[MUSIC PLAYING]
SPEAKER: As you deploy workloads in Google Cloud,
you need centralized visibility into the security posture
and status of your environment.
You need a way to surface vulnerabilities
and malicious activity with clear ways
to take action against them.
Security Command Center is a built-in security management
tool for Google Cloud Platform that
helps you prevent, detect, and remediate vulnerabilities
and threats.
You can identify misconfigured virtual machines, containers,
networks, storage, and identity and access management policies,
as well as web application vulnerabilities,
and act on them before they damage your business.
With Security Command Center, you
can perform several security-related actions
from a single centralized dashboard.
Let's get started by completing three steps.
Step one, set up Cloud IAM permissions.
To get started, you need to ensure
you have the correct permissions set up in Cloud IAM.
These roles can be enabled from the GCP console
IAM and admin page.
To view the Security Command Center,
you must have the Security Center Admin Viewer role.
To make changes, you must have an appropriate editor role,
like Security Center Admin Editor.
To set up Security Command Center
for the first time for your organization,
you'll need five roles--
Organization Admin, Security Center Admin,
Security Center Settings Admin, Security Admin,
and Service Account Creator.
Step two, choose services.
Head to the console.
On the left-hand panel, navigate to Security
and then click Security Command Center.
On the Organization dropdown list, select your organization.
Note-- if this is the first time your organization is using
Security Command Center, you will
be directed through a sign-up flow, where
you will choose your services.
For organizations that have already
completed the sign-up flow, you may review and refine
your services from the UI.
To do so, click on Add Security Sources to review and enable
the services that Security Command
Center will use to show you the security
state of your resources.
Our built-in services are Security Health Analytics,
which can identify misconfigured virtual machines, containers,
networks, storage, and identity and access management policies.
The built-in capabilities in the standard tier
include scans for high-severity misconfigurations,
such as open storage buckets.
When using Security Health Analytics in the premium tier,
you get scans for broader security misconfigurations,
such as API keys needing to be rotated.
In addition, you get compliance monitoring and security posture
management against PCI DSS, CIS GCP 1.0, NIST 800-53, and ISO
27001 recommendations, among other security best practices.
For premium users, there are additional services available.
Web Security Scanner manage scan capabilities,
which automatically detect new public-facing web
applications deployed on Google Cloud
and can detect vulnerabilities in those applications,
including those from categories in the OWASP top 10,
such as cross-site scripting, use of clear text passwords,
and outdated libraries.
Event Threat Detection, which uses log data
from inside your systems and watches your organization's
Cloud Logging stream to detect threats like brute-force SSH,
Cloud IAM abuse, malware, and data exfiltration.
Container Threat Detection, which
can detect some of the most common threats seen
in the containerized workloads running on GKE,
such as adversaries dialing home with reverse shells
or the execution of binaries in libraries
that did not come from your secure build pipeline.
You can also integrate with other services
to have their findings surfaced in Security Command Center.
Cloud Armor, which is a customizable service
for protecting applications from DDoS or web attacks.
Cloud Armor sends any allowed traffic
spike and increasing deny ratio findings to Security Command
Center.
Data Loss Prevention, which shows storage buckets that
contain sensitive and regulated data,
integrates and surfaces its findings
into Security Command Center.
And partner solutions from many partners,
such as Chef Automate, which can be
integrated into Security Command Center and enabled here.
You can enable or disable a service
by clicking the toggle next to the service name.
The services will be enabled at the organization level.
Optionally, you can enable or disable your services
for individual resources by navigating to the Resources
tab.
Click the dropdown list in the Service column
to select service enablement on a resource.
Now Security Command Center is ready to help you prevent,
detect, and respond to threats.
This leads up to step number three, view your dashboards.
Security Command Center gives you a lot of flexibility
to review the security state of your resources.
Explore contains a directory of the dashboards, displays,
and services available to you.
On the Threats dashboard, you can
review potentially harmful events in your organization's
resources.
These events are summarized by severity, category,
and resource or project.
The Threats dashboard displays results for the time period
you specify in the dropdown list.
Click through these items to see more detail
on the specific findings.
The Vulnerabilities dashboard display Security Health
Analytics findings and recommendations.
The findings can be filtered to one or more projects
and also by other characteristics,
such as categories, severity, and/or benchmarks.
The Recommendations column provides
a summary of how to remediate the finding.
More details on the finding can be viewed by clicking through.
The Compliance dashboard uses Security Health Analytics
and Web Security Scanner detectors
to monitor for violations against common compliance
controls, which are part of various industry regimes,
including CIS and PCI.
While not a replacement for a compliance audit,
it can be used to help you maintain
your continuous compliance and catch violations early.
You can filter by project and view
or export reports of specific findings by compliance regime.
If you'd like to export Security Command Center data, including
assets and findings, you can find the Export button
on the Assets or Finding tabs on the dashboard.
You can also have event threat detection and container threat
detection findings automatically logged to Cloud Logging.
To enable, navigate to Settings and click
on the Sinks tab, where you can turn on the service.
Congratulations.
That's it.
You're set up to start using Security Command Center.
[MUSIC PLAYING]