JENNY BROWN: Welcome to Cloud Security Basics, a series where
we explain the ins and outs of securing your application
on Google Cloud.
Sound fun?
Then stick around because in this episode,
you'll learn about Cloud audit logging.
[MUSIC PLAYING]
[PHONE DIALING]
BRAD ACTOR: Salutations, Cloud detective.
Last episode, you used service accounts
to foil my grand attempt to compromise your apps
and scripts that allow for automated access
into your system.
This time, I decided to go old school.
One of your employees is logging in in the middle of the night
and accessing things they shouldn't be.
How do I know this?
Well, maybe it's because you're not their only employer.
The question is, in a fully remote workplace,
how are you ever going to track down
who the wayward employee is?
If you don't do something soon, I just
might have to ask our mutual employee
to make some unfortunate changes to a slideshow.
How embarrassing would it be if all of your images
were replaced with cats at the next company-wide presentation?
JENNY BROWN: All right, so here's what we know.
Admins are responsible for coming up with solutions
to the many ways users can interact with their systems.
And in this case, we need to track down
who's accessing files when they shouldn't be.
If this was at the office, we could
ask the security guards to walk around
and note if they see anything suspicious.
And if we were at the office, we would actually
be able to look at the security logs
to see whose keycard was being used to access
the building late at night.
Wait a minute.
That gives me an idea.
See, Google Cloud provides a lot of tools and services
to protect its users from cases just like this.
And one of the most important tools
is called Google Cloud Audit Logs,
which lets teams easily create and manage audit logs.
Regardless of how carefully we code or thoroughly
debug a piece of software, problems are going to come up.
And when they do, it's almost impossible
to determine why they happened and figure out how to fix them
unless there's a trail of breadcrumbs
to follow along the way.
And security logging provides that crucial trail of evidence.
So during an active investigation or postmortem
analysis, having regular logs to go through
is critical to identify the cause of the issue.
They help establish baselines and find operational trends.
Logging security events that keep
track of every activity that happens
in the digital environment, your organization
will monitor these logs for any suspicious activity
or unauthorized access to the system.
Whenever these breaches are found,
the data is moved to a central database
so that the security team can then investigate them.
Hmm, I need to investigate this more.
When it comes to Google's Cloud Audit Logs,
some types of logs, like Admin Activity logs,
are on by default and can't be disabled.
Others, like Data Access logs, are optional,
off by default, and cost money to use.
Logs that are not essential are turned off by default
to save users money because the logs could take up
a large amount of data that would apply against Google's
quotas and limits.
But depending on what you need, Cloud Audit Logs
provide many customization options to suit an organization
and fulfill all their security logging needs.
So these include the aforementioned Admin Activity
audit logs, which cover API calls
and admin actions that modify how metadata for resources
is configured.
Whenever VM instances are created
or identities are changed, a log record is kept.
These logs are automatically kept,
don't cost users anything, and can't be disabled.
Then there's Data Access audit logs, which keep track of users
as they create, change, and read data that's been user provided.
These do have costs associated with them,
except for BigQuery's Data Access audit logs.
And Data Access audit logs aren't on by default
because they can store a lot of data.
And then there's System Event audit
logs to track changes to how resources are configured.
These logs are triggered by Google systems,
don't cost anything, and can't be disabled.
And finally, there's Policy Denied audit logs.
Those are created whenever a Google Cloud service denies
access to a user or service account because of a security
policy violation.
These are on by default but do have
costs associated with them.
So we've got a lot of log information to sort through,
but it's important to understand that audit logs have
no concept of suspicious events and are often best-effort items
that can be delayed by up to five minutes.
And still, once your security team
is aware of a suspicious event, your team
will need to have the correct tools and data
to work with to assess the situation
and take action as appropriate.
And luckily in our case, we turned on Data Access logs.
So let's look at those and see who's been calling what
and when.
And by taking a look at who's been accessing files they
shouldn't have, eureka, I was able to figure out who's been
accessing files they shouldn't.
BRAD ACTOR: Drats, you figured that out so quickly,
although it does make me wonder why a regular scan of activity
wasn't already part of your process.
Google Cloud has tools that allow
you to set up real-time alerts and notifications.
And regardless of if you use those or not,
your company should implement an audit process
that involves regularly reviewing the logs
for suspicious behavior.
JENNY BROWN: So there you have it, another episode
of Cloud Security Basics.
Next episode, we'll be looking into this so-called security
breach.
So stay tuned for the rest of the Cloud Security Basics
Series, because when it comes to security,
you can't let bad actors win.
[MUSIC PLAYING]