Managed Security Service

Alibaba Cloud Managed Security Service (MSS) provides security technology and consulting delivered by Alibaba Cloud security experts. MSS helps you build and continuously optimize your cloud security defense system.

Background information

As more businesses migrate to the cloud, they face new challenges to the availability, security, and integrity of their cloud workloads.

Common challenges for cloud users

Lack of comprehensive cloud security solutions weakens security system effectiveness.
Traditional vendors may not fully understand the cloud environment, raising questions about whether legacy defense solutions remain suitable.
Uncertainty about security solutions leads to higher costs.
Without thorough analysis of business security issues, you cannot develop effective policies, which increases security management costs.
Shortage of professional security management personnel.
Without skilled security talent, businesses cannot respond to security incidents in time, risking disruption and financial loss.

To address these challenges, Alibaba Cloud MSS provides Managed Detection and Response (MDR) services for your ECS servers. MDR combines Alibaba Cloud security expertise with in-depth detection and response capabilities to help you quickly establish a basic security operations system and protect your cloud business.

MSS also offers value-added services such as risk assessment, emergency response, and classified protection assessment to help you build a comprehensive security defense system.

Service Specifications

MSS offers different service editions. Purchase the edition that best suits your needs.

Service Specifications

Scenarios

Service content

Enterprise Edition

Suitable for scenarios that require high security protection to build a comprehensive security operations system.

Security consulting
Provides consulting services for basic security products, including Anti-DDoS, WAF, Cloud Firewall, and Security Center. This covers configuration issues, policy anomaly analysis, and abnormal event handling.
Security monitoring
- Monitors and analyzes security alerts. Pushes alert information through DingTalk groups and handles alerts using tickets to help filter out false positives.
- Analyzes and assesses alerts to provide security recommendations based on your current business.
Vulnerability notification
Provides impact detection for 0-day vulnerabilities using vulnerability detection rules. Provides impact analysis based on factors such as host outbound traffic and host status.
Summaries and reports
Provides cloud security posture reports in various formats, including monthly, quarterly, and semi-annual summaries. Optimizes product rules and holds monthly, quarterly, and semi-annual review meetings.
Security assessment service
Assesses your overall cloud security. Helps you identify security risks by analyzing major risks and attack surfaces in the cloud.
Security hardening
Helps you quickly implement security hardening measures after a security incident, based on alert details and relevant industry standards.
Emergency response
Provides methods for containment, eradication, and recovery after a security incident. Offers preventive measures and security recommendations to help find the attack source and the cause of the intrusion.
Product training
Provides training on cloud security product capabilities and best practices.
Visualization Portal
Provides a visualization, management, monitoring, and collaboration platform for MSS.

Major Event Support Edition

Suitable for providing periodic protection for key services during major events, such as:

Large-scale attack and defense drills organized by regulators or industry authorities.
Security assurance for major national or government events and conferences.
Business security assurance for company anniversaries, new product launches, sales promotions, IPOs, and more.

Security consulting
Provides consulting services for basic security products, including Anti-DDoS, WAF, Cloud Firewall, and Security Center. This covers configuration issues, policy anomaly analysis, and abnormal event handling.
Security monitoring
- Monitors and analyzes security alerts. Pushes alert information through DingTalk groups and handles alerts using tickets to help filter out false positives.
- Analyzes and assesses alerts to provide security recommendations based on your current business.
Vulnerability notification
Provides impact detection for 0-day vulnerabilities using vulnerability detection rules. Provides impact analysis based on factors such as host outbound traffic and host status.
Summaries and reports
Provides cloud security posture reports in various formats, including monthly, quarterly, and semi-annual summaries. Optimizes product rules and holds monthly, quarterly, and semi-annual review meetings.
Security protection plan design
Designs a custom security protection plan based on the security goals of the protected assets.
Assessment and hardening guidance
Performs a comprehensive security assessment of key systems and provides guidance on security optimization.
7x24 security watch
Provides 7x24 online security expert monitoring during the support period, as needed. Responds to and handles security incidents promptly and provides a daily security report.
Security emergency response
Coordinates the Alibaba Cloud security expert team to respond quickly to any security incidents and reduce their impact.

Scenarios

Build a complete security operations system

Scenario description
After migrating to the cloud, some businesses lack effective vulnerability and risk management capabilities. MSS provides a mature operations system covering security product operations, vulnerability and risk management, and basic security operations to ensure seamless protection for your cloud assets.
Service benefits
A mature operations system lets you focus on business development while building your security capabilities more efficiently with MSS expert support.

Improve the ROI of security operations resources

Scenario description
Traditional security operations require significant investment in professional staff, and costs scale with asset growth. Many businesses lack sufficient security operations resources.
Service benefits
A service-oriented approach reduces operational costs while leveraging MSS expertise to enhance overall security capabilities, including product protection, policy optimization, and vulnerability and risk management.

Get security architecture guidance during cloud migration

Scenario description
During cloud migration, you may face security challenges at the business, technical, and management levels. MSS provides cloud security architecture design guidance and consulting to help you achieve optimal protection.
Customer benefits
Professional consulting on cloud security architecture helps you achieve your migration goals while ensuring business stability and security.

Enhance security capabilities

Scenario description
System platforms face growing security threats, including data theft, tampering, and unauthorized access. Professional security services help ensure the confidentiality, integrity, and availability of your data.
Service benefits
The MSS team assesses your security posture and identifies gaps from best practices. For issues found during assessment, MSS implements security hardening to improve the resilience of your operating systems and network devices.

Benefits

One-click management and full-stack operations
MSS provides comprehensive security operations from network border to internal network, covering vulnerabilities, policies, configurations, and data. It continuously optimizes your cloud security defense system so you can focus on business development.
Powered by big data
Alibaba Cloud security centralizes protection data from products such as Security Center, Cloud Firewall, Web Application Firewall, and Anti-DDoS, covering multiple protection layers such as VPN networks, ECS, web applications, and databases. Based on data mining techniques accumulated over years of practical experience, it provides real-world attack and defense threat intelligence to all cloud users. The security operations team combines this intelligence with your protection needs and business system status to periodically adjust security policies. This brings security risks within a controllable range and enables dynamic adjustment, defense, operations, and management.
Benefits of scale
MSS adopts a large-scale, systematic operation model to deliver high-quality services to every cloud user efficiently.
Minute-level emergency response
The MSS monitoring and emergency response system helps you respond to intrusions, clean up Trojan backdoors, and analyze root causes. This reduces incident losses and helps you resume normal operations quickly.

Service content

MSS includes the following services:

Service content (Enterprise Edition)

Service category	Service content	Deliverable details	Deliverables	SLA (Service-Level Agreement)
Security consulting	Provides consulting services for basic security products: Security Center, WAF (excluding bot management), Anti-DDoS, and Cloud Firewall. This includes answering questions about configuration, policy anomaly analysis, and abnormal event handling.	Troubleshooting for cloud security product anomalies.	Push notifications to DingTalk groups and the MSS console. Summarized information in relevant daily reports.	Response to inquiries within 30 minutes and ticket closure within 72 hours during 5x8 business hours, as needed.
		Guidance on cloud product policy optimization.
		Questions about cloud security products.
Security risk assessment	Assesses your overall cloud security. Helps you identify security risks by analyzing major risks and attack surfaces in the cloud.	Security operations capability assessment Assesses security maturity through interviews and surveys, and provides recommendations for security development.	"Security Assessment Report"	Once per quarter.
		Network architecture risk assessment Checks the validity of network access control policies and suggests optimizations.	"Security Assessment Report" "Vulnerability Scanning Report" Continuous monitoring of security risks, repair and hardening recommendations, and assistance with risk assessment and content remediation.	One assessment per month.
		Cloud product security assessment Performs baseline checks and risk management for cloud hosts. Provides repair recommendations and risk management best practices, including system vulnerability checks.
		Exposure and attack surface risk assessment Provides periodic asset exposure, vulnerability detection, and management services for cloud hosts and businesses. Manually analyzes report content and provides repair guidance and risk management best practices. This includes public network exposure risk, vulnerable port scanning, and web vulnerability scanning.
		Account security risk assessment Detects and assesses risks related to AccessKey pair leaks.
		Application system security risk assessment
		Cloud security product configuration risk assessment
Security monitoring	Monitors and analyzes security alerts. Pushes alerts through DingTalk groups and manages alerts using tickets to help filter out false positives and other issues. Analyzes and assesses alerts to provide security recommendations based on your business.	Monitoring of the security status of cloud security products. Includes Web Application Firewall (excluding bot management), Anti-DDoS, Security Center, and Cloud Firewall. Monitoring of the security status of assets connected from multicloud and IDC environments.	"Security Monitoring Service Report"	Push notifications to DingTalk groups and the MSS console. 5x8 business hours: Response to alerts within 30 minutes and alert handling completed on the same day. Security Center, Cloud Firewall, and Anti-DDoS are inspected every 15 minutes.
Security hardening	Helps you quickly implement security hardening measures after a security incident, based on alert details and relevant industry standards.	Security product configuration service: Helps you connect security products and configure policies.	Deliverables are included in the "Security Assessment Report", "Risk Tracking Sheet", and "Security Vulnerability Hardening Checklist".	Included.
Emergency response	Provides methods for containment, eradication, and recovery after a security incident. Offers preventive measures and security recommendations to help you find the attack source and the cause of the intrusion.	Security incident emergency response.	After the emergency response is complete, an "Emergency Response Report" is provided. Triggered when: The user initiates a request for emergency response. A security expert discovers an anomaly and initiates an emergency response.	Included (for orders of three months or longer). 5x8 business hours: Response to proactively discovered risks within 30 minutes. 7x24 passive response. Improvement suggestions provided within 2 hours. Report completed within 72 hours.
Vulnerability notification	Provides impact detection for 0-day vulnerabilities using vulnerability detection rules. Provides impact analysis based on factors such as host outbound traffic and host status.	Monitoring, analysis, and warnings for the latest vulnerability intelligence: When a new high-risk vulnerability event affecting your assets is detected on the Internet, we analyze it, issue a warning, and provide a remediation plan to remind you to fix it.	Push notifications to DingTalk groups and the MSS console. "Emergency Vulnerability Inspection Notification"	Daily. Vulnerability monitoring reports are delivered on an irregular schedule.
Product training	Provides training on cloud security product capabilities, best practices, and more.	The following services are provided as needed: One session on best practices for using cloud security products 30-minute remote training session	"Training Materials"	Included.
Visualization Portal	Provides a visualization, management, monitoring, and collaboration platform for MSS.	None.	MSS console	Included.
Summaries and reports	Provides cloud security posture reports in various formats, such as monthly, quarterly, and semi-annual. Optimizes product rules and holds monthly, quarterly, and semi-annual review meetings based on the current situation.	None.	The following work summaries and reports are provided: "Daily Security Service Report" "Weekly Security Service Report" "Monthly Security Service Report" "Quarterly Security Service Report" "Annual Security Service Report"	Corresponding reports are provided at fixed intervals.

References

MSS offers various service types with different billing methods. Product Billing.
To activate and start using MSS, follow the Quick Start.
Learn about MSS service types and workflows in Managed Security Service workflow.
During a security risk assessment, MSS evaluates your network system and works with you to develop an inspection plan, risk mitigation measures, an emergency plan, and an authorization statement. Security Assessment Service.
The Emergency Response Service provides one-on-one expert assistance using standardized processes to help you resolve urgent security incidents quickly and cost-effectively. Emergency Response Service.
The Classified Protection Assessment Service provides one-stop consulting and assessment covering classification, filing, construction, rectification, and assessment. Classified Protection Assessment Service.