[MUSIC PLAYING]
ANDY CHANG: Welcome to the Google Cloud Security Showcase,
a special web series, where we'll
focus on security use cases that customers
can solve with Google Cloud.
My name is Andy, and I'm a Product Manager
at Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers.
How do I detect and respond to threats
inside and outside my GCP infrastructure?
The Cloud Security Command Center, Cloud SEC,
is a security management and data risk
tool for GCP resources that helps you prevent, detect,
and respond to threats from a single pane of glass.
To help you detect threats, Cloud SEC
gives you native scanners like Event Threat Detection
and Cloud Anomaly Detection to identify suspicious activity
and help you take action.
To see if there are any threats in GCP resources,
you'll need to go to the Cloud SEC Security Settings page,
and look under the Security Sources.
There you'll see which of the detectors are enabled.
Here you can see that we've explicitly
enabled Event Threat Detection and Cloud Anomaly Detection.
Event threat detection leverages the logs from your Stackdriver
installation and then processes those
against industry-leading and proprietary threat intelligence
provided by Google.
And we can detect things like cryptomining, unauthorized
access to GCP resources, outgoing DDoS attacks,
port scanning, and brute force SSH.
To dive this in a little bit more detail,
we're able to explore, for example,
one of these persistent grants.
Here this takes us to specifically
the Findings Inventory page, where we're
able to look for event detection,
see the different persistent grants.
And as we specifically investigate one of them,
we're able to see when it was discovered.
We're able to see what resource, what project, this IM grant was
made in, that it is an active threat,
that it was detected by Event Threat Detection,
that the source of the data is audit logs, that a member was
added to a policy.
And this is an example of persistence as a TTP.
It has a high level of priority.
We can specifically see the ad and the user that
was added from outside domain and the actual person who
did the underlying add.
With this information, we're now able to understand better
whether this is something that is truly an additional threat
and requires more investigation or something
that was normal and OK for that particular resource.
In addition, we can look at things from Cloud Anomaly
Detection.
So again, from the Summary Card, Cloud Anomaly Detection
gives you an overview of the different threats
that have been seen.
We can dive into that in more detail as well.
You will see the examples of the different threats
Cloud Anomaly Detection can find--
outgoing intrusion attempts, Bitcoin mining,
unusual activity, data exfiltration, alerts and risks,
compromised instances and resources,
leak credentials into GitHub, and then resources
used for phishing.
So if we explore the resources involved in coin mining
detection, we'll see that back in March
we were able to find an example of what we thought
is coin mining on this particular project
in this particular instance.
We tell you the specific project that it was impacted on,
whether it's an active or inactive threat, how
it was detected, what the actual IP was from the coin mining
pool that was targeting the organization,
similarly what was the public IP and the actual instance that
was the target of the compromise,
and the type of mining pool.
In both these cases, you can take action
by sending the results for more detailed investigation
into a Sim, for example, Splunk.
We provide, as a sidecar application,
the ability for you to directly take Command Center results
into Splunk through a Splunk connector.
So if we go to the Splunk Connector Project,
this is set up as an app engine application
with a number of cron jobs that can either
on demand or on a scheduled basis,
as you see here, every 24 hours, run an ingestion of Command
Center data into Splunk.
We can also do a streaming output from Command Center
directly to Splunk.
So if we were to say, run this ingestion of all the threat
data today, we can then go into Splunk.
And what you'll see is that you can
search for things like the anomaly detections
that we just found, as well as you
can find the ETD detections, such as the persistent
anomalous grant.
So with that you have the ability to use our technology,
Cloud Anomaly Detection, which takes look at data
from outside the organization to understand
if there are possible threats to your organization,
as well as Event Threat detection that processes
your Stackdriver logs to look at what's happening
inside your organization.
Once you've detected those threats
and you want investigate more, you can export those to a Sim,
like Splunk, and then follow with the rest of your workflow.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]