Resilience

Security Suite and Cloud Bastion Host for Enhanced Defense and Detection Against Intrusions

Security suites have been deployed on ModelArts at the host, application, network, and data layers to promptly detect intrusions.

• ModelArts uses web secure components to prevent web security risks from web applications deployed on it and uses WAF for security protection.
• Host Security Service (HSS) products have been deployed on all hosts that carry ModelArts services. These products include but not limited to Huawei-developed HSS and Compute Security Platform (CSP).
• Vulnerability Scan Service (VSS) has been deployed on ModelArts and performs routine scanning to quickly detect and fix vulnerabilities.
• ModelArts performs security O&M on cloud resources through a security management platform.
• Situation Awareness (SA) has been deployed on ModelArts to understand security situation, query attack histories, and promptly detect compliance risks and respond to threat alarms.
• Advanced Anti-DDoS (AAD) has been deployed on the EIPs that carry key ModelArts services to prevent traffic storms.
• Database Security Service (DBSS) has been deployed on ModelArts databases that store important data.

Jitter Prevention and Emergency Response and Restoration Policies Against Attacks

ModelArts isolates resources of different tenants, so that attacks on a tenant's resources will not affect others' resources.

• ModelArts provides dedicated resource pools that are physically isolated, so that attacks on a tenant's resources will not affect others' resources.
• ModelArts defines and maintains its performance specifications to defend attacks, for example, by configuring traffic control on API access.
• ModelArts provides alarm reporting and self-protection against attacks.
• ModelArts detects abnormal service behavior, for example, by detecting abnormal operations platform data and integrating security logs.
• ModelArts provides risk control and emergency response against attacks. For example, ModelArts quickly identifies malicious tenants and malicious IP addresses.
• ModelArts quickly restores services after traffic attacks stop.

Domain Name Usage Specifications and Tenant Content Security Policies of Cloud Services

ModelArts domain names meet certain security requirements to avoid compliance risks and phishing attacks.

Domain names visible to tenants: domain names accessible to tenants, which require more attention to security and compliance.

Domain names invisible to tenants: domain names used by Huawei Cloud services to call each other on the intranet, in which case external users are not able to access the authoritative DNS servers; or domain names that can only be accessed by Huawei employees, partner staff, and outsourced personnel in yellow and green zones through Huawei's office network (namely these domain names cannot be accessed over the Internet).

• Huawei Cloud basic domain names are not directly allocated to tenants but securely used.
• External domain names that have been licensed are not used by Huawei Cloud services to call each other on the intranet.