Data Security Center (DSC) helps you assess and verify the security configuration compliance of your buckets. It checks whether critical settings, such as access control list (ACL) and encryption policies, are correctly configured and provides actionable recommendations for any detected configuration risks. Promptly address these risks to enhance the baseline security of data assets in your Object Storage Service (OSS) buckets.
Solution overview
DSC supports the following baseline risk check items for OSS buckets:
|
Policy name |
Check item |
Description |
|
Data Storage Security |
OSS-Enable server-side encryption for buckets |
Checks whether server-side encryption is enabled for the OSS bucket. You should enable encryption for data at rest to ensure its confidentiality and integrity. |
|
Data Backup and Recovery |
OSS-Enable version control for buckets |
Checks whether version control is enabled for the OSS bucket. Establish a version control and recovery mechanism to protect data availability from accidental deletion or overwrites. |
|
Access Control Management |
OSS-Enable bucket hotlink protection, OSS-Configure an access source IP address whitelist |
Checks whether the OSS bucket is publicly accessible. You should restrict access sources based on business requirements to prevent public exposure of data assets. |
|
Data Transmission Encryption |
OSS-Enable secure encrypted transmission |
Checks whether data is encrypted during transmission. You should use encryption to secure data in transit. |
|
Log Monitoring and Auditing |
OSS-Enable log storage |
Checks whether access logging is enabled for the bucket. You should enable logging to maintain a traceable record of data access for monitoring and auditing. |
|
Identity and Access Management |
OSS-Check for read/write or full control permissions for anonymous accounts |
Checks for overly permissive access, such as public read/write or full control permissions granted to anonymous users. Data access should always follow the principle of least privilege to prevent unauthorized actions. |
|
Sensitive Data Protection |
OSS-Check public read/write access for buckets with sensitive data, OSS-Check public read/write access settings for log files |
Checks for data exposure risks, such as public read/write permissions on buckets that contain sensitive data or on log files. In this guide, sensitive data detection is not run on the bucket beforehand. As a result, the OSS-Check public read/write access for buckets with sensitive data check item passes by default. |
You can complete these security baseline checks and address these risks in four steps:
-
Create an OSS bucket: Create a new bucket in the Object Storage Service console.
-
Add the OSS bucket to DSC: In Asset Center, enable the configuration risk check for the bucket.
-
Manually run a security baseline check: By default, a security baseline check runs on all connected data assets at approximately 01:00 every day. If you need immediate results, run the check manually.
-
View and address security risks: Based on the check results, promptly address any detected configuration risks.
Prerequisites
-
You have activated the Data Security Center Free Edition and granted DSC the necessary permissions to access other Alibaba Cloud resources.
The Free Edition of Data Security Center provides the security baseline check feature. It supports the check items in the Alibaba Cloud Data Security Best Practices baseline and offers 500 TB of free OSS protection per month. For this guide, you only need to activate the Free Edition.
-
You have activated Object Storage Service (OSS).
Step 1: Create an OSS bucket
-
In the Object Storage Service (OSS) console, go to the Buckets page and click Create Bucket.
-
In the Create Bucket panel, configure the following parameters, use the default settings for the others, and then click Create.
For region, select Region-specific, and then select China (Shanghai). For storage class, select Standard. For Redundancy Type, select Zone-redundant storage (Recommended). Keep the Block Public Access switch enabled. For ACL, select Private. For resource group, select default resource group. Keep version control disabled.
Step 2: Add the OSS bucket to DSC
-
Log on to the Data Security Center console.
-
In the left-side navigation pane, choose Asset Center.
-
Take the new Asset Center as an example. On the Asset Center page, in the Unstructured Data section on the left, click OSS and then click Asset synchronization.
-
After the asset synchronization is complete, find the newly created OSS bucket and turn on the Configuration Risks switch.
Wait for the Connection Status of the OSS bucket to change to Connected.
After you confirm that the Bucket Status is Running, you can click Enable All in the Actions column to turn on all data security protection switches at once.
Step 3: Manually run a baseline check
3.1. Verify the check policy
-
In the left-side navigation pane, choose .
-
On the tab, view the OSS-related check items and their status.
The PIPL-based Security Baseline Check requires an DSC Enterprise instance. This guide uses the Alibaba Cloud Data Security Best Practices baseline to check the compliance of the authorized bucket.
By default, DSC enables all check items in the baseline policy to detect risks for authorized OSS assets. In the policy list, expand the Log Monitoring and Auditing policy. You can see check items such as OSS-Enable log storage. Confirm that its switch is enabled and the status is All Enabled.
-
Confirm that the Status column for the OSS check items shows the enabled icon
.
3.2. Manually run security checks
-
On the tab, find the target policy and click Details in the Actions column.
-
On the Risk Situation tab, click Check for each OSS-related check item. The check is complete when the Check button becomes active again. Then, close the panel.
-
Repeat these steps to run checks for all relevant policies.
Step 4: View and address security risks
4.1. View check results
-
After the baseline check is complete, go to the Asset Risks tab. Search for the target bucket. You can see that five security configuration check items have passed. The check time shows when the last check was performed.
In the filter bar, set Product Type to OSS and Region to China (Shanghai). A total of nine security configuration check items are displayed, and the risk level is Medium.
-
Click Handle in the ActionsHandle
On the Compliance Check tab, the Risk Details area groups check items by risk level (Medium, Low, and No Risk). For each failed item, the Actions column contains the Recheck, Add to Whitelist, and Handle links.
4.2. Remediate risk items
-
In the Risk Details area, click Handle to go to the corresponding page and resolve the risk. For this example, resolve the OSS-Enable server-side encryption for buckets risk.
-
You are redirected to the Server-Side Encryption page for the OSS bucket. Click Settings, set the encryption method to OSS-Managed, and then click Save. For detailed instructions on configuring server-side encryption, see server-side encryption.
For Encryption Algorithm, select AES256.
4.3. Recheck to verify
Return to the risk details panel in DSC and click Recheck.
If the check passes, the risk is resolved.
You can follow these steps to remediate all remaining risk items and improve the security configuration compliance of your OSS bucket.
Summary
For any OSS bucket, you can run a security configuration compliance check before you store data in it to enhance data security.
Sensitive data protection policy
By default, the OSS-Check public read/write access for buckets with sensitive data check item passes for any bucket that has not been scanned for sensitive data. To maintain compliance after storing data, create a sensitive data detection task to periodically scan the bucket. If sensitive data is found, DSC runs the OSS-Check public read/write access for buckets with sensitive data baseline check, which allows you to promptly address any associated risks.
For more information about sensitive data detection tasks, see Scan for sensitive data by using a detection task.
The Data Security Center Free Edition provides 5 GB of free OSS sensitive data detection per month. If this quota does not meet your business needs, purchase a DSC Enterprise instance. For more information, see Purchase Data Security Center.
Whitelist management
If you determine that a failed check for a specific asset can be safely ignored, go to the Asset Risks tab. Find the target asset and click Add to Whitelist in the Actions column. This action adds the asset to the whitelist for that specific check item.
The Data Security Center Free Edition does not support the whitelist feature. You must purchase a DSC Enterprise instance to use whitelist management.