Tencent distributed cloud is deployed in the customer data center. The Ops management of the cloud environment is run by Tencent Cloud, while customers are responsible for the overall environment and network Ops of the data center. Therefore, special environmental security designs are required to meet Tencent Cloud's security management requirements and the customer's business security needs.
Cloud Dedicated Cluster (CDC) Security Management Solutions
Cabinet security: CDC supports intelligent cabinets that can implement smart door locks and remote switching for daily closure, preventing unauthorized personnel from accessing the equipment. When it is deployed in customer cabinets, a dynamic environment monitoring system is also deployed. This dynamic environment system features a door opening detection feature and 24/7 camera monitoring of the physical environment around the CDC, promptly detecting and alarming unauthorized physical access.
Device security: Each physical device is equipped with Tencent's self-developed security agents, which can detect illegal physical ports and network connections, as well as perform intelligent analysis of device operations. Unauthorized physical intrusions can be detected and alarms issued promptly.
Network security: A dedicatedVPNchannel has been established between CDC and the cloud region, controlling data transmission through the VPN channel to avoid information security risks caused by unauthorized retained traffic. At the same time, the servers and switches in the CDC only support communication through authorized ports and IPs. Tencent's internal security protection system will conduct security checks on cloud-to-cloud access to prevent intrusions. Cloud Dedicated Zone (CDZ) Security Management Solution
Cabinet security: CDZ will isolate and use cabinet enclosures at the customer data center, and arrange engineers on-site to prevent unauthorized access.
Device security: Each physical device is equipped with Tencent's self-developed security agents, which can detect illegal physical ports and network connections, as well as perform intelligent analysis of device operations. Unauthorized physical intrusions can be detected and alarms issued promptly.
Network security: CDZ and the cloud region are directly connected via a direct connection at Layer-2 to prevent network intrusion.