Adding an Emergency Policy

Scenario

Emergency policies are used to quickly prevent attacks. You can select a block type based on the alert source to block attackers. Table 1 lists recommended settings. You can also block a single attack source based on the comprehensive investigation of multiple alerts.

This topic describes how to add an emergency policy.

Limitations and Constraints

• A maximum of 300 emergency policies that support block aging can be added for a single workspace you have. A maximum of 1,300 emergency policies can be added for a single workspace you have. Limits on blocked objects at a time are as follows:
  • When a policy needs to be delivered to CFW, each time a maximum of 50 IP addresses can be added as blocked objects for each account.
  • When a policy needs to be delivered to WAF, each time a maximum of 50 IP addresses can be added as blocked objects for each account.
  • When a policy needs to be delivered to VPC, each time a maximum of 20 IP addresses can be added as blocked objects within 1 minute for each account.
  • When a policy needs to be delivered to IAM, each time a maximum of 50 IAM users can be added as blocked objects for each account.
• If an IP address or IP address range or an IAM user is added to the blacklist, CFW, WAF, VPC, and IAM will block requests from that IP address or user without checking whether the requests are malicious.
• After an emergency policy is added, its blocked object type and blocked objects, such as IP addresses, IP address ranges, or IAM user names, cannot be modified.

Adding an Emergency Policy

1. (Optional) Create a SecMaster agency.

   If the blocked object is an IAM user, you need to create a SecMaster agency before adding an emergency policy.

   1. Log in to the management console.
   2. Click in the upper left corner of the page and choose Management & Governance > Identity and Access Management.
   3. Add a custom policy.
      1. In the navigation pane on the left, choose Permissions > Policies/Roles. In the upper right corner of the displayed page, click Create Custom Policy.
      2. Configure a policy.
         • Policy Name: Enter a policy name.
         • Policy View: Select JSON.
         • Policy Content: Copy the following content and paste it in the text box.

           1 2 3 4 5 6 7 8 9 10 11 12

           { "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "iam:users:updateUser", "iam:users:listUsers" ] } ] }

      3. Click OK.
   4. Create an agency.
      1. In the navigation pane on the left, choose Agencies. On the page displayed, click SecMaster_Agency. The Basic Information page of SecMaster_Agency is displayed by default.
      2. On the Permissions tab page, click Authorize.
      3. On the Select Policy/Role page, search for and select the policy added in 1.c and click Next.
      4. Set the authorization scope. Select All resources for Scope. After the setting is complete, click OK.

2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the navigation pane on the left, choose Risk Prevention > Security Policies. Then, click the Emergency Policies tab to go to the emergency policy page.
   Figure 2 Emergency Policies
   

5. On the emergency policy page, click Add. The page for adding policies slides out from the right of the page.
6. On the displayed page, configure policy information.

   Table 2 Policy parameters

   Parameter	Description
   Blocked Object Type	Type of the object you want to block. You can select IP or IAM.
   Block Object	If you select IP for Blocked Object Type, enter one or more IP addresses or IP address ranges you want to block. If there are multiple IP addresses or IP address ranges, separate them with commas (,). If you select IAM for Blocked Object Type, enter IAM user names. There are some restrictions on delivery of blocked objects: When a policy needs to be delivered to CFW, each time a maximum of 50 IP addresses can be added as blocked objects for each account. When a policy needs to be delivered to WAF, each time a maximum of 50 IP addresses can be added as blocked objects for each account. When a policy needs to be delivered to VPC, each time a maximum of 20 IP addresses can be added as blocked objects within 1 minute for each account. When a policy needs to be delivered to IAM, each time a maximum of 50 IAM users can be added as blocked objects for each account.
   Label	Tag of the custom policy.
   Operation Connection	Asset connections that are used to operate blocking workflows of security services in the seven layers of defense. Select the operation connection for the policy.
   Block Aging	Check whether the policy needs to be stopped. If you select Yes, set the aging time of the policy. For example, if you set the aging time to 180 days, the policy is valid within 180 days after the setting. After 180 days, the IP address/range or the IAM user will not be blocked. If you select No, the policy is always valid and blocks the specified IP address/range or the IAM user.
   Policy Description	Description of the custom policy.

7. Click OK. In the dialog box displayed, confirm the information and click OK.