Trojan injection attack protection plan
Trojan injection attacks on cloud hosts are an application-level security risk. This risk is outside the scope of Alibaba Cloud infrastructure management. To prevent these attacks, you must deploy security products and policies for your applications.
Alibaba Gov Cloud recommends that all government agencies prepare prevention plans and create emergency response strategies. This helps ensure the security of cloud-based services during major government events.
Handling attacks from infected virtual machines on non-Alibaba Cloud services
For websites under major event support, Alibaba Gov Cloud blocks attacks by closing ports on all virtual machines, especially those that host web applications and pages. Only port 80 remains open. This allows these websites to serve traffic from the internet and ensures that core services are not affected.
Risk: If a website under major event support communicates with other resources on ports other than 80, that communication will be disrupted during the major event support period.
Handling attacks from infected virtual machines on users within Alibaba Gov Cloud
For websites under major event support deployed on Alibaba Gov Cloud, Alibaba Gov Cloud assigns dedicated personnel to help customers. They will assist with installing commercial security products on hosts and adjusting security group rules. This protects customers from attacks that originate from other infected hosts within the cloud and helps secure their services during major events.
Requirement: This approach requires you to install software on your host and configure security settings based on your specific needs. Therefore, customers under major event support must subscribe to the corresponding Security Services.
- Xianzhi:
Before you publish your application code, perform security tests such as white-box code audits. This helps eliminate major threats and vulnerabilities at the code level.
- Automatic updates:
Enable the automatic patching feature in Alibaba Cloud Security and on your virtual machines. As part of daily O&M, and when your services allow, regularly scan for and fix vulnerabilities in your website and its server-side environment. Promptly apply patches for the operating system, application services, and other software.
- Web Application Firewall:
Typically, the most basic configuration of Web Application Firewall (WAF) is sufficient to defend against most low-level attacks. However, government agencies can be high-value targets for hackers. For more information, see the Solution description section.
Web tamper-proofing
Because web tamper-proofing is directly related to website development and application vulnerabilities, it is the user's responsibility. Alibaba Cloud cannot manage this directly. Therefore, users under major event support should use commercial services from security partners on the Alibaba Cloud platform, such as the tamper-proofing service provided by DBAPPSecurity.