[MUSIC PLAYING]
KYLE OLIVE: Welcome to the "Google Cloud Security
Showcase," a special web series where
we'll take a look at the use cases
that customers can solve using Google Cloud.
My name is Kyle Olive, and I'm a product manager here
at Google Cloud.
Today, we'll take a look at one of the most common questions
we hear from customers--
how can I make sure my Google Cloud deployment meets
the Center for Internet Security's Google Cloud
security benchmarks?
The CIS Google Cloud benchmarks are
a set of recommendations drafted by the CIS community
and contributed to by Google that
are intended to serve as a guide to securing your Google Cloud
environment.
It covers several Google Cloud Services
and tools spanning from IAM to compute to storage
and many more services.
While the benchmark includes instructions
for manually checking for and remediating issues
against these recommendations, tracking to make sure
your entire deployment continues to meet
these benchmarks is a significant and ongoing
challenge.
Security Health Analytics and Security Command Center
reduces the burden on your security teams
by automating these detections and surfacing findings
in easy-to-use ways, while providing
context-specific remediation instructions that can quickly
help you resolve any issues that do occur.
Security Health Analytics can also
help you meet your continuous compliance goals
by monitoring for violations against a wide variety
of compliance controls and surfacing reports
against those violations.
Let's take a look at how you can get set up with Security Health
Analytics and get a handle on how your organization is
doing against the CIS benchmarks for Google Cloud.
Before you can get started, ensure
your organization has enabled Security Command Center.
For more information, check out the Security Command Center
quick start documentation available online.
Setting up Security Command Center is fast and easy.
First, you'll select your tier.
For full comprehensive monitoring against the CIS
benchmark, as well as additional monitoring against compliance
standards like PCI DSS, ISO 27001, and NIST 800-53,
you're going to need to have access to the Security Command
Center premium tier, but several of the most impactful
recommendations from CIS are also
available to all Google Cloud customers completely free
of charge as part of the standard tier.
Once you've selected your tier, ensure you enable
Security Health Analytics.
At this point, if it's available to you,
you can also enable the other premium services
as part of Security Command Center.
This includes web security scanner
for automatically detecting vulnerabilities
in your exposed web applications,
event threat detection for detecting threats
against your Google Cloud resources via your logs,
and container threat detection, which can detect threats
against your GKE workloads.
Next, you'll select which parts of your organizations
you want detections to run.
Since you can always filter and sort findings
after they've been generated by anything you want,
like folder or hierarchy, we generally
recommend that you leave Security Health Analytics
enabled for your whole organization
so you don't miss anything.
Finally, you'll need to grant the Security Command Center
service account the appropriate permissions
to monitor your resources for misconfigurations
and vulnerabilities.
Once you've completed setting up Security Command Center,
the first pass of these detection will run,
and this first pass may take up to 24 hours to complete.
For now, let's jump to an organization
with a bunch of security findings
and find out how I'm doing against CIS.
I can go straight to the compliance dashboard
to see my current score against the CIS Google Cloud
benchmarks.
This dashboard gives me a great at-a-glance view
of my compliance monitoring findings,
including a score for CIS.
This will give me a good idea of how I'm doing overall
against the controls that matter to me,
as well as giving me a way to assess
how much my organization is improving its security
posture over time.
Here, I can see how many of the CIS Google Cloud
controls are being monitored, as well as
how many controls have violations,
broken out by level-one and level-two controls
just like the benchmark.
There's a lot of data here, since my organization has
a lot of projects, but the compliance dashboard
allows me to narrow down the report
to a specific set of folders or projects that I care about.
Now I can see this particular folder, which
could be a stand-in for a prod, or dev, or test folder,
scored against the CIS Google Cloud platform foundation
benchmarks.
At this point, I could do a couple of things.
I could either export this information
out as a CSV file to document my current state
or I can continue working in Security Command Center
to find out more about these issues and how to fix them.
On the Export tab, I can set the type of report I want,
as well as filters around the time
for the report and the projects and folders
that are included in the report.
When I export the report, a CSV file
would automatically be downloaded.
This CSV file contains a lot of extra useful information,
like the set of projects with violations against controls
in the scope of the report, as well as
a mapping of every finding category
and the appropriate CIS control, as well as
the number of failing resources that map to that control.
But if I want to work on my findings directly
in Security Command Center, I can also
pivot to the Vulnerabilities tab.
Here, I can see all of the open findings detected
as part of the report from the previous dashboard.
I can also manipulate this dashboard to sort and search
by benchmark or control number, sort and search by severity,
or by active count.
In this case, I'll look for the highest severity
findings that are still open.
Once I've decided what I want to work on,
I can pivot from here to the Findings tab.
From here, I can open up a finding
and I can review all of the information I
need to act on this finding, including
the affected resources, the impact of the finding,
and the remediation steps context-specific
for this resource.
If I wanted to, I could fix this immediately
by clicking on this button and following the instructions,
or I could copy these remediation steps
and assign a ticket to the owner.
Once the issue is fixed, the finding
in Security Command Center will automatically go away.
My compliance score will have improved.
Using Security Command Center and Security Health Analytics,
you can continue to detect, understand, and resolve
violations against the CIS benchmarks,
improving your overall security rating
and keeping your workload secure on Google Cloud.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]