Skip to content

Latest commit

 

History

History
124 lines (73 loc) · 7.3 KB

guide.en-gb.md

File metadata and controls

124 lines (73 loc) · 7.3 KB
title excerpt updated
Public Cloud Instance security specification
Public Cloud Instance security overview
2025-01-17

Objective

In addition to the responsibility model for Public Cloud Instance, this security fact sheets aims at describing security features and functions associated to the service. It also describes best practices that customers can adopt to secure their instances based on OpenStack technology.

1. Certifications

  • ISO/IEC 27001
  • ISO/IEC 27701
  • ISO/IEC 27017
  • ISO/IEC 27018
  • HDS
  • SOC 1 type II
  • SOC 2 type II
  • CSA type II
  • C5 type II

2. Best pratices to be deployed on the service

2.1 Recommendations once the service is delivered

When you sign up for the service, we recommend that you use SSH keys to access your Instance (rather than a login/password) for a better authentication security level for your administrators and to change it regularly. For more information on how to manage your SSH keys, consult this guide.

You can use the user interface and the CLI to perform tasks. You must manage and secure your access to perform certain administrative tasks, as described in this guide.

To filter connections, you must set up a firewall using IPtables.

2.2 Vulnerability scans

You are authorized to perform vulnerability scans on the service you have subscribed to. OVHcloud doesn't have to be previously informed.
Security measures deployed by OVHcloud (especially network protection) aren't disabled, because such an audit's purpose is to demonstrate a clear vision of the security level of the customer's infrastructure.
You are not authorized to use your service to scan other infrastructures.

3. Service Level Agreement (SLA)

The SLA varies between 99.9% and 99.999% and differs between offers and ranges. Please refer to the specific terms and conditions of service for more details.

4. Backups

4.1 Technical backups

As a part of our reslience plan in the Control Plane, we perform backups to maintain our Service Level Agreement. These technical backups cannot be activated at the customer's request.

4.2 Customer data backups

Option Granularity RPO RTO Documentation
Backup of an Instance Instance Depends on the date of the last backup and the delay of incident resolution Depends on the size of the Instance Backing up an instance
Backups and restoration

5. Logs

Source Content Documentation
Control Panel Logs of interactions made by admin, technical or billing contacts in the Control Panel and services they have access to, using API calls. - https://api.ovh.com/console/#/me (see /me/api/logs)
- List of API calls done with your account
- List of API calls done on services you have access to
- Get your audit logs

6. API

Name Capacity Documentation
Control Panel and service Manage customer accounts and services on which each account has access rights. Preparing an environment for using the OpenStack API
Getting started with the OpenStack API
API Rate Limits

7. Accounts - User

7.1 Control plane

Using your customer account on the OVHcloud Control Panel, you are able to manage your service using three different contacts.
OVHcloud uses another account with an internal NIC to refer a customer having subscribed to several services.

To enforce security access to your account on the Control Panel, we recommend activating a two-factor authentication mechanism or SSO (Single Sign-On) authentication.

You can create your OpenStack users and define several roles following this guide according to your access management policy.

You have to activate and manage your tokens in order to access the Keystone API by following this guide.

7.2 Data plane

Once you get your credentials, you are autonomous to create user accounts on your OS and applications you've installed.

8. Features and options available at service delivery

8.1 OS hardening and maintenance

Public Cloud Instance is based on OpenStack technology which is managed and maintained by the OVHcloud team.

OVHcloud provides a large catalog of Operating Systems for Windows and Linux distributions. We are committed to updating our catalogue with the latest releases from editors.

The level of hardening applied refers to the basic version supplied by the editor. For an advanced level of hardening, we recommend that you refer to the guidelines published by each editor.

You also have the possibility to import your own image when you deploy your Instance with a supported format. Consult this guide for more information.

Finally, you remain responsible for monitoring your OS and applying necessary updates, upgrades and security measures on applications you've installed.

8.2 Network security

To activate a private connection, you can use the vRack option. This option could be activated at the first step when you create your Public Cloud Instance (which is recommended) or after service subcription.

You should filter and allow necessary connections by using IPtables according to your defined project architecture.

You can consult these guides to setup your configurations:

Managing firewall rules and port security on networks using OpenStack CLI. Access and security settings in Horizon. Network guides.

8.3 HDS option

The HDS option can be activated on the service.
The subscription to the Business support levelis mandatory, at least to maintain necessary requirements.

9. Reversibility

To ensure reversibility on the service, you may follow the specific reversibility policy to import and export your data in complete autonomy.

9.1 Erasure of customer data

Once you have destroyed your public Cloud project, in the OVHcloud control panel, all allocated resources are released.