Protecting Your Big Data on the Cloud
1 like217 views
The document outlines the security risks associated with enterprises migrating to cloud services, emphasizing threats such as data leakage and account hijacking. It details the structure and security goals of Alibaba Cloud accounts, including the importance of identity and access management (IAM) practices. Additionally, it describes the Resource Access Management (RAM) features designed to facilitate centralized user and permission management while ensuring secure access to cloud resources.
![Authorization capabilities: the minimum granularity and
the strongest control
Scenario description:
To authorize an employee to download only
the privatebucket data of OSS, the operator
must be in the internal network with MFA
logon authentication.
RAM authorization policy description
(Policy language):
A traditional access control matrix
(e.g., ACL) cannot describe
Grant what operation On what object To what user;
{
"Version":"1",
"Statement":[
{
"Effect":"Allow",
"Action":"oss:Get*",
"Resource":"acs:oss:*:*:privatebucket/*",
"Condition":{
"Bool":{
"acs:MFAPresent":"true"
},
"IpAddress":{
"acs:SourceIp":"42.120.88.0/24"
}
}
}
]
}](https://image.slidesharecdn.com/protectingyoudataonthecloud-alibabacloud-180911083535/85/Protecting-Your-Big-Data-on-the-Cloud-13-320.jpg)
Protecting Your Big Data on the Cloud
- 1. Protecting Your Data on the Cloud Derek Meng
- 2. 01 03 02Information security management of enterprise's migration to cloud Overview 04 RAM Product Design RAM User and MaxCompute Demo: Add RAM user into MaxCompute Project
- 3. CSA 2016: Top 12 security threats of enterprise's migration to cloud Data leakage AccessKey or password leakage/ Lack of IAM practices API security System and application software vulnerabilities Account sharing or hijacking Internal attacks (employees/outsourced personnel/ISVs) APTs Data loss Insufficient understanding of cloud Technologies Malicious utilization of cloud services Denial of Service (DoS) Technical module sharing https://cloudsecurityalliance.org/group/top-threats/ 1 2 3 4 5 6 7 8 9 10 11 12
- 4. About Alibaba Cloud accounts Alibaba Cloud Resources Alibaba Cloud Account 2 (Tenant2) • Basic unit for multi-tenant isolation on the cloud platform • Owner of resources (ResourceOwner) • Subject of metering and billing • Permission administrator (root) Alibaba Cloud Resources Alibaba Cloud Account 1 (Tenant1) Explanations about Alibaba Cloud accounts
- 5. Alibaba Cloud account security • Security goal of Alibaba Cloud accounts: Protect cloud resources from unauthorized access • Credentials - Password - Multi-factor authentication (MFA) - API AccessKey Alibaba Cloud Resources Alibaba Cloud Account 1 (Tenant1)
- 6. Alibaba Cloud account vs User Who is the user? Employee Alibaba Cloud Resources Alibaba Cloud Account (Buyer)
- 7. Application Alibaba Cloud Resources Alibaba Cloud Account (Buyer) App Alibaba Cloud account vs User Who is the user?
- 8. Mobile App Alibaba Cloud Resources Alibaba Cloud Account (Buyer) App Client Alibaba Cloud account vs User Who is the user?
- 9. An Alibaba Cloud service Alibaba Cloud Resources Alibaba Cloud Account (Buyer) ECS Alibaba Cloud account vs User Who is the user?
- 10. How to centrally manage the identities and access permissions of users for tenants? Question
- 11. 01 03 02Information security management of enterprise's migration to cloud Overview 04 RAM Product Design RAM User and MaxCompute Demo: Add RAM user into MaxCompute Project
- 12. RAM (Resource Access Management) Alibaba Cloud Resources Alibaba Cloud Account (Tenant) RAMApp User authorization policy User • Centralized user management • Centralized permission management • Unified access control • Centralized user audit • Unified bill RAM core features App
- 13. Authorization capabilities: the minimum granularity and the strongest control Scenario description: To authorize an employee to download only the privatebucket data of OSS, the operator must be in the internal network with MFA logon authentication. RAM authorization policy description (Policy language): A traditional access control matrix (e.g., ACL) cannot describe Grant what operation On what object To what user; { "Version":"1", "Statement":[ { "Effect":"Allow", "Action":"oss:Get*", "Resource":"acs:oss:*:*:privatebucket/*", "Condition":{ "Bool":{ "acs:MFAPresent":"true" }, "IpAddress":{ "acs:SourceIp":"42.120.88.0/24" } } } ] }
- 14. Implementation of RAM user authorization Alibaba Cloud Resources Alibaba Cloud Account (Tenant) Check PermissionApp User authorization policy User App Console or APIInternet User characteristic Request characteristic Resource characteristic