See webinar recording of this presentation at: https://resource.alibabacloud.com/webinar/live.htm?&webinarId=41 A growing number of Big Data applications are deployed on the cloud, and account management is often the first security issue. In this webinar, we will discuss how to use account management systems to ensure the data security of Alibaba Cloud's big data application MaxCompute. Included in the webinar is a demo that shows users how to create a RAM sub-account, and how to assign permissions. Read more about Alibaba Cloud's Key Management Service: https://www.alibabacloud.com/product/key-management-service

1. Protecting Your
Data on the Cloud
Derek Meng

2. 01
03
02Information security
management of
enterprise's migration to
cloud
Overview
04
RAM Product Design
RAM User and MaxCompute Demo: Add RAM user into
MaxCompute Project

3. CSA 2016: Top 12 security threats of enterprise's migration to cloud
Data leakage
AccessKey or password leakage/
Lack of IAM practices
API security
System and application software
vulnerabilities
Account sharing or hijacking
Internal attacks
(employees/outsourced
personnel/ISVs)
APTs
Data loss
Insufficient understanding of cloud Technologies
Malicious utilization of cloud services
Denial of Service (DoS)
Technical module sharing
https://cloudsecurityalliance.org/group/top-threats/
1
2
3
4
5
6
7
8
9
10
11
12

4. About Alibaba Cloud accounts
Alibaba Cloud Resources
Alibaba Cloud Account 2
(Tenant2)
• Basic unit for multi-tenant isolation
on the cloud platform
• Owner of resources
(ResourceOwner)
• Subject of metering and billing
• Permission administrator (root)
Alibaba Cloud Resources
Alibaba Cloud Account 1
(Tenant1)
Explanations about Alibaba Cloud accounts

5. Alibaba Cloud account security
• Security goal of Alibaba Cloud accounts:
Protect cloud resources from unauthorized access
• Credentials
- Password
- Multi-factor authentication (MFA)
- API AccessKey
Alibaba Cloud Resources
Alibaba Cloud Account 1
(Tenant1)

6. Alibaba Cloud account vs User
Who is the user?
Employee
Alibaba Cloud Resources
Alibaba Cloud Account
(Buyer)

7. Application
Alibaba Cloud Resources
Alibaba Cloud Account
(Buyer)
App
Alibaba Cloud account vs User
Who is the user?

8. Mobile App
Alibaba Cloud Resources
Alibaba Cloud Account
(Buyer)
App
Client
Alibaba Cloud account vs User
Who is the user?

9. An Alibaba Cloud service
Alibaba Cloud Resources
Alibaba Cloud Account
(Buyer)
ECS
Alibaba Cloud account vs User
Who is the user?

10. How to centrally manage the
identities and access permissions
of users for tenants?
Question

11. 01
03
02Information security
management of
enterprise's migration to
cloud
Overview
04
RAM Product Design
RAM User and MaxCompute Demo: Add RAM user into
MaxCompute Project

12. RAM (Resource Access Management)
Alibaba Cloud Resources
Alibaba Cloud Account
(Tenant)
RAMApp
User
authorization
policy
User
• Centralized user
management
• Centralized permission
management
• Unified access control
• Centralized user audit
• Unified bill
RAM core features
App

13. Authorization capabilities: the minimum granularity and
the strongest control
Scenario description:
To authorize an employee to download only
the privatebucket data of OSS, the operator
must be in the internal network with MFA
logon authentication.
RAM authorization policy description
(Policy language):
A traditional access control matrix
(e.g., ACL) cannot describe
Grant what operation On what object To what user;
{
"Version":"1",
"Statement":[
{
"Effect":"Allow",
"Action":"oss:Get*",
"Resource":"acs:oss:*:*:privatebucket/*",
"Condition":{
"Bool":{
"acs:MFAPresent":"true"
},
"IpAddress":{
"acs:SourceIp":"42.120.88.0/24"
}
}
}
]
}

14. Implementation of RAM user authorization
Alibaba Cloud Resources
Alibaba Cloud Account
(Tenant)
Check PermissionApp
User
authorization
policy
User
App
Console or
APIInternet
User
characteristic
Request
characteristic
Resource
characteristic