14

Security Command Center

In this chapter, we will look at the capabilities of Google’s Security Command Center. The exam typically has questions on how to configure and use Security Command Center (SCC) to monitor the security posture of your Google Cloud organization. You may also get questions on how to detect threats and vulnerabilities in your cloud environment and workloads. This is one of the critical aspects of security operations, so make sure you understand it very well.

In this chapter, we will cover the following topics:

• Overview of SCC
• Core services:
  • Cloud Asset Inventory
  • Detecting security misconfiguration using Security Health Analytics
  • VM Manager
• Rapid vulnerability detection
• Threat detection
• Continuous compliance monitoring using SCC
• Exporting SCC findings
• Automating findings response

Overview of SCC

Google introduced SCC in mid-2018. SCC provides many features to monitor your organization’s security controls, detect threats, and use alerts to automate security responses.

Here are some of the key features of SCC:

• Gain centralized visibility and control over your Google Cloud data and resources:
  • SCC gives enterprises centralized visibility of their cloud assets across App Engine, BigQuery, Cloud SQL, Cloud Storage, Compute Engine, Identity and Access Management (IAM) policies, Google Kubernetes Engine (GKE), and more.
  • SCC enables enterprises to quickly find out the number of projects in their environment, what resources are deployed, where sensitive data is located, and which service accounts have been added or removed. You can leverage the SCC REST API to access assets and findings and make it easier to integrate with existing systems.
  • You can view your Google Cloud asset history to understand exactly what changed in your environment and respond to...

Core services

Core services contribute to various parts of the security architecture of your Google Cloud organization for detection and alerting. The following diagram shows the core services offered by SCC.

Figure 14.1 – SCC core services

As shown in Figure 14.1, SCC is a collection of various modules providing detection and alerting capability:

• Cloud Asset Inventory (CAI): CAI provides full visibility of all assets in your Google Cloud organization. You can search by type of resources, projects, and locations. CAI also provides all IAM policies in your Google Cloud organization.
• Vulnerability Findings: You can detect misconfigurations and vulnerabilities in your Google Cloud organization using SHA, VM Manager, WSS, and Rapid Vulnerability Detection.
• Event Threat Detection (ETD): ETD is a collection of threat detection capabilities that provides alerts on threats to your Google Cloud organization. It will also alert threats to...

Cloud Asset Inventory

CAI provides a list of asset metadata for your cloud resources based on when they were created and/or updated. Note that the roles in SCC are assigned at various levels of your Google Cloud resource hierarchy. The amount of access you have determines your ability to see, edit, create, or change findings, assets, and security sources. Typically, security operations have access to see findings at the organization level, while project teams have access to see findings at the individual project level.

As a member of the security team, you need to know how to query assets to be able to quickly find what has changed in your cloud environment. For example, it would be highly suspicious behavior if you found accelerator-optimized machines (GPUs and HPC) being unexpectedly provisioned.

Let us go over various features of CAI so you can understand how it works and how to use it.

Listing assets

Assets are Google Cloud resources within your Google Cloud organization...

Detecting security misconfigurations and vulnerabilities

Most of the cloud threats that you will find will be due to security misconfigurations or a lack of understanding of how the cloud works. So, it is critical to understand how to find misconfigurations and how to quickly analyze and fix them. SCC reports findings from four categories of detectors:

• Security Health Analytics
• Rapid Vulnerability Detection
• Web Security Scanner
• VM Manager vulnerabilities

Now let us look at each of them to understand the details.

Security Health Analytics

SHA is a service within SCC that has built-in detectors to identify misconfigurations. SHA automatically scans your Google Cloud organization for known vulnerable configurations against compliance benchmarks such as CIS, PCI DSS, NIS 800-53, ISO 27001, and the OWASP Top 10. SHA scans begin around an hour after SCC is turned on and can be done in one of two modes: batch mode, which conducts scans twice a day, 12 hours...

Threat detection

Google Cloud provides several types of threat detection via SCC Premium:

• Event Threat Detection
• Container Threat Detection
• VM Threat Detection
• Anomaly Detection

Let us start with ETD.

Event Threat Detection

Event Threat Detection (ETD) is a built-in feature of the SCC Premium tier that watches your Google Cloud environment in real time and detects threats within your systems. New detectors are added to ETD regularly to discover emerging threats at cloud scale.

ETD produces security findings by matching events in your Cloud Logging and Google Workspace log streams to known indicators of compromise (IoCs). IoCs, developed by internal Google security sources, identify potential vulnerabilities and attacks. ETD also detects threats by identifying known adversarial tactics, techniques, and procedures in your logging stream, and by detecting deviations from the historically observed behavior of your Google Cloud organization.

Here are...

Continuous compliance monitoring

In a regulated organization, compliance takes precedence as it is mandated by regulations; however, compliance is now generally enforced by all security-conscious organizations, regardless of regulations. SCC provides the ability to continuously monitor your Google Cloud compliance posture by doing the following:

• Identifying compliance violations in your Google Cloud assets helps you resolve them by following actionable suggestions
• Reviewing and exporting compliance reports to ensure all your resources are meeting their compliance requirements
• Supporting compliance standards, such as these:
  • Payment Card Industry Data Security Standard (PCI DSS v3.2.1)
  • International Organization for Standardization (ISO 27001)
  • National Institute of Standards and Technology (NIST 800-53)
  • Center for Internet Security (CIS) 1.0 and 1.1 benchmarks

Now let us look at how SCC supports these standards.

CIS benchmarks

SCC supports the following CIS benchmarks...

Automating a findings response

Google provides procedures for the following four types of SOAR products for exporting SCC alerts and findings:

• Palo Alto Cortex XSOAR
• Elastic Stack
• Splunk
• IBM QRadar

However, you can set up an integration using Pub/Sub to any other product if it can ingest and parse the Pub/Sub message.

Figure 14.2 – Automating SCC response

Figure 14.2 shows an architecture of a simple workflow to automate a response based on SCC alerts and findings. The steps in the workflow are listed as follows. Each of these steps represents an action that can be taken either manually or automated. Understanding the various categories of threats and vulnerability findings is critical before building such a workflow.

Let us quickly run through these steps:

1. SCC alerts and findings are exported to the SIEM tool of your choice. As you saw in the previous section, you can export alerts and findings using continuous...

Summary

In this chapter, we went over several capabilities of SCC. We learned how to use CAI, set up an export to BigQuery, and run SQL queries to understand your environment. We also went over how to detect security misconfigurations using SHA, VM Manager, WSS, and Rapid Vulnerability Detection. These are all critical capabilities before a security misconfiguration vulnerability becomes a threat. We learned about the threat detection capabilities of SCC in the form of ETD, CTD, VMTD, and anomaly detection. We also covered continuous compliance monitoring to understand how to apply industry standards to your cloud environment. Finally, we explored a simple architecture pattern for alerting.

In the next chapter, we will cover container security and look at how security measures are taken to protect containers and the applications and data that reside in them. This includes preventing unauthorized access and mitigating the risk of malicious code or attacks, as well as ensuring that...

Further reading

For more information on Google Cloud Security Command Center, refer to the following links:

• Event Threat Detection rules: https://packt.link/Oeyqd
• Sensitive IAM roles and permissions: https://packt.link/5V1TK
• Useful BigQuery queries for SCC findings: https://packt.link/n8rwU
• Creating charts in Google Looker Studio for findings: https://packt.link/esxM2