SETH VARGO: In this episode of the Google Secret Manager
video series, we'll talk about how
Secret Manager can aid in threat detection
and forensic analysis.
Where can you find a list of all requests
to Google Secret Manager?
Stay tuned to find out.
[MUSIC PLAYING]
While we always want to do as much as we
can to prevent a data breach, a good security threat model
also accounts for the unexpected and helps us respond
in the event of a compromise.
All too often, organizations invest all their resources
in prevention and then they leave no bandwidth
for detection or recovery.
Cloud Audit Logging is a fully managed logging service
that, once enabled, provides a forensic history
of interactions with Google Secret Manager.
It also works with other Google Cloud products,
but this episode focuses specifically on Secret Manager.
To tell us more about Cloud Audit Logging
and how it can help with forensics,
I think we need to bring in an expert.
[MUSIC PLAYING]
Hey, Tommy.
Thanks for joining us today.
TOMMY MURPHY: Thanks, Seth.
Thank you for having me.
SETH VARGO: So Tommy is a software engineer who
works on Google Secret Manager.
Tommy, earlier, I was telling our viewers about Cloud Audit
Logging and how it keeps a detailed list
of all interactions with Google Secret Manager.
TOMMY MURPHY: That's right, Seth.
But there's an important first step.
SETH VARGO: Oh, what's that?
TOMMY MURPHY: You have to turn them on.
Admin write audit logs, which include any changes to secrets,
are enabled by default. But admin
read logs, which include viewing secret metadata,
and data read logs, which log secret access,
are disabled by default because of the amount of data
they generate.
SETH VARGO: OK.
But what if I have my secret stored
across multiple projects?
Do I have to enable it on each project, or how does that work?
TOMMY MURPHY: You can enable cloud audit logs
on a per-product basis.
And you can choose to enable logs
for admin read, admin write, data read, data write,
or any combination.
SETH VARGO: OK.
But to rephrase my last question,
where do I turn them on, at the project level,
or how do I manage this at scale?
TOMMY MURPHY: Great question.
Cloud audit logs are configured through IAM
and can be enabled on a single project,
for all projects in a folder, or for all projects
in an entire organization.
This means a security team can configure
an organization-wide policy that automatically
applies to all current and future projects.
SETH VARGO: OK.
And then what do I do after I turn them on?
TOMMY MURPHY: That's it.
SETH VARGO: Oh, this is kind of awkward then.
TOMMY MURPHY: Why?
SETH VARGO: We just--
we had a lot more back-and-forth with our other experts.
I guess Cloud Audit Logging really is this easy.
TOMMY MURPHY: Yep.
I'm going to go now.
SETH VARGO: Cool.
Thanks, Tommy.
TOMMY MURPHY: Thanks, Seth.
SETH VARGO: OK.
Let's look at how we enable and consume cloud audit
logs for Google Secret Manager.
Now that we've enabled Cloud Audit Logging,
all requests to access and manage secrets in this project
will generate a log entry.
I'll go ahead and access a secret
so it generates such an audit log entry.
These audit logs are written to Cloud Logging, Google Cloud's
centralized logging solution, which you can easily
access from the sidebar.
From here, you can filter by log type,
including audit logs for particular services.
For example, suppose you suspected
that a service account credential had
been compromised.
Here in the Log Viewer, you can filter for all requests
to access secrets using that service account.
You can then correlate that data against timestamps, source IP
addresses, and more.
Google Secret Manager's integration
with Cloud Audit Logging brings a wealth
of forensic information to your fingertips
with the click of a button.
That's all for this episode, and this concludes
our Secret Manager series.
To learn more about Secret Manager,
visit us on the web at cloud.google.com/secret-manager.
And be sure to Like, Subscribe, and click the bell
to get notifications about new and upcoming video series
on security, AI, ML, databases, storage, and so much more.
[MUSIC PLAYING]