[MUSIC PLAYING]
ABHI YADAV: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Abhi and I'm a Product Manager
at Google Cloud.
Today we'll be walking you through one
of the top questions we get from customers.
How do I reduce and discover over-provisioned access
to cloud resources?
Cloud admins assign access using roles that contain permissions.
They can create their own roles, which are called custom roles,
or use predefined roles that we ship with our services.
Let's take an example.
Kevin is somebody who is in my organization has the Kubernetes
Engine admin role.
He's a member of the admin team, so I
assume this is the right role for him to manage my Kubernetes
environment.
This role has 296 permissions.
I'm not sure which one he needs, but let's give him this role
because it sounds right.
Although, I'm not entirely sure.
Here's where IM Recommender comes in.
It helps security professionals identify and remove
unwanted access to GCP resources using machine learning
to make smart access control recommendations,
right here in the IM page.
The Recommender is now going to show you
how many permissions I have given
and what is actually being used.
There is no need to collect and pass through activity logs.
We've done all that hard work for you.
We now simply show you this data right here next
to the user's assigned role.
And it looks like most of my users in the project are OK.
There are few that are using a lot less than they
were granted.
And this is amazing feedback.
But wait, we can go even further.
You will see here that four light bulbs have popped up.
This is where our ML models have found
a recommendation for a better fitting role automagically
in the background.
I had to do no work at all.
So here it's showing me that Kevin was given the Kubernetes
Engine admin role that has 296 permissions,
but he's only using six of them.
IM Recommender is telling me that I must change his role
to reduce my security risk.
And if I want further details, I can simply click here
to get more information.
Here, the tool shows me the analysis
behind the recommendation.
It suggests that Kevin should be moved from the Kubernetes
Engine Admin role to the Kubernetes Engine Clustered
Admin role and why by highlighting the permissions
that are not needed in red.
And it's using ML to determine permissions
that Kevin is likely going to need based
on similar users in the organization and their access
patterns.
This helps make sure that Kevin does not miss out
on permissions and he does not have to come back
to request more later on.
So he can get his job done right.
And, as you can see, this role reduces my
over granting attack surface by 95%.
I just need to hit Apply to make the change.
Service accounts is another area where
we see a lot of over granting.
Service accounts are machine identities
that apps and services use to access your data.
These are often overlooked and what attackers
may take advantage of in a breach.
In this project, I see there's a service
account called a Logging agent.
It has the Editor role, which grants a lot of access,
but it has only used one permission in the last 90 days.
So let's see if there's a recommendation.
In this case, I see there's a recommendation
to change the role to Logs Writer
role, which seems like the right role for the service account.
So I'm happy to hit Apply right away.
Today, we talked about how IM Recommender helps
remove over-provisioned access for roles and service accounts.
It's our modern entitlement analysis solution
for the cloud, delivered entirely
as a managed service that helps you have a smarter security
experience on Google Cloud Platform.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]