[MUSIC PLAYING]
MEGAN YAHYA: Hello, and welcome to the Google Cloud Advanced
Network Security Demo Series.
Today, we are going to talk about Cloud Firewall Plus.
My name is Megan Yahya, and I'm a product manager
at Google Cloud.
And I'm here with Nicolas Bedard,
who's a customer engineer.
We have heard from many of our customers
about the importance of network threat detection
and prevention in their cloud environment
as a must-have for protecting their workloads.
As we talked with more customers,
it was clear that they had three core areas of need
when it came to network threat detection and prevention.
The first was the need for complete visibility and control
as they transitioned from primarily
perimeter-based inspection to inspecting traffic
within their cloud environment.
And really, what they want is to do that even
between the workloads.
It is also important to be able to prevent threats even
if the threats are encrypted.
Second, our customers asked us for a solution that
was easy to deploy and manage.
It was clear that they didn't want
to roll up their own solutions, manage,
and scale fleets of workloads or have to deal with bringing
their own open source rules.
They wanted a fully managed solution.
And finally, they were not willing to compromise
on security efficacy.
With the increasing sophistication of threats
and the massive volume of new malware variants being
introduced every day, they absolutely
needed a system that provided amazing protection,
proven detection and inspection capabilities
with very low noise.
Today, we are Introducing Google Cloud Firewall
Plus, which is a cloud-native and easy and fast to deploy
product.
It provides you with scalability and performance, as well as
availability and reliability.
Our intrusion prevention capabilities
are built on top of the existing stateful
and distributed cloud firewall, which
enables users to leverage the hierarchical policies
and [? IAM ?] back tags, providing them
with flexible insertion with no need for rerouting
or reconfiguration.
We're using a new technology called packet intercept that
is part of Google's software-defined networking
to redirect traffic flows to firewall endpoints that
are located in the same zone as the workload.
This helps bring detection and prevention
as close to the workload as possible,
providing north/south and east/west visibility
and control next to the VM interface level.
We have partnered with Palo Alto Networks Technologies
to make sure we are not compromising on security
efficacy and protect you against any kind of exploits, threats,
and command and control attacks from day one.
We have built-in TLS inspection capabilities
to make sure no threats go undetected.
We provide you with the alerts in the UI,
as well as in Cloud Logging, which provides you with APIs.
With that, I pass it to Nicolas to walk you
through more information about the underlying architecture
and a demo.
NICOLAS BEDARD: Thank you, Megan.
To configure Firewall Plus with IPS,
you will need to follow these steps.
First, we need to enable one firewall endpoint
and attach it to your VPC.
The firewall endpoint is a Google-managed Palo Alto
Network VM that provides firewall and intrusion
prevention services.
Second, you will need to create a threat prevention security
profile.
This is where you will specify the action
to take on traffic that matches specific threat
signatures or severity level.
You can allow, deny or alert on traffic.
Third, you will need to create a security profile group.
Security profile group will be applied onto firewall policies.
And in step four, you will need to enable Cloud Firewall Plus
IPS into the firewall policies.
Step number five, you will be able to view
all of the threat logs in Firewall Manager
or in Cloud login.
Step number one, two and three must
be done at the organization level, where
step number four can be done at both org level
or at the project level.
Finally, you can send the threat logs to your security operation
tool using a [INAUDIBLE] and Pub/Sub or the Chronicle
native integration.
I would also like to bring to your attention
that enabling Cloud Firewall Plus IPS will not require
any architecture change.
So no special routing, no special load
balancing to change in your existing topology.
Google take care of this in the back end.
All you need to do is to turn it on your existing security
policy.
Now, let's get into my demo lab.
It's built over three main components.
Number one is a Google Cloud project
with two virtual machines, one web server
VM and one compromised VM.
And second, we have a Cloud Firewall Plus Endpoint
with IPS configuration.
Finally, we have the security operation tools using
Chronicle, SIEM, and SOAR.
The web server is accessible internally
and from the internet using an application load
balancer and Cloud NAT.
The compromised VM will attack the web server
from both the internet and from the internal network.
So this will demonstrate Firewall Plus capability
to protect against North-South as well as East-West traffic.
The firewall policies will capture VM traffic
and send it to the firewall endpoint for threat inspection.
The firewall endpoint will apply the security profile action,
then signature override, and then send back the payload
to the destination, alert or block the traffic.
It will also send all of the logs
to Cloud Logging, where Logging Sync will forward them
to Pub/Sub in order to push to external security tool.
For Chronicle, it's even faster as the firewall logs
are exported automatically at the org level using
a one-time access code option in the Chronicle page
within the Google Cloud Console.
This will allow my security operation team
to collect and analyze the threat logs to detect
and response to incident.
You can also send all of these logs to BigQuery
and create an analytics dashboard
using the Looker that are published on the marketplace.
In this demonstration, I will first
create a security profile in Alert mode only.
I will also show you how to override the action
for a specific signature.
Then I will change the security profile from Alert
to Block mode in order to demonstrate how Firewall
Plus can now block threats.
Now let's go in the console and see how we
can achieve this configuration.
In my Console step number one is to enable the firewall endpoint
and associate it with the proper network VPC.
So in the menu, on the left, you now
see that Firewall Plus has new options available--
Threats, Firewall Endpoints, and Security Profiles.
Firewall Endpoints and Security Profile
has to be configured at the org level.
So let's go and create the firewall endpoint.
In order to do that, you simply need
to click Create and select the region, the zone,
and give it a name.
In my case, it's already done.
Then the second step is to associate a VPC to it.
If we go into the VPC menu, you will find a new menu here
called Firewall Endpoint.
Into that Firewall Endpoint menu,
you will have an option to add a firewall endpoint association.
This is where you are going to associate
your org-level firewall endpoint to your VPC level project.
So simply click Add Endpoint, select the region, the zone,
and in the list, you will select the firewall endpoint
that you previously configured.
So now that is done, let's go to step two.
Step two is to create security profile.
In order to create security profile,
we click in the Security Profile menu on the left,
and you will have two options--
Security Profiles and Security Profile Groups.
So step two is to create security profile.
In this case, I already created two security profiles, one
in Alert and one in Block mode.
Let's go and review the configuration
for this security profile.
As you can see, we have two options
when we configure a security profile.
We have the security overrides, and we
have signatures override.
Security override is where you tell what is the override
action that you want to take when
a specific threat or vulnerability is being observed
by IPS.
So in my case, in my lab, I want to alert on everything
to start.
But I want to block any Log4j threats.
So what I did is I configured from Informational to Critical,
the severity override, and I set that to alert.
And the signature override--
I used three distinct signature that
are known to be Log4j attack.
And I configured them as a Deny action.
If I go back and click to the Block menu
for the security profile, you will
see that I configured everything from Informational
to Critical to Deny.
And this time, I don't have any signature overwrite
I don't need them because I'm already blocking everything
on the signature override.
So now that my two security profiles are configured, let's
see how we can use them in the firewall policies.
In order to use them in the firewall policies,
you need to create a security profile group.
The security profile group will be the one used in the firewall
policy, but you need to attach it
to a threat prevention profile.
So in this case, to start the demo,
I associated the alert security profile with my profile group
number one.
And I will reuse them in the firewall policy right after.
So now that that's being done, let's
go in the Firewall Policy menu and see how we can use it.
So if we go into the Firewall Policies menu,
you can see all of the rules that I created in order
to have my lab working.
There is two use cases that I want to demonstrate today
in this demo, and it is the ability of Firewall Plus
to block threat coming from external as well as internal.
For these two specific use case, I
created two security policies, the number 800
and number 901, one to allow ingress traffic,
coming from the internal, and the other one
to allow an ingress traffic, coming
from the external-- in this case, the external
being my Cloud NAT gateway.
So as you can see, this is a typical firewall rule,
where the action is either allow or deny.
This is no different for these two rules.
I want to allow it right now.
But I want now to inspect it.
So what I'm going to do is I'm going
to update these two rules in order
to have the traffic inspected by Firewall Plus IPS.
So when we see the Action on Match menu
has changed a bit with Firewall Plus,
we now have a menu called Proceed to L7 inspection.
So, for this rule, I'm going to change it to this new option
and I'm going to select the security profile group
one that I created previously.
So I'm now going to select this one here,
and I'm going to change the other one as well.
Here, Proceed to L7 Inspection, security profile group,
and then Save.
Now I have my two rules that are showing Proceed to Layer
7 Inspection instead of Allow.
So if I refresh my page here, we'll
be able to see that instead of having an Allow,
we have Proceed to L7 Inspection with the proper security
profile group.
Now let me generate some threats in the back end
in order to kick in these tools.
OK, the threats are generated.
Let's see in the threat menu how it looks like.
So if I click on the menu Cloud Firewall Threats,
I get to this page, where I see the details of everything that
was triggered by Firewall Plus.
I can see the severity, the timestamp, the threat name,
as well as the type and some information.
If we go to the right, we will see
that all of the action that my threats generated
are Alert instead--
oh, we see one that is dropped.
Let's go and see--
OK, this one that was dropped is an Apache Log4j,
exactly what I asked the security profile to do.
So it is alerting everything, but blocking Apache Log4j.
Now what happens if I want to block everything?
Instead of going into this firewall policy again,
the only thing I need to do is to change the security profile
within the profile group.
So let's go back into the menu.
And I'm going to change from Alert to Deny.
So if I click this, and I click Edit, instead of Alert
I'm going to select the Block security profile
and see what it's doing.
So I simply update this one, and I'm
going to regenerate-- once it's done,
I'm going to regenerate my threats.
So let's regenerate the threats in the back end.
That's done.
Now I'm going to go back in the threat menus
and see what is the result of this modification.
You can see that we have the same menu,
but if we scroll to the left, now all of the threats
are now set to action drop, the Log4j one and the other one
that I used.
So this is exactly working as expected.
So I was not forced to change the firewall policy.
I only needed to change the policy group.
Then it had an impact the flow of traffic
that was allowed or blocked.
Now if I want to see all of these logs
in the console, what I can do is I
can click View Audit Log, which will bring me
to the Cloud Logging menu.
And I will be able to see the full JSON payload
of this specific threat.
So if I go there and I expand this,
I will have all of the detail that
is required for me to do some incident response.
So all of the data that will be eventually sent
to my SIEM, my SOAR, or to Chronicle,
you can have access to all of this in Cloud Logging.
From Cloud Logging, you can even create the log routing sync
directly from the menu, and then you
will be able to send it to your SIEM or your SOAR.
So that's it.
Thanks for watching.
To learn more about Cloud Firewall Plus, please
check out the documentation link in the description.
[MUSIC PLAYING]