing performance: 3,000 times/second SM2 signature verification performance: 2,000 times/second RSA 2048 public key operation performance: 3,500 times/second RSA 2048 private key operation performance: 400 times/second Symmetric algorithms: SM1, SM4, DES, 3DES, AES Asymmetric algorithms: SM2, RSA (1024 to 2048) Hash algorithms: SM3, SHA-1, SHA-256, SHA-384	Very High

Table 3. Priority: High cloud products
No.	Device and software name	Technical parameters/Configuration/Performance	Priority
1	Certificate Service	HTTPS certificates (recommended for increased security)	High
2	Managed Security Service	Emergency, Escort, and Enterprise Editions (choose a type based on your business scale)	High
3	Penetration Test	Alibaba Cloud experts provide penetration tests. This can help you detect vulnerabilities that you cannot find on your own.	High

Table 4. Priority: Medium cloud products
No.	Device and software name	Technical parameters/Configuration/Performance	Priority
1	Anti-Bot Service	Consider if needed	Medium
2	ID Verification	Consider if needed	Medium
3	Content Moderation	Consider if needed	Medium

Customer use case 1: Basic security

A government agency deployed an internal application that is accessed through a VPN. For this scenario, you can use the following approach to plan your security product selection:

This use case requires only a few cloud products, such as two virtual machines and one Server Load Balancer instance. The number of daily active users (DAU) is less than 500, and the content is not confidential or critical.

Basic security products: Web Application Firewall and Server Guard are sufficient. You can also purchase Alibaba Cloud VPN.

Customer use case 2: Internet-based government services

A government agency deployed a public-facing website with applications that are accessed by the public. Because this service has a social impact, it has high security requirements. For this scenario, you can use the following approach:

This use case is more complex and consists of products such as virtual machines, databases, Object Storage Service, and Server Load Balancer. You must strictly separate the backend and frontend services. After you divide the functional zones, you can use Bastionhost and a VPN to log on to and manage the backend. For the frontend, the focus should be on tamper-proofing and protection against network attacks.

Basic security products: Web Application Firewall, Server Guard, and Bastionhost
To prevent website breaches and tampering, you can also add: Anti-DDoS Pro and Anti-DDoS Premium, Website Threat Scan, and Cloud Firewall
If your database requires auditing, you can also add: DataBase Audit

Customer use case 3: High-level security architecture

A government agency deployed its core business applications on Alibaba Gov Cloud. The architecture is complex, has extremely high security requirements, and requires continuous service availability. For this scenario, you can use the following approach:

This use case involves more than 20 Alibaba Cloud products with high usage rates and has extremely high security requirements. In this case, basic security products are insufficient. You must perform strict planning at the architecture and process levels based on your specific business and architecture.

You will likely need all the security products. More importantly, you should choose Alibaba Cloud expert services:

Dedicated after-sales team: You can choose Alibaba Cloud's premium after-sales service for major customer support.
Dedicated security team: You can use Alibaba Cloud expert security services to perform a security assessment of the overall architecture.
Dedicated compliance team: The Alibaba Cloud compliance team provides compliance consulting and assessment support for this type of architecture.
Alibaba Gov Cloud major event support: This service provides customers with comprehensive security protection during critical periods.