[MUSIC PLAYING]
SPEAKER: Web Security Scanner is a built-in service
for the Security Command Center Premium tier.
It can automatically scan for and detect key vulnerabilities
in App Engine, Compute Engine, and Google Kubernetes Engine
applications before deploying them to production.
There are two types of scans you can do.
Managed scans are configured and managed
by Security Command Center.
With an SCC Premium subscription,
they're enabled by default and will automatically run
once a week.
Results will appear in the SCC Vulnerabilities
tab and related reports.
With managed scans, you can centrally
manage basic web application vulnerability detection
for projects in your organization
without having to involve individual project teams.
If you disable managed scans, you can re-enable them.
For this, you need the SCC and Security Center
Sources Admin IAM roles, along with the SCC Premium
subscription.
Go to the Sources and Services Settings page
and enable managed scans.
You may need to wait up to 24 hours for the application
to be detected and scanned.
Custom scans are also available.
They provide granular control over how the scan runs,
including additional controls like scanning from a static IP
or using IAP authentication.
Before you begin, make sure the account you're logged into
has a project editor, the organization administrator,
Security Center Admin, and Security Center Sources Admin
IAM roles.
To enable custom scans, make sure you've also
enabled Web Security Scanner in the Settings page.
To set up a custom scan, first make
sure your app is running with the public URL and IPs.
Then head to the Web Security Scanner
from the navigation bar.
Select a project in the page that appears.
If you haven't enabled the Web Security Scanner API before,
you will be prompted to do so before continuing.
You are now in the Web Security Scanner page.
This page allows you to create, save, and run a scan.
Click New Scan to display the new scan form.
Add in the URL of the application you'd like to test.
You can select authentication options, including
needing a Google account to run the scan
or using Identity Aware Proxy.
IAP works by verifying user identity and context
of the request to determine if a user should
be allowed to access.
And for now, let's schedule the scan to run weekly
and select the starting date.
You can choose to run scans from a predefined set of source IP
addresses.
This gives the scanner access to applications behind a firewall,
but might limit the scope of the scan.
The Export box is automatically checked.
It allows scan results to be displayed on the Security
Command Center dashboard.
You can also specify the user agent, which is a web client
software to be emulated when scanning your app,
max scan speed, queries per second, and risk level.
Because Web Security Scanner populates
fields, pushes buttons, clicks links, and other interaction,
low-impact scanning minimizes requests with a potential
to modify data.
Click Save to create the scan.
The scan will be queued, and then it
will be run at a future time.
It might take several hours before the scan runs.
Click Run to schedule the scan.
The scan is placed in a queue, and there might be a delay
before it runs.
It can take several minutes or many hours to complete a run,
depending on the system load and site complexity.
Web Security Scanner will automatically
crawl your application, following
all links within the scope of your starting URLs
and attempts to exercise as many user inputs and event
handlers as possible.
The scanner attempts to identify common web vulnerabilities
on these pages, including findings from categories
in the OWASP Top 10, like cross-site scripting,
mixed content, and outdated or insecure JavaScript libraries.
The scan will display a results page when it completes,
such as the following if no vulnerabilities were detected.
Click the scan name to go to the scan's config page, where
you'll find more information about the scan, its history,
and some controls for running, editing, or deleting the scan.
You can see all vulnerabilities found
by navigating to the Vulnerabilities dashboard.
Filter by vulnerability type, like OWASP.
In this case, we have the highest number
of cross-site scripting listings and the recommendation
provided.
You can click on a finding to bring up
more information about it.
If we click on this cross-site scripting error,
for instance, a pop-up will display information
about the finding, including information
like the resource that was flagged,
how severe the flag is, and the reproduction URL.
You can also share the scan with your team.
You just completed a scan using Web Security Scanner.
You can now set up and run on-demand, immediate or
scheduled security scans for your own application
from the Google Cloud Console.
[MUSIC PLAYING]