View and handle baseline risk items

View baseline check results and risk hardening suggestions

View the details of failed risk items from baseline checks to identify which items require action and the affected instances.

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Risk Management > CSPM, and then click the Baseline Risk tab.

3. On the Risk Details tab, view risk items and suggestions by check item.

   • In the Pass Rate section, expand the view to see the pass rate for each baseline. Hover over the pass rate line to see the counts of high-risk (red), medium-risk (orange), low-risk (yellow), and failed check items.

   • In the Check Item Statistics section, click the number under Failed or Total Check Items Handled to view the corresponding check items in the list below.

     Note

     The list of failed check items displays data from the last 30 days only. The total for handled check items includes data from the last 365 days and excludes released assets.

   • View the details and suggestions for a target check item.

     Use the search and filter controls above the list to narrow results by risk level, status, and type, or search for a specific item by name.

     In the Actions column for the target check item, click Details. In the details panel, view the Description, Suggestions, Related Baselines, and a list of affected assets.

4. On the Baseline Check Policy tab, view risk items and suggestions by baseline.

   • View the check results for all or a specific Baseline Check Policy.

     In the policy overview area, the default policy is Default. Click the expand icon to open the baseline check policy menu. Then click All Policies or a specific policy to view its details, including Servers Checked, Baselines, High Weak Password Risk, and Last Check Pass Rate (the pass rate of the most recent baseline check).

     Click the number under High Weak Password Risk to view a list of high-risk weak password items.

     Important

     • High Weak Password Risk lists high-severity baseline risks that require immediate attention. For information about how to improve password security and change passwords in common systems, see Weak password security best practices.

     • The font color for the Last Check Pass Rate indicates the following:

       • Green: The scanned assets have a high pass rate for baseline configurations.

       • Red: A high number of baseline configurations failed on the checked assets, which poses a security risk. Go to the baseline check details page to view and fix these risks.

   • View the list of baseline check results and suggestions by baseline.

     1. In the list of baseline check results, click a baseline name. In the baseline details panel, view the assets affected by the baseline, as well as the counts for Passed Items and Risk Item.

     2. In the baseline details panel, find an affected asset and click View in the Actions column. In the Risk Item panel, view all baseline risk items for that asset.

        Note

        If a check item shows a status of Passed, it means the configuration of the corresponding instance has no risks and requires no fixes.

        For example, for the Unauthorized Redis Access check, if a Redis database has no password but is bound to 127.0.0.1 (allowing only local access), the item passes the baseline check. This indicates that the current unauthorized access is secure and does not require fixing. Decide whether to configure authorized access based on your business requirements.

     3. In the Risk Item panel, click Details in the Actions column for a risk item. View information provided by Security Center for the risk item, including the Description, Check Tips, and Suggestions.

        The dialog box displays the following details of the risk item:

        • Description: Containers are not allowed to run with the allowPrivilegeEscalation flag set to true.

        • Suggestions: Note that this operation clears the data of the pod.

        1. Modify the existing YAML file of the pod and set spec.containers.securityContext.allowPrivilegeEscalation to false. Sample YAML snippet: apiVersion: v1, kind: Pod. In securityContext, configure allowPrivilegeEscalation: false.

        2. Run the kubectl replace command to update the pod configuration.

        3. Run a command to query the YAML configuration and verify that the change takes effect.

     4. Optional: Return to the baseline details panel. In the upper-right corner of the baseline check results list, click the download icon . In the Select Baseline Export Task dialog box, select a method to export the results.

        For exporting weak password information contained in the baseline, Security Center provides the following methods:

        • Export Weak Password in Plaintext: Exports the weak password information from the baseline check results in plaintext.

        • Mask and Export Weak Password: Exports the weak password information from the baseline check results in a masked format.

Result retention period

In system baseline checks, results involving critical security configurations are marked as locked. Locked results are automatically cleaned up by the system after 30 days. Unlocked check results are not subject to this limitation.

The following table describes the retention policies for different types of check items:

Handle failed baseline risk items

You can address baseline risks by check item on the Risk Details tab, or by baseline on the Baseline Check Policy tab.

The following example shows how to handle baseline risks by baseline. It uses the Suggestions provided in the Risk Item panel.

1. After you view failed check items in the Risk Item panel, select one of the following operations in the Actions column to handle the corresponding risk item.

   Fix risk items

   Security Center supports one-click fixes for some baseline risk items. A risk item supports one-click fix if the Fix button appears in the Risk Item panel.

   • If the Fix button is not available, the risk item cannot be fixed in the Security Center console. Log on to the affected instance, modify the configuration, and then return to Security Center to Verify the result.

     On the baseline check page, perform the following steps to view and handle risk items that do not support online fixing:

     1. In the baseline list on the left side, click the target baseline, such as Alibaba Cloud Standard - Debian Linux 8/9/10/11/12 Security baseline check.

     2. In the asset list, click View in the Actions column of the target asset to open the Risk Item panel.

     3. In the Risk Item panel, click Details in the Actions column of the target check item to view the risk item details.

     4. In the details panel, view the risk description and Suggestions (for example, modify the /etc/ssh/sshd_config file or configure PermitRootLogin). Manually fix the issue on the server based on the suggestions, and then click OK.

   • If the Fix button is displayed, the risk item can be fixed directly in the Security Center console.

     On the baseline check page, perform the following steps to view and manually fix risk items:

     1. Click the target baseline check item, such as Alibaba Cloud Standard - Debian Linux 8/9/10/11/12 Security baseline check.

     2. In the asset list, click Details in the Actions column of the target asset to view the pass rate and risk levels.

     3. In the Risk Item panel, click the target check item, such as Make sure the rsyslog service is enabled, to view its details.

     4. View the fix commands in Suggestions, for example systemctl enable rsyslog and systemctl start rsyslog. Manually fix the issue based on the suggestions, and then click OK.

     5. Click Verify in the Actions column of the check item to verify the fix result.

     1. In the Risk Item panel, click Fix in the Actions column for the target check item.

     2. In the Fix Risks for Assets dialog box, configure the following settings and then click Fix Now.

        The following table describes the settings.

        Parameter	Description
        Fixing Method	The method used to fix the baseline risk item. Note The available fixing method varies by risk item type. Configure this setting based on your scenario.
        Batch Handle	Specify whether to fix the same baseline risk item on other assets in a batch.
        System Protection	Specify whether to create a snapshot to back up your system data. Warning A fix can fail and affect your business. We strongly recommend that you back up your instance before proceeding. If the fix fails and interrupts your business, use the backup to restore the instance to its pre-fix state. Automatically Create Snapshot and Fix Risk: Specify the Snapshot Name and Snapshot Retention Period, and then click Fix Now. Note Creating a snapshot incurs fees. Click Snapshot billing on the page to learn more about snapshot billing details. Skip Snapshot and Fix: To fix the baseline risk without creating a snapshot, click Fix Now.

   Roll back a fix

   If you created a backup snapshot before fixing a baseline risk item on an Alibaba Cloud ECS instance, you can roll back the changes if the fix fails and causes a business interruption. In the baseline details panel, click Roll Back in the Actions column for the instance. In the dialog box, select the snapshot created before the fix and click Confirm.

   The Roll Back operation restores the instance configuration to the state captured in the pre-fix snapshot.

   Configure whitelist

   If you confirm that a failed baseline check item does not require remediation, use the Add to Whitelist feature to suppress alerts for that risk on the target instance.

   Important

   Adding a risk item to the whitelist for an instance exempts that instance from future checks for the risk.

   For example, if the baseline check risk item is "Log in to instances with a non-root account", and your business scenario requires using the root account to log in to instances, you can add it to the whitelist.

   In the Risk Item panel for the target asset, click Add to Whitelist in the Actions column for the check item you want to handle. In the dialog box that appears, enter a reason for whitelisting, and then click OK.

   To add multiple check items to the whitelist, select the check items that have a status of Not Passed, and then click Add to Whitelist at the bottom of the list.

   You can also whitelist check items across multiple assets on the Risk Details tab:

   • Whitelist a specific check item for all assets (including new ones)

     On the Risk Details tab, find the check item in the list and click Add to Whitelist in the Actions column. Alternatively, select multiple check items and click Add to Whitelist at the bottom of the list.

   • Whitelist some assets for a single check item

     On the Risk Details tab, find the check item in the baseline check results list and click Details in the Actions column. In the instance list of the risk item details panel, select the instances you want to whitelist, and then click Add to Whitelist at the bottom of the list.

   Remove from whitelist

   To have Security Center resume alerting for an ignored baseline check configuration item, remove the ignored check item or server from the whitelist by clicking Remove from Whitelist. After removal, the baseline check configuration item triggers alerts again.

   On the Risk Item panel, locate the check item to remove from the whitelist and click Remove from Whitelist in the Actions column. In the Remove from Whitelist dialog box, click OK to remove the check item from the whitelist. Also select multiple check items to remove, and click Remove from Whitelist at the bottom of the list for batch removal.

2. Verify baseline risk handling results.

   In the Risk Item panel for the asset, click Verify in the Actions column for the target check item to verify the fix. If the verification is successful, the risk is fixed. The number in the Risk Item column for the asset decreases, and the status of the risk item is updated to Passed.

   Note

   If you do not manually verify the fix, Security Center automatically verifies it during the next scan cycle defined in your policy.