Overview of cloud security posture management (CSPM)

Run security checks on cloud assets

• Scenario: To perform security checks on all your cloud resources, you can use a combination of cloud product configuration risk check and baseline risk check.

• Instructions:

  • Initial assessment: Use the 100+ free check items to run an initial risk scan on your cloud products and servers.

  • In-depth scan and remediation: After you activate a paid edition (pay-as-you-go or subscription), you can use all check items for in-depth scans and remediate the detected risks.

Meet compliance or internal standards

• Scenario: To meet specific security standards, such as MLPS 2.0, or your organization's internal security baseline requirements, you can use the baseline risk check feature for automated compliance auditing and continuous monitoring.

• Instructions: This feature includes built-in compliance check packages for mainstream standards like MLPS 2.0 and CIS, and supports custom policies, making it the preferred option for automated compliance auditing.

Analyze and block internal attack paths

• Scenario: Use the attack path analysis feature to analyze and block paths that attackers can use to pivot from compromised resources to other critical assets.

• Instructions: This feature intelligently connects scattered configuration risks and visualizes the complete attack path. For example: Publicly accessible ECS → Bound to a high-privilege RAM role → Can control all core OSS buckets.

Region restrictions

Product version restrictions

Billing concepts

• Authorization: The billing unit for paid cloud security posture management (CSPM) features. One authorization is consumed for each successful billable operation (scan, verification, or remediation) on an asset instance.

  For example, if you have 10 products, each with 15 instances, and you use 5 check items to scan all instances, the task will consume 10 * 15 * 5 = 750 authorizations.

• Asset instance: A specific cloud resource, such as an OSS bucket or an ECS security group.

• Check item: Check items are categorized as free or paid.

  • Free check items: The Cloud Service Configuration Risk feature provides some free check items for basic risk awareness. You can perform an unlimited number of scans and verifications, and authorizations are consumed only for repairs.

    Important

    Users who authorized CSPM (formerly cloud product configuration check) before July 7, 2023, can continue to receive the number of free check items corresponding to their Security Center edition (Anti-virus: 80+, Advanced: 90+, and Enterprise/Ultimate: 250+) until their current edition expires.

  • Paid check items: You must purchase the corresponding edition or separately enable the CSPM service. The fees are included in the edition's service or consume authorizations.

For more billing information, see Billing.

Billing details

Security Center offers two billing models: subscription and pay-as-you-go. These models cover the cloud product configuration risk check, system baseline risk check, and attack path analysis features. The following tables describe the feature support and billing details for each model.

Billing and authorizations

• Can I switch from the subscription model to the pay-as-you-go model?

  You cannot switch directly. You must wait for your subscription instance to expire or unsubscribe from it before you can activate the pay-as-you-go service.

  Important

  After you unsubscribe or the subscription expires, any unused authorizations are reset to zero and cannot be transferred.

• What happens if I run out of authorizations?

  • Subscription model: If the remaining authorizations are insufficient to complete an entire scan task, the task stops prematurely. The system displays only the results for checks completed before authorizations ran out. Refer to Upgrade to upgrade your edition or purchase more authorizations.

  • Pay-as-you-go model: There is no authorization limit. The system continuously bills based on actual usage, ensuring all tasks run to completion.

Feature usage

• How do I get started with CSPM for security hardening?

  1. Activation and authorization: Activate the CSPM service and follow the prompts to grant management permissions for your cloud products.

  2. Add assets to check: Add the cloud product instances you want to check, such as ECS and RDS, to Security Center.

  3. Scan and remediate: Configure a check policy and run a scan. After the scan is complete, perform security hardening based on the risk report and remediation suggestions.

• How do I use Security Center to improve the configuration security of my databases?

  Security Center enhances database security in two ways:

  • Cloud security posture management (CSPM):

    • Detection scope: Checks for external configuration risks.

    • Check examples: Checks if access control whitelists are too permissive or if automatic backup and log audit are enabled.

  • Baseline risk check:

    • Detection scope: Checks for internal security flaws on the database's host server.

    • Check examples: Checks if database login accounts use weak passwords or if server configurations follow security best practices.

Unsubscribe and disable

How do I disable the cloud security posture management (CSPM) feature?

• Free edition: No action is required. The Free edition provides only limited detection features and does not involve fees or authorization consumption.

• Subscription edition: In the order management center, follow the instructions in Upgrade or downgrade editions to downgrade your Security Center edition to one that does not include CSPM features.

• Pay-as-you-go edition: On the Overview page, in the Pay-as-you-go area, turn off the CSPM switch.