Basic security services

Vulnerability severity

Description

Scenario

Solution

Handling method

High Risk

The high-risk vulnerabilities directly threaten system security. The vulnerabilities include system vulnerabilities that are not fixed, SQL injection vulnerabilities, and weak passwords. We recommend that you take note of the vulnerabilities and fix the vulnerabilities at the earliest opportunity.

System vulnerabilities that are not fixed:

• High-risk Common Vulnerabilities and Exposures (CVE) in operating systems, such as Linux and Windows.

• Remote Code Execution (RCE) vulnerabilities that are not fixed at the earliest opportunity.

• Detect and install security patches for the operating system and software on a regular basis.

• Use the vulnerability scanning feature of Security Center to fix high-risk vulnerabilities at the earliest opportunity.

• In Linux, run the yum update or apt-get update command to install updates.

• In Windows, use Windows Update to install latest patches.

Web application vulnerabilities:

• SQL injection vulnerabilities that can directly obtain database access permissions.

• Remote command execution vulnerabilities, such as Struts2.

• Strictly validate and filter user inputs.

• Use Web Application Firewall (WAF) to protect against common attacks.

• Fix security vulnerabilities in code, such as using parameterized queries to prevent SQL injection.

• Update web frameworks and components to the latest versions.

Service configuration vulnerabilities:

• Services, such as Redis and MySQL, do not have passwords configured or are exposed to the Internet.

• Unauthorized access to Docker.

• Do not expose high-risk services, such as Redis and MySQL, to the Internet.

• Configure strong passwords for the services and restrict IP addresses that can access the services.

• Modify configuration files to bind the services to internal IP addresses or configure whitelist settings.

• Enable identity authentication features, such as the requirepass setting for Redis.

Malware:

• Malicious files such as mining trojans and backdoor programs.

• Scan for and kill malicious files in the system on a regular basis.

• Use the suspicious file detection feature of Security Center to detect suspicious files and delete malicious files.

• Delete malicious files and fix the corresponding vulnerabilities.

• Reset the passwords of the affected services.

Weak password risks:

• Services, such as SSH, Remote Desktop Protocol (RDP), and FTP, use weak passwords or the default password.

• Use a strong password policy that requires a password to contain lowercase letters, uppercase letters, digits, and special characters.

• Enable multi-factor authentication (MFA).

• Change weak passwords to strong passwords.

• Disable the default account or change the default password.

Medium Risk

The medium-risk vulnerabilities may cause harms to the system, such as Cross-Site Scripting (XSS), file upload vulnerability, and unusual logons. We recommend that you fix the vulnerabilities at the earliest opportunity.

Software vulnerabilities that are not fixed:

• Medium-risk vulnerabilities in middleware, such as Apache, NGINX, and Tomcat.

• Privilege escalation vulnerabilities in databases, such as MySQL and PostgreSQL.

• Update middleware to the latest versions on a regular basis.

• Disable feature modules that you do not need.

• Download and install official patches.

• Modify configuration files to disable high-risk features.

Web application vulnerabilities:

• XSS.

• File upload vulnerabilities that may lead to malicious file upload.

• Strictly filter and encode user inputs and outputs.

• Restrict the types of files that can be uploaded and limit the file size.

• Fix the XSS vulnerabilities in code, such as encoding outputs by using HTML.

• Add the types of files to be checked and scan for viruses.

Configuration risks:

• Web services that do not have HTTPS enabled.

• High-risk ports, such as ports 22 and 3389, that do not restrict IP access.

• Enable HTTPS-encrypted communication.

• Close unnecessary ports.

• Configure SSL certificates and enable HTTPS.

• Modify security group rules to restrict the IP addresses that can access high-risk ports.

Unusual logons:

• Brute-force behaviors, such as multiple failed logon attempts.

• Lock an account after a specific number of consecutive logon failures.

• Restrict the IP addresses that can log on.

• Configure the Fail2Ban tool of SSH to prevent brute-force attacks.

• Modify security group rules to restrict the IP addresses that can access services, such as SSH and RDP.

Data leak risks:

• Configuration files, such as .env files, contain sensitive information.

• Do not store sensitive information in plaintext in configuration files.

• Encrypt sensitive data and store the encrypted sensitive data.

• Remove sensitive information from configuration files.

• Use environment variables or Key Management Service (KMS) to store sensitive data.

Low Risk

The low-risk vulnerabilities are less harmful to your assets than high-risk and medium-risk vulnerabilities, but long-term existence of low-risk vulnerabilities may increase risks, such as configuration risks and compliance risks. You can fix low-risk vulnerabilities at your convenience.

Low-risk vulnerabilities that are not fixed:

• Low-risk vulnerabilities in the operating system or software, such as information disclosure vulnerabilities.

• Scan for and fix low-risk vulnerabilities in the system on a regular basis.

• Install official patches or updates.

Configuration risks:

• The log audit feature is disabled.

• SSL certificates are not updated at the earliest opportunity.

• Enable the log audit feature to check logs on a regular basis.

• Update SSL certificates at the earliest opportunity.

• Configure a log audit tool, such as Logrotate.

• Update SSL certificates and enable auto-renewal for SSL certificates.

Compliance risks:

• MFA is disabled.

• The compliance requirements, such as the requirements in Multi-layered Protection Scheme (MLPS) 2.0 or General Data Protection Regulation (GDPR), are not met.

• Enable MFA.

• Modify system configurations based on compliance requirements.

• Enable MFA in the Alibaba Cloud Management Console.

• Complete security settings based on the requirements in MLPS 2.0 or GDPR.

Other risks:

• Unused services or ports are not disabled.

• Disable unused services and ports.

• Run the systemctl disable command to disable unused services.

• Modify security group rules to disable unused ports.

Type

Description

Scenario

Unusual logons

Unusual logon behaviors are detected.

• Suspicious logons: ECS instances are logged on to from IP addresses that have never been used.

• Brute-force attacks: Multiple logon attempts fail.

• Logons during unusual time periods: ECS instances are logged on to during non-working hours.

Malicious files

Malicious programs or files are detected.

• Mining trojans, such as XMRig.

• Backdoor programs, such as WebShell.

• Viruses or worms: the spread of malware.

Network attacks

Network attacks against ECS instances are detected.

• DDoS attacks, such as SYN floods and UDP floods.

• Port scanning: scans the ports of ECS instances.

• Brute-force attacks, such as brute-force attacks for FTP and MySQL services.

Data leaks

Sensitive information leakage or unauthorized access is detected.

• Sensitive information leakage: Databases or configuration files are leaked.

• Unauthorized access: Unauthorized users access sensitive resources.

Configuration risks

Security risks caused by improper system or service configurations are detected.

• High-risk port exposure: For example, ports 22 and 3389 are exposed to the Internet.

• HTTPS not enabled: HTTPS encryption is not enabled for web services.

Compliance risks

Behaviors that do not meet security compliance requirements are detected.

• MFA not enabled: MFA is disabled.

• Log audit not enabled: The log audit feature is disabled.

Other alerts

Other potential security threats or suspicious behaviors are detected.

• Suspicious processes: Unknown malicious programs are running.

• File tampering: The key files of the system are tampered with.