SPEAKER: Access control capability in Security Command
Center allows organization administrators
to grant fine-grained access to the assets
and findings surfaced in Security Command Center.
This feature is relevant for many use cases,
including sensitive applications or compliance
regimes that require strict access controls,
as it lets you isolate Cloud resources
and restrict employee access to only those they
need to do their jobs.
Access control at the folder and project level
is available to Security Command Center Premium customers.
In this video, we'll walk through how
to grant granular access control to assets and findings
in your organization, and demonstrate
the experience from the end user's perspective.
Starting in the Organization view of the Security Command
Center, you can see this example organization
has thousands of assets.
And similarly, it has many findings,
rather than providing organization-wide permissions.
Administrators can use access control
to limit the View or Edit permissions in Security Command
Center to specific folders and projects.
We'll now show how to grant users
access to specific folders or projects
in Security Command Center using the Cloud Console.
In the Project Selector dropdown,
choose the project or folder to which you would
like to provide scoped access.
In this case, we're selecting a project.
Then, head to the IAM landing page,
which you can find with the left-hand navigation menu.
Search for the user's email address, and click to edit.
Then add the Security Center Admin Editor, Viewer,
or one of the many additional Security Center roles
based on your user's needs.
Then click Save.
The permissions are now applied and live for your user.
Now, let's switch over to view the console logged
in as the user.
As you can see, when the user tries
to access Security Command Center for the organization
itself, they will get a Permission Denied error
because they do not have permissions at the organization
level.
Using the Project dropdown, we'll
select the target project to which they were granted
Security Command Center access.
We'll now see Security Command Center
is scoped to the specific project,
including only the assets and findings that are associated
with the project.
For example, by selecting the Assets tab,
we can now see that the number of assets
has decreased from the Organization
view we saw earlier, as now, these are only the assets that
reside within this project.
When looking at projects, we can only
see the specific project and not others within the organization.
We'll click on a specific asset, such as this bucket,
to expand the asset details.
Take note of the new Canonical Name
field, which contains the asset's actual parent project
ID and its name.
Now, let's head to the Findings tab.
Again, we can only see findings that
are associated with the assets contained in this project,
rather than the organization-wide findings.
Note-- if we had shared access at the folder level,
we would be able to see assets and findings associated
with all projects within that folder.
Just as we saw earlier in the Assets tab,
we can see that the details for a finding
includes the new Canonical Name field, which
identifies the parent project associated with the finding.
All functionality across dashboards
is scoped as per the access controls defined.
For example, in the Overview tab,
we continue to see the charts and reports for findings
within the scope of this project.
And we also see only the vulnerabilities
associated with this project.
The Settings page, however, does require organization level
permissions in order to be viewed and edited.
Because Security Command Center settings always
apply to the entire organization.
Congratulations.
You're now equipped to use Access Control in Security
Command Center to restrict users,
to manage assets and findings within an assigned scope.
[MUSIC PLAYING]