O&M platform isolation
As an Alibaba Gov Cloud user, you focus on basic O&M tasks for your cloud resources, such as usage levels and utilization rates. Alibaba Cloud O&M engineers perform O&M on the Alibaba Gov Cloud platform.
Alibaba Cloud O&M engineers use the Apsara O&M management platform to manage the Alibaba Gov Cloud platform. They follow strict O&M policies for access control, separation of duties, and monitoring and auditing to ensure the security of platform O&M.
Access control
Separation of duties and permission management
Separation of duties
- O&M and audit duties are separated. The O&M team performs O&M operations, and the security team is responsible for auditing.
- Database administrator and system administrator duties are separated.
Account management and identity authentication
- Each employee has a unique account.
- A centralized password policy is enforced. This policy requires employees to set passwords that meet length and complexity requirements and to change them regularly.
- Multiple authentication methods are supported, such as account and password logon, one-time security token logon, and digital certificate logon.
Authorization
Alibaba Cloud grants employees limited access permissions to resources based on their job positions and roles, following the principles of least privilege and separation of duties.
Employees request access permissions for VPN, Bastionhost, management platforms, and production systems through a centralized permission management platform. Permissions are granted only after approval from a supervisor, the data or system owner, a security administrator, and other relevant departments.
Monitoring, auditing, and change management
Monitoring
Alibaba Cloud uses an automated monitoring system for comprehensive, real-time monitoring of the cloud platform's network devices, servers, databases, application clusters, and core services. The monitoring system uses dashboards to display key Alibaba Cloud operational metrics. You can configure alert thresholds. When a key operational metric exceeds a configured alert threshold, the system automatically notifies O&M and management personnel.
Auditing
All employee O&M operations on production systems must be performed through a Bastionhost. All operations are fully recorded and transmitted in real time to a centralized log platform. Alibaba Cloud defines audit policies based on the violations specified in the "Account Usage Specification" and "Data Security Specification". These policies detect non-compliant behavior and notify security personnel to take appropriate action.
Internal web-based management and support systems record sensitive operations in detail according to the Alibaba Cloud Log Auditing Specification and send the logs to the centralized log platform.
Change management
Alibaba Cloud established a complete change management process based on ISO/IEC 20000. Changes are graded by urgency and classified by source and object. The process also defines criteria for potential change outcomes. The entire process is supported by automated systems and tools. This process includes stages such as request, assessment, approval, testing, implementation, and review. It also clearly defines the responsibilities for each role in the change management process.
The change request stage defines key steps, including submitting, recording, accepting, and evaluating the request.
The change execution stage includes creating a change plan and schedule, and assessing and implementing the change. All changes must be tested before execution. The change plan and time window must be reviewed. Alibaba Cloud notifies customers who might be affected by the change. Important changes require a dual review.
The change verification stage includes change validation, configuration item review, and change result notification. Alibaba Cloud records all information throughout the change process and deploys automated configuration check tools to verify infrastructure and information system configurations.