Hi everyone, welcome to the 7th and last chapter in our Tencent Cloud Practitioner Course, Introduction to Tencent Cloud Security Products. At the end of this chapter, you will have a better understanding of the cloud security systems, standards and technologies that are commonly used in the cloud industry. The features technical principles and advantages of Tencent Cloud security products and the billing methods of Tencent Cloud security products. In this chapter we will cover five sections Cloud Security Systems and Standards. Network Security Products, Host Security Products, Website Security Products and Mobile Security Products. This video will cover the first section, Cloud Security Systems and Standards. Subsequent videos will cover the remaining four sections. Let's get started with Section, Cloud Security Systems and Standards. In this video will cover the Basic Principles of Cloud Security. Cloud Security Standards and Technologies, Common Security Threats, Traditional Security vs Internet Security and the Tencent Cloud Security System. The three main cloud security objectives are to uphold Confidentiality, practice Integrity and maintain Availability. To achieve these objectives, security protection must be provided to reduce the Attack Surface, increase the Attack Cost and reduce the Attack Effect. Reducing the attack surface means reducing the number of services that are vulnerable to attacks. Increasing the attack cost means making it more expensive for the attacker to launch an attack, to discourage such behavior. Reducing the attack effect means minimizing the severity of the consequences of servers attacks. The Shared Responsibility Model details the responsibilities of the customer, the responsibilities of Tencent Cloud. And the shared responsibilities between the customer and Tencent Cloud for the three types of cloud services provided, Iaas, PaaS and SaaS. Tencent Cloud undertakes more responsibilities for PaaS services than for IaaS services. And Tencent Cloud undertakes more responsibilities for SaaS services than for PaaS services. There are four different well known cloud security standards and technologies, Cloud Security Alliance Security Guidance v4.0, Classified Protection Standard 2.0, Trusted Cloud Service Certification and Gardner Top 10 Security Projects. Cloud Security Alliance is an alliance forged among numerous cloud computing companies, including Tencent Cloud, that aims to establish cloud security standards. CSA version 4.0 defines two categories and 13 domains of cloud security. Describing the strategic and tactical security difficulties of a cloud environment and corresponding measures. The first category is Cloud Governance, which includes Governance and Enterprise Risk Management, Legal Issues such as Contracts and Electronic Discovery, Compliance and Audit Management and Information Governance. The second category is Cloud Operations, which includes Management Plane and Business Continuity. Infrastructure Security, Virtualization and Containers, Incident Response, Application Security, Data Security and Encryption, Identity, Authorization and Access Management, Security as a Service and Related Technologies. Classified Protection Standard 2.0, is china's information security protection requirement framework that is divided into management and technology with a focus on compliance. Management requirements include the security management unit and personnel, security construction management, security Ops management and the security policy and management system. Technical requirements include logistics and environment security, network and communications security, device and computing security and application and data security. Trusted cloud service is the only recognized certification system for cloud services in china. It's 16 metrics and 3 categories cover 90% of the problems and cloud service providers, Service Level agreements. Tencent Cloud provides many TRUCS-certified services and is among the first cloud providers to pass the TRUCS' Gold Class Operations Special Assessment. Gardner Top 10 Security Projects is an annual list released by Gardner that details each year's top 10 most important security projects across different security fields. Such as Identity and Access Management, Cloud Security, Endpoint Security, Network Security, Application Security, Data Security and Secure Operations. In 2019, The Gardener Top 10 Security Projects were Privileged Access Management, CARTA-Inspired Vulnerability Management, Detection and Response, Cloud Security Posture Management, Cloud Access Security Broker, Business Email Compromise, Dark Data Discovery, Security Incident Response, Container Security and Security Rating Services. Common security threats include virus attacks, WebShell attacks, App vulnerabilities, DDoS web attacks, Penetration attacks and data theft and Bonus hunters. In Virus attacks, hackers corrupt computer systems or system files so that they cannot be used normally by spreading malicious code, such as viruses on the internet. In WebShell attacks, hackers invade websites by exploiting vulnerabilities, implant dynamic scripts and continuously control servers through backdoor WebShells to perform various operations, such as file uploading and downloading and command execution. App vulnerabilities allow hackers to easily implant malicious code, steal sensitive information and remotely control devices. DDoS web attacks, hackers attack official websites, payment interfaces, apps and other businesses by causing their servers to crash. In Penetration attacks and data theft, hackers steal data by launching dragon drop attacks and intrusions. This type of attack is unobtrusive and durative, so massive amounts of data can be leaked before the enterprise detects the attack. In china Bonus hunters exploit and profit from the loopholes of online promotional campaigns, undermining the campaign's objectives and consuming the campaign's resources. Security threats exist at each layer of the internet business. At the Business layer there is loan delinquency fraud, in which illegal loan brokers use fake ID information to apply for consumer loans. In addition incidents such as batch registration, cheating and voucher hunting cause great losses to business platforms. At the App application layer, hackers exploit vulnerabilities in the app source code to hijack large numbers of users. Sensitive data such as payment information is exposed due to malicious code implanted in the app. At the Web application layer, developers cannot quickly fix code when website security vulnerabilities are not promptly identified. And incidents such as injection attacks and XSS attacks, can damage the public image of an enterprise and drive customers away. At the host layer, high risk loopholes and servers cannot be promptly detected or quickly fixed. Malware and back doors cannot be quickly detected on servers and servers suffer brute force attacks. At the Network layer, tenants who share the same platform are not isolated and DDoS attacks cause the server to crash and to be unable to provide services to external users. Now, let's compare the Traditional Data Center Security System with Today's Information Security System. Both types of security systems are quite similar in the sense that they face the same types of security threats. However, for the Traditional data center security system, you need to deploy everything locally as a hardware appliance. While for Today's information security system, the software defined service will manage this for you. Tencent Cloud Security System can be classified into Network Security, Data Security, Application Security, Business Security and Security Management. Network Security consists of anti-DDoS, the Anti-Virus Engine, the Spoofing Defense and Threat Perception System, the Advanced Threat Detection System and the Advanced Threat Tracing System. Data Security includes the Data Encryption Service, Sensitive Data Processing, Data Security Audit, the Data Security Gateway and the Data Security Governance Center. Application Security consists of Web Application Firewall, Web Vulnerability Scanning, Mobile Security, Mobile Game Security and Application Intelligent Gateway. Business security includes Registration and Login Protection, Verification Codes, Anti-Bonus Hunting for Promotional Campaigns, Marketing Risk Control and Anti-Fraud. Finally, Security Management consists of the Secure Operations Center, Situation Awareness, Business Risk intelligence, Security Governance and the Quantitative Assessment of Network Security Risks.
