[MUSIC PLAYING]
SPEAKER: Cloud data loss prevention
is a fully managed service designed
to help you discover, classify, and protect
your most sensitive data.
You can inspect, mask, an de-identify sensitive data
such as personally identifiable information or PII, secrets,
and credentials.
Cloud DLP integrates natively with Security Command Center.
When you use Cloud DLP to scan your GCP storage repositories,
it can send results directly to the Security Command Center
dashboard.
Please note.
Cloud DLP uses its own pricing structure separate
from Security Command Center Premium.
A link to pricing information is available in the description
below.
Before you can send Cloud DLP scan results
to Security Command Center, you must set up
the following components--
identify GCP storage repositories,
set Cloud IAM roles, enable Security Command Center,
enable Cloud DLP, enable Cloud DLP as a security source
for Security Command Center, and define a DLP inspect job.
Step one.
Identify a GCP storage repositories.
You can choose whether you want to scan your own GCP storage
repository or an example one.
If you want to scan your own existing cloud storage bucket,
BigQuery table, or Cloud Datastore kind, first,
open the project that the repository is in.
In the next steps, you'll enable Cloud DLP for this project
and its organization.
Step two.
Set Cloud IAM rules.
Before you can use Cloud DLP to send scan results to Security
Command Center, you'll need to enable some Cloud IAM rules.
This section requires you to have the organization
administrator IAM role.
Click on the organization dropdown list
and select the organization for what
you want to enable Security Command Center.
Navigate to IAM and Admin using the Navigation pane.
Find the user name in the member column or add a new user.
Add the role, Security Center Admin and DLP Jobs Editor
and then click Save.
Step three, enable Security Command Center.
If you are a new user, enable Security Command Center
following the instructions in the three-step overview
video linked below.
Step four.
Enable Cloud DLP.
Navigate to the project you would
like to use to execute your DLP scan.
The project must be within the same organization
where you enabled Security Command Center.
Head to APIs and Services in the Navigation pane.
Search for Cloud DLP, API, and enable it.
Step five.
Enable Cloud DLP as a security source
for Security Command Center.
Go to the Security Command Center page
and select your organization.
Click Settings in the top right corner of the page.
Under Integrated Sources, click the toggle next
to Data Loss Prevention.
Step six.
Define a DLP inspect job.
Go to the Cloud DLP console and choose your project,
click on Create Job, enter a name
and select the storage target that you want to scan.
Configure your scan options.
On the action step, click to enable Publish the Security
Command Center.
You also have the option to save the results to BigQuery,
click Create, and run the job.
If you want to surface findings for additional projects
within your organization, repeat step six for each storage asset
that you went to inspect.
Now, findings for Cloud DLP will display
in the Findings tab of the Security Command Center
dashboard.
Cloud DLP uses information types or info types
to define what it scans for.
An info type is a type of sensitive data
such as a name, email address, telephone number,
identification number, credit card number, and so on.
You can also define your own custom info types or tune
detection using inspection rules.
You can find out more about it in the Cloud DLP documentation.
In our environment, we see that there
have been more than 90 Cloud DLP findings in our organization
such as email addresses, credit card numbers, and phone
numbers.
Drilling in, let's expand an email address finding.
We can see it first occurred on August 25
and is located in the asset we identified for inspect job.
This is the project in which the PII was flagged.
We can then click on the external URI source
and see almost 4,000 PII findings related to it.
Next, if set up as part of the DLP job,
we can perform additional analysis
on this data their BigQuery.
Or we can remove this resource and remediate these findings
by contacting the owner.
Congratulations.
You've enabled Cloud DLP for Security Command Center
and learned how to respond to a finding from it.
[MUSIC PLAYING]