Alibaba Cloud recognizes the importance of risk assessment for customers when adopting cloud solutions to host their business systems and data. A well-defined risk assessment process ensures that potential security risks are identified and controlled within an acceptable threshold. This section provides guidance to help customers effectively conduct risk assessments through Alibaba Cloud’s security framework.

Alibaba Cloud follows the shared responsibility model, where security responsibilities between Alibaba Cloud and customers vary based on the type of cloud service selected:

Infrastructure as a Service (IaaS)

● Alibaba Cloud Responsibilities: Ensuring security of physical data centers, network infrastructure, cloud platform security, and compliance with global regulations.
● Customer Responsibilities: Securing self-built applications, workloads, business and user data hosted on the cloud. Conducting continuous security operations.

Platform as a Service (PaaS)

● Alibaba Cloud Responsibilities: In addition to IaaS responsibilities, ensuring virtual machine security, shared responsibility for application security, and integrating third-party security solutions.
● Customer Responsibilities: Securing application code, data, cloud account management, and access control configurations. Implementing security best practices in cloud application development.

Software as a Service (SaaS)

● Alibaba Cloud Responsibilities: Ensuring application security, cloud-hosted service security, and network access policies.
● Customer Responsibilities: Securing account credentials, user access policies, and data security configurations.

To effectively manage security risks, customers should:

1. Understand the division of security responsibilities when selecting IaaS, PaaS, or SaaS.

2. Leverage Alibaba Cloud’s security capabilities to enhance risk mitigation strategies.

3. Design a cloud architecture with security in mind, ensuring alignment with best practices and compliance requirements.

Alibaba Cloud provides a comprehensive suite of security tools and services to help customers implement secure cloud environments. Customers should proactively configure and utilize these security features to strengthen their cloud security posture.

Alibaba Cloud maintains a continuous compliance program to ensure adherence to international, regional, and industry security standards. Our security and compliance certifications include:

● ISO 27001 (Information Security Management)
● SOC 1/SOC 2/SOC 3 Reports
● Other global and industry-specific security attestations

Accessing Compliance Reports

● Customers can download security compliance reports from the Alibaba Cloud Trust Center after signing an NDA.
● These reports, issued by independent external auditors, assess Alibaba Cloud’s security effectiveness and control mechanisms.
● By reviewing these audit reports, customers can validate Alibaba Cloud’s security commitments and ensure alignment with their internal risk assessment frameworks.

Alibaba Cloud implements strict log management throughout daily operations, covering multiple dimensions, including host, network, application, and cloud products, ensuring that unauthorized activities and abnormal behaviors are monitored and detected in detail. This section describes Alibaba Cloud's comprehensive approach to deploying audit logging to continually enhance our security posture.

Alibaba Cloud deploys a centralized log management strategy to ensure that we achieve a holistic view of our cloud environment, enhancing both security and operational efficiency through diverse types of logs from various sources, such as servers, applications, network devices, and security systems. Alibaba Cloud O&M engineers are only allowed to perform relevant maintenance operations on the production system through bastion hosts. The entire operation process is recorded in logs. Once collected, these logs are then transmitted securely to our Central Logging Platform, which serves as a single point for storing and managing all log data.

Log analysis is the core of Alibaba Cloud's centralized log management strategy. Audit and monitoring rules are defined within the Central Logging Platform to monitor sensitive activities and detect suspicious behaviors. This process involves using advanced analytics, including machine learning algorithms, to identify patterns, anomalies, and potential security threats. Real-time monitoring and alerting mechanisms are set up to trigger alerts on the security monitoring platform and open a ticket for the security team to review and follow up, ensuring that identified risks are limited and kept under control.

Alibaba Cloud's internal centralized log management strategy plays a crucial role in ensuring log data remains protected in terms of integrity, confidentiality, and availability. This is achieved through a combination of robust security measures and best practices, including:

● Access Restrictions: Alibaba Cloud's Central Log Management Platform provides log collection and log viewing interfaces only, while modification and deletion interfaces are disabled. Access to logs is restricted to authorized personnel with approval based on the type of access, ensuring log data within the central repository is protected from unauthorized access, modification, and deletion.

● Secure Storage: Alibaba Cloud ensures that log data is stored in a protected and controlled environment, implementing strict security measures to prevent unauthorized access, tampering, or loss. Robust storage mechanisms are in place to maintain the integrity and availability of log data, ensuring it remains secure and accessible when needed. Continuous monitoring and safeguarding practices further enhance the security of stored logs, aligning with operational and compliance requirements.

● Log Retention: Alibaba Cloud determines log retention periods based on regulatory requirements, legal obligations, and business needs. Normally, most audit logs are retained for at least six months to ensure alignment with security, operational, and compliance objectives.

● Log Backup: Alibaba Cloud implements automated backup processes to reduce the risk of human error and ensure that logs are consistently and securely backed up.

Alibaba Cloud implements a robust access management framework to safeguard systems and data, ensuring that only authorized personnel gain access to specific, restricted resources. Our approach includes identifying necessary access levels, applying the principle of least privilege, continuous monitoring, and conducting regular reviews and audits of access rights. This section details Alibaba Cloud's comprehensive access management practices, underscoring our commitment to maintaining stringent security standards and protecting our customers' trust.

Alibaba Cloud's rigorous access management framework forms the foundation of our zero-trust architecture, adhering to the principles of least privilege and need-to-know. We enforce strict access controls over customer data, ensuring that employees can only access this information with explicit customer authorization. Customers maintain full control, management, and ownership of their data. Alibaba Cloud never uses or derives information from customer data for marketing, advertising, or any unauthorized purposes. Key access management practices include:

● Logical Isolation: Alibaba Cloud has implemented a robust tenant isolation architecture that defaults users to segregated environments, preventing unauthorized access to or interference with each other's data.

● Role-Based Access Control (RBAC): We employ RBAC to assign a limited set of default permissions based on an employee's position and role within the organization, ensuring that employees only have access to resources necessary for their job responsibilities.

● Automated Account Management: A centralized permission management system manages access requests, approvals, and automatic provisioning or removal of access. This system synchronizes with the Human Resources system to adjust access permissions when employees leave or change positions.

● Segregation of Duties: Within the access approval process, Alibaba Cloud enforces segregation of duties by assigning distinct roles for requestors, approvers, and management system administrators. This ensures that only appropriate permissions are granted following objective approvals.

● Multi-Factor Authentication (MFA): To add an extra layer of security, MFA is required for accessing production systems and resources. Even if a password is compromised, unauthorized access remains prevented.

● Access Review and Monitoring: Defined audit and monitoring rules within the access monitoring system analyze account usage and access permissions, detect potential misuse, and generate automated alerts to notify the security team of any deviations or exceptions. The security team is responsible for investigating alerts and taking appropriate action.

● Security Training and Awareness: Regular training on security best practices, including secure access management and recognizing phishing attempts or other social engineering attacks, is provided to all employees. This ongoing education fosters a strong security culture within the company.

Alibaba Cloud deploys comprehensive access control measures to ensure that all access to its production systems is secure, auditable, and compliant with best practices in cybersecurity. By default, employees responsible for operating these systems do not have access to customer content. Customers maintain full control over granting external and temporary access to their Alibaba Cloud resources via the management console's ticket service, where access is strictly governed by customer-configured authorization settings.

Based on the potential risks associated with different levels of access, Alibaba Cloud categorizes access permissions into three types: normal users, application administrators, and system administrators. Employees who need access to physical servers, network devices, or virtual machines must submit an application with a defined request period and receive approval from authorized personnel. Upon expiration of the access period or completion of the task, permissions are promptly revoked to prevent lingering access rights.

Access to production systems is strictly controlled and monitored. Employees can only gain entry through bastion hosts, which require two-factor authentication (2FA). All activities performed within production systems via bastion hosts are logged in real-time and transferred to a central log management platform for analysis and auditing.

Alibaba Cloud fully recognizes the critical importance of data encryption in meeting stringent data protection requirements. Our encryption solutions ensure the confidentiality, authenticity, and integrity of sensitive data through state-of-the-art cryptographic techniques. This section outlines our comprehensive end-to-end encryption mechanisms, designed to protect customer content throughout its lifecycle. These mechanisms include encryption in transit, encryption at rest, and hardware-based encrypted computing services. We are committed to continuously enhancing our technologies to align with best practices in data security and privacy.

Encryption in transit safeguards data as it moves across networks, ensuring that sensitive information remains confidential, intact, and authentic from sender to receiver. Alibaba Cloud provides multiple mechanisms for protecting data in transit, including:

● Secure Data Transmission via Management Console: The Alibaba Cloud Management Console employs HTTPS encryption for data transmissions when customers perform operations through the console, ensuring that interactions remain secure and confidential.

● Secure API Access Points: Alibaba Cloud products provide customers with API access points that support HTTPS with up to 256-bit key length encryption, addressing customers’ requirements for secure transmission of sensitive information.

● Secure Encryption Algorithms and Protocols: Alibaba Cloud provides high-security encryption algorithms such as AES-256 and cryptographic protocols like IPsec and TLS, combined with strict authentication and authorization mechanisms to prevent encrypted data from being compromised.

● Secure End-to-End Encryption: Alibaba Cloud network gateway products offer end-to-end encryption during data transmission. For instance, customers can use our VPN Gateway products to establish IPsec-VPN and SSL-VPN connections as needed, ensuring that all data transmitted over these encrypted channels remains confidential, authentic, and tamper-proof.

Alibaba Cloud offers comprehensive encryption solutions for data at rest across its services, allowing customers to encrypt stored data using advanced cryptographic techniques.

● Envelope Encryption Mechanism: This mechanism is based on a key hierarchy consisting of at least two layers:

 ○Customer Master Key (CMK): Used to encrypt or decrypt Data Encryption Keys (DEKs).
 ○Data Encryption Key (DEK): Used to encrypt or decrypt business data.

● Bring Your Own Key (BYOK): Alibaba Cloud offers multiple products that support user-managed encryption keys, including the option for customers to upload their own CMKs as part of the BYOK feature or generate their own CMKs within the Key Management Service (KMS).

● Key Protection Measures: Alibaba Cloud implements industry-standard key protection measures using its KMS infrastructure, which complies with NIST 800-57 recommendations and employs certified cryptographic algorithms and Hardware Security Modules (HSMs).

 ○HSMs used outside of mainland China are FIPS 140-2 Level 3 certified.
 ○KMS includes an automated key rotation feature, allowing customers to configure automatic rotation for CMKs.

● Encryption by Design: Data encryption capabilities are integrated across various Alibaba Cloud products, including Elastic Block Storage (EBS), Object Storage Service (OSS), Relational Database Service (RDS), MaxCompute, and File Storage NAS. For example: OSS supports both server-side and client-side encryption:

 ○Server-side encryption: OSS uses service-managed keys or BYOK CMKs to encrypt data.
 ○Client-side encryption: OSS allows customers to use self-managed keys or CMKs generated in Alibaba Cloud KMS to encrypt data before upload.

Alibaba Cloud’s robust network security strategy serves as the foundation for building trust and ensuring service reliability. To effectively mitigate network security risks, we focus on strengthening network architecture, enforcing stringent network access controls, and leveraging advanced detection and prevention mechanisms against network threats. This section outlines our multi-layered network security strategies designed to continuously optimize the security posture of our network environments.

Alibaba Cloud strategically designs network security from the initial architecture phase to ensure it is robust, scalable, and secure. We implement a multi-layered network protection approach, safeguarding different layers, from perimeter defense to internal segmentation. This layered approach isolates critical resources and reduces the risk of lateral movement by attackers, thereby enhancing overall network security.

● Network Segmentation: Alibaba Cloud implements network isolation measures to enhance security and control by dividing the network into production and non-production environments. This division prevents malicious actors from moving freely within the network. Additionally, we further segment the production network to separate cloud service networks that provide external services from the physical networks supporting underlying cloud service functionalities.

● Strict Network Access Controls: Access to the physical network from the cloud service network is disabled by default through configured Network ACLs. Alibaba Cloud also enforces strict network control measures to prevent unauthorized devices from connecting to the internal network and to prevent physical servers from initiating connections to external devices. Additionally, we deploy bastion hosts at the boundaries of the production network for centralized management and control, ensuring that all access activities within production networks are audited and recorded.

In addition to network isolation and rigorous network access controls, Alibaba Cloud deploys network intrusion detection and prevention mechanisms to safeguard against malicious network activities.

● Real-Time Network Detection and Prevention: Alibaba Cloud employs sophisticated network intrusion detection systems (IDS) at network boundaries and within internal segments to automatically monitor traffic for signs of suspicious or unauthorized activities, alerting our security team to any malicious network behavior. Additionally, we implement intrusion prevention system (IPS) rules to block malicious traffic and ensure proactive protection from threats.

● Rapid Response and Investigation: Alibaba Cloud integrates its intrusion detection and prevention mechanisms with a security incident monitoring platform, enabling rapid analysis of suspicious network activity and swift responses to intrusions. This integration minimizes the window of opportunity for attackers.

● Continuous Security Enhancements: With threat intelligence insights gained from each security incident, Alibaba Cloud’s security team continuously updates detection and prevention rules to enhance network security and stay ahead of emerging threats.

Alibaba Cloud implements a comprehensive Vendor Management program to regulate interactions with vendors and third-party employees, ensuring security throughout the vendor management lifecycle. This section outlines our robust controls before, during, and after vendor engagement, reflecting our long-term commitment to optimizing data security and compliance in vendor management.

During the vendor onboarding phase, Alibaba Cloud implements a series of stringent evaluation and security control measures focused on information security and data protection to ensure that each vendor meets our high security standards:

● Vendor Due Diligence: For vendors processing personal data, Alibaba Cloud’s security and compliance team conducts thorough due diligence. This assessment evaluates the vendor's capabilities in data security and compliance, covering their information security management frameworks, data encryption policies, access control mechanisms, incident response plans, and other relevant practices. The goal is to ensure that vendors effectively protect personal data in accordance with our defined standards.

● Contractual Security Requirements: Before commencing work, all vendors must sign a contract that outlines their rights and obligations, scope of services, confidentiality clauses, security and compliance requirements, and service levels. This contract governs the relationship between Alibaba Cloud and its vendors, ensuring clear expectations and responsibilities.

To ensure vendors continuously adhere to strict information security and data protection policies during the partnership, Alibaba Cloud has established a proactive monitoring mechanism:

● Third-Party Personnel Management: Alibaba Cloud’s vendor employees are not granted access to the internal network until they successfully complete mandatory onboarding training for information security awareness and pass a data security test. Vendor employees’ access behaviors are managed and controlled under our Access Management System, preventing unauthorized data access.

● Ongoing Compliance Monitoring: Alibaba Cloud conducts regular monitoring of vendors to ensure compliance with our information security and data protection standards throughout the partnership. For instance, data center service providers must submit monthly reports for review, covering various aspects such as access logs, major incidents, summaries of maintenance activities, and key data from monitoring systems to ensure the secure and stable operation of data centers.

● Sub-Processor List: Alibaba Cloud limits the number of vendors authorized to act as sub-processors for processing Member Content on behalf of customers. These sub-processors fall into two categories:

  ○ Alibaba Cloud affiliated entities that provide the infrastructure supporting Alibaba Cloud Products/Services.

  ○ Third-party vendors contracted by Alibaba Cloud to perform specific processing activities for certain services.Customers can access the Alibaba Cloud Sub-Processor List by logging into their Alibaba Cloud account.

Alibaba Cloud operates a global portfolio of data centers to provide highly reliable, efficient, and secure network and computing power for customers and partners. These data centers serve as the backbone of Alibaba Cloud’s more than 200 products and services. To ensure the protection of infrastructure and customer data, Alibaba Cloud has established a robust physical and environmental security program, acting as the first line of defense against threats ranging from natural disasters to malicious physical intrusions. This article outlines Alibaba Cloud’s multi-layered approach to securing its data centers and our continuous commitment to enhancing security measures.

Site Selection

Before establishing a data center, Alibaba Cloud conducts rigorous site selection assessments to identify and mitigate potential risks. Locations are strategically chosen to minimize exposure to natural disasters such as earthquakes, floods, and extreme weather events. Our Availability Zones are designed to be independent and geographically separated to enhance resilience.

Power Redundancy

To ensure 24/7 uninterrupted service, Alibaba Cloud data centers are powered by dual main supplies and redundant power systems. The primary and secondary power supplies provide equal capacity. In the event of a power failure, redundant battery packs and diesel generators are activated to sustain data center operations for an extended period, ensuring continuous service availability.

Secure Areas and Compartmentalization

Alibaba Cloud implements strict physical security controls by segmenting data center facilities into designated areas, including server rooms, office spaces, and delivery zones. Each area is compartmentalized based on sensitivity levels, with security measures increasing accordingly

Employee Access Control

Alibaba Cloud data centers are accessible only to authorized employees. Access permissions must be requested with a valid business justification and are granted based on the principle of least privilege. All access rights are time-bound and require approval from authorized personnel. Employees can only enter designated areas, and access permissions are revoked upon expiration.

Third-Party Access

Contractors and visitors must submit access requests in advance, providing business justifications. Their access is limited to approved areas and is granted based on the least privilege principle. Visitors must be escorted by authorized Alibaba Cloud staff at all times. Access permissions are automatically revoked after the approved timeframe.

Security Monitoring

Alibaba Cloud data centers are equipped with video surveillance at all key entry points, including entrances, equipment delivery areas, and critical access zones. Surveillance footage is retained according to legal and compliance requirements. In addition, access logs are regularly reviewed and securely stored to monitor entry activities and detect anomalies.

Asset Management

Alibaba Cloud has established a security management system to oversee the entire lifecycle of storage devices, from reception and deployment to maintenance, transfer, reuse, or decommissioning. Each device is logged in an asset management system and assigned an owner. Strict access controls and continuous monitoring ensure the security of all hardware assets. Regular maintenance and audits are conducted to verify compliance.

Storage Media Security

When storage media are decommissioned, Alibaba Cloud follows the NIST SP 800-88 standard for secure data sanitization. Stored data is erased multiple times to ensure permanent removal. Unneeded storage media are physically destroyed through shredding. The entire sanitization and disposal process is documented and retained for audit purposes.

Climate Control

Alibaba Cloud data centers are equipped with precision air conditioning systems that maintain optimal temperature and humidity levels. These conditions are electronically monitored, and any deviation triggers an automatic alarm, prompting immediate corrective action.

Fire Suppression

Advanced fire detection systems with thermal and smoke sensors are installed in Alibaba Cloud data centers. These sensors are positioned on both ceilings and floors and trigger audible and visual alarms when activated. Each data center is equipped with an integrated gas-based fire suppression system and fire extinguishers. Regular fire safety training and drills are conducted for data center personnel to ensure rapid response capabilities.

Flood Prevention

Alibaba Cloud data centers are constructed using waterproof materials and comply with national standards for water resistance. Buildings undergo regular inspections for moisture and leaks, with immediate remediation for any detected issues. Floors are designed with drainage systems and isolation layers to prevent flooding. Water detection sensors are strategically placed near water pipes, triggering alarms upon detecting leaks to facilitate immediate response.

Drills and Inspections

Alibaba Cloud data centers conduct regular security drills and inspections, simulating potential physical and environmental security incidents such as power outages. The results of these exercises are documented, and lessons learned are incorporated into security enhancements.

Real-Time Monitoring and Analytics

On-site personnel work in shifts to monitor Alibaba Cloud data center operations continuously. Real-time monitoring systems track environmental conditions, including temperature and humidity, as well as the performance of servers. If any parameter deviates from the standard range, automatic alerts are triggered, prompting immediate resolution by on-site staff.

Third-Party Audits and Compliance

Alibaba Cloud data centers adhere to industry-leading security standards, including ISO 27001 (Information Security Management) and ISO 22301 (Business Continuity Management). Independent third-party auditors regularly assess compliance with these standards. For more details, visit the Alibaba Cloud Trust Center and Compliance Repository.

Alibaba Cloud operates a top-tier information security system that integrates rigorous processes managed by a highly skilled incident monitoring and response team. The Incident Response Team at Alibaba Cloud is a specialized unit dedicated to managing and mitigating security incidents. This team plays a crucial role in maintaining the security and integrity of customer data by responding promptly to any unplanned events that could disrupt service quality or pose security threats.

Depending on the nature of the incident, the response team may include experts from the following fields:

● Incident Response Commander

● Incident Coordinators

● Security Specialists

● R&D & Engineering Specialists

● Legal & Compliance Specialists

● Public Relations & Government Affairs Specialists

● Customer Support Specialists

Alibaba Cloud employs continuous monitoring and advanced threat detection systems to identify and respond to security incidents in real-time. The incident response framework is designed to ensure swift and effective handling of incidents, minimizing their impact on service quality and customer experience. Alibaba Cloud’s primary goal in incident response is to manage and mitigate security incidents efficiently to ensure the continuity, availability, and security of the cloud environment.

Alibaba Cloud follows a five-step approach to effectively respond to security incidents:

1. Detection & Identification – Potential security incidents are identified using advanced monitoring tools, including Intrusion Detection Systems (IDS), Security Information and Event Management (SIEM), and anomaly detection algorithms. Suspicious activities, such as unauthorized access attempts and abnormal data transfers, are continuously monitored. Employees and users are encouraged to report irregularities.

2. Triage & Response – The Incident Response Team assesses the severity and impact of the incident. Incidents are classified based on urgency, and immediate containment measures, such as isolating affected systems and disabling compromised accounts, are implemented to prevent further damage.

3. Investigation & Analysis – Security specialists conduct Root Cause Analysis (RCA) to determine the cause and extent of the incident. Forensic analysis is performed on logs, system images, and network traffic to understand the impact on data integrity and business operations.

4. Mitigation & Resolution – The incident is mitigated by applying security patches, removing malware, and restoring affected systems from verified backups. A detailed incident report is created, documenting key findings, actions taken, and recommendations for future improvements.

5. Post-Incident Improvement – Alibaba Cloud strengthens security measures by learning from past incidents. Security policies are updated, employees undergo cybersecurity training, and proactive threat monitoring is conducted to prevent future threats.

1. Detection & Identification

Timely and accurate identification of security incidents is crucial for effective incident management. Alibaba Cloud employs real-time monitoring, automated alerts, and continuous auditing to detect and report potential security threats.

● Monitoring Tools: Security Information and Event Management (SIEM) systems, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) help identify suspicious activity.

● Anomaly Detection: Alerts are triggered for events such as multiple failed login attempts, unauthorized data access, and unexpected data transfers.

● Log Collection & Analysis: Logs from cloud hosts, networks, applications, and other infrastructure components are collected and analyzed using security monitoring algorithms.

● Incident Reporting: Employees and users are encouraged to report suspicious activities, such as phishing attempts or unusual system behavior.

2. Triage & Response

Once an incident is detected, the Incident Response Team categorizes and prioritizes it based on its potential impact.

● Incident Classification: Severity levels (low, medium, high) are assigned based on factors such as:

  ○ Cause of the breach and whether it is ongoing.

  ○ Number of affected individuals.

  ○ Type of data compromised.

  ○ Impact on business operations.

  ○ Need for external assistance (e.g., legal or regulatory response).

●Containment Measures: Immediate actions to prevent further damage, such as isolating affected systems, revoking access permissions, and disabling compromised accounts.

●Preservation of Evidence: System logs, snapshots, and other forensic data are securely stored for investigation.

3. Investigation & Analysis

Alibaba Cloud’s Security Specialists conduct a thorough investigation to understand the cause, extent, and impact of the incident.

● Root Cause Analysis (RCA): Identifies vulnerabilities, attack vectors, and exploited weaknesses.

● Forensic Analysis: Examines logs, system images, and network traffic to trace attacker activity.

● Impact Assessment: Evaluates compromised data, operational impact, potential financial losses, and regulatory implications.

4. Mitigation & Resolution

The response and recovery phase focuses on mitigating the incident and restoring affected systems.

● Remediation Efforts: Apply security patches, update configurations, and remove malware.

● Data & System Restoration: Verify and restore clean backups to ensure data integrity.

● Incident Documentation: Create a detailed report covering:

  ○ Timeline of events.

  ○ Actions taken.

  ○ Investigation findings.

  ○ Remediation measures.

  ○ Recommendations for future improvements.

● Stakeholder Communication: Notify affected users, regulatory bodies, and other stakeholders in compliance with legal obligations. Alibaba Cloud ensures transparent communication through emails, official statements, and customer support.

5. Post-Incident Improvement

Alibaba Cloud continuously refines its incident response strategy by learning from past incidents.

● Security Framework Enhancement: Policies, procedures, and technical safeguards are updated based on lessons learned.

● Training & Awareness Programs: Employees receive ongoing training on cybersecurity threats and incident response best practices.

● External Security Audits: Alibaba Cloud collaborates with third-party experts to conduct security assessments and identify areas for improvement.

● Proactive Threat Monitoring: Regular security evaluations, penetration testing, and anomaly detection are conducted to identify and mitigate potential threats before they escalate.

Alibaba Cloud operates a comprehensive vulnerability management program designed to safeguard our infrastructure, ensuring the highest levels of security and service reliability. As an integral part of our global cybersecurity strategy, this program focuses on identifying, assessing, and mitigating vulnerabilities that could potentially compromise our systems and services. This section outlines Alibaba Cloud’s multi-layered approach to vulnerability management and our commitment to continuous security enhancement.

Alibaba Cloud’s threat and vulnerability management program ensures the security of Alibaba Cloud’s infrastructure and customer environments by detecting system flaws and unauthorized actions and applying timely remediation measures. Vulnerabilities are detected and reported through multiple channels, including:

● Internal Reporting and Scanning: Our internal security mechanisms include automated vulnerability scans and manual security audits. These processes ensure that network components, servers, applications, and databases are thoroughly examined for potential vulnerabilities.

● External Reporting: We collaborate with external security entities, including the Alibaba Security Response Center (ASRC), Alibaba Cloud Crowdsourced Security Testing Platform, and third-party threat intelligence sources. These channels help us track Common Vulnerabilities and Exposures (CVEs), particularly those affecting open-source third-party components.

All identified vulnerabilities are consolidated into our security vulnerability management platform, where they undergo rigorous analysis, classification, and prioritization based on predefined security monitoring algorithms.

Once vulnerabilities are identified and verified, they are prioritized based on severity, potential impact, and exploitability. Our risk assessment and remediation process includes:

● Critical Patching: High-severity vulnerabilities are addressed with immediate patching and configuration changes through our robust patch management system.

● Long-Term Mitigation Strategies: For complex vulnerabilities requiring architectural changes or code refactoring, we implement long-term mitigation plans to ensure a comprehensive resolution.

● Configuration Management:

  ○ The security team maintains configuration standards that define baseline system hardening requirements.

  ○ These standards undergo annual reviews and updates.

  ○ Automated configuration scanning tools continuously monitor compliance, ensuring that deviations are promptly detected and corrected.

By systematically addressing vulnerabilities based on risk-based prioritization, Alibaba Cloud minimizes potential security threats while maintaining operational efficiency.

Alibaba Cloud’s vulnerability management program is a continuous process aimed at maintaining and strengthening our security posture. Key initiatives include:

● Proactive Threat Intelligence:

  ○ We leverage global threat intelligence platforms and external vulnerability databases to stay ahead of emerging security threats.

● Penetration Testing and Security Drills:

  ○ Internal red teams and external security experts conduct regular penetration tests to assess our infrastructure’s security posture.

  ○ Attack-and-defense drills systematically evaluate and enhance our threat detection and response capabilities.

●Security Training and Awareness:

  ○ We invest in continuous employee education programs to ensure that all staff members can identify, report, and respond to security threats effectively.

  ○ This security-first culture strengthens Alibaba Cloud’s ability to detect and mitigate vulnerabilities proactively.

Transparency and collaboration are essential components of Alibaba Cloud’s vulnerability management strategy. We actively engage with customers and the broader cybersecurity community to drive a cooperative approach to security:

● Vulnerability Reporting & Bug Bounty Programs:

  ○ Alibaba Cloud operates bug bounty programs that incentivize external security researchers to report vulnerabilities, enhancing our security capabilities beyond internal teams.

  ○ More details can be found at: Alibaba Security Response Center (ASRC).

● Transparent Reporting & Customer Communication:

  ○ We proactively inform customers about identified vulnerabilities and remediation efforts, ensuring transparency in security management.

  ○ Our approach fosters trust and collaboration, enabling customers to strengthen their own security defenses in response to emerging threats.