Demo: Using Security Command Center
1. Demo: Using Security Command Center
As you deploy your workloads into Google Cloud, you need a tool that provides features with centralized dashboard for discovering vulnerabilities. Misconfigurations, maintaining compliance, detecting threats, helping you mitigate and remediate risk before they damage your business. That is what the Google Cloud Security Command Center offers to access security Command center navigate to the top left hand corner menu. Look at a security section. Click on Overviews Menu. You can activate security command center for an entire organization or for individual projects you use in roles to control who can do what with assets, findings and security sources in a security command center environment. If you are activating Security Command center at the organization level, here is a list of I am permissions needed. However, if you are activating Security Command center, add a project label. Here is the list of IAM permissions needed to provide vulnerabilities and threat findings to the Security Command center. Configure security services through them. Settings menu can be found on the top right hand side corner. Once you click on the settings menu, you'll be presented with built in security services that you can enable or disable them accordingly. First one is the Security Health analytics. It finds and report Misconfigurations of resources Web Security scanner scan publicly available web applications and checks for all top ten vulnerabilities such as cross-site scripting, even threat detections. It is a lock based threat analysis is capable to scan for potential threats such as false sage attack. And of course we have container threat detection, rapid vulnerability detections, as well as virtual machine threat detection. On top of this, if you have activated security command center at the organization level, you are able to at Google Cloud integrate its services into party security services. Let's take a quick look at the documentation pitch of what services support it. First is the Google Cloud integrated services. So you are able to see this are the services that you are able to add. And then if you look at the security services, here are the list of third party services that you are able to consider. So let's take a look at some of the menus can be found on the left hand side panel below security command center section. So the first one is the overview page. So this page provides a quick view of both the new threats and the total number of active vulnerabilities in your Google environment. So it can look at the threat to report that over time. You can also filter based on the time range. If you scroll down, you are able to see vulnerabilities for resource type. Looking at the Active Vulnerabilities report that based on findings by category, findings, by resource type findings by project, you can also look at the identity and access finding sections where you are able to look into some of the findings report that exemplar user may need to service account key. So to see more details about these finding, you can click on the link. You'll be directed to the findings page in case if the findings query result is returning a massive output, you can make use of the quick Filters feature to fill out the output. If you would like to dive into, understand each of the finding, click on the name you'll be present that the summary page, which is summarized by using the AI technology. Then you can look at a state which resources are affected as well as should. You want to mitigate what at a step that you could pick. Next, let's take a look at Threats page. So this page helps you review potentially harmful events in your Google Cloud Resources over time period. An example of a threat can be a search key being added to your compute engine instances. At a same time, you are also able to filter the result based on time range vulnerabilities. Page this page list all of the categories of vulnerabilities that various security command center threat prevention services can detect. In your environment, you are able to make use of the filter feature to filter the result based on properties. Value compliance page helps you assess and take actions on your complying with common security standards or benchmarks. If you want to see details about each of the compliance standard, click on the View details. Link. You'll be presented with a page by showing the rules available severity levels for each of the rule findings and the controls information. If you look at the assets page, this page provides a detailed display of all Google Cloud resources currently running in your environment. It could be at a project level or organization as a whole. If you want to filter the output, you can make use of the quick filters feature S40 High value Resource set tab. These particular type provide a path simulation. Identify the path that a potential attacker could take to access your Google cloud environment. However, in order to make use of this feature, it has to be configured at the organization level. A set query is letting you to supply obscure query Spackman to query against the assets that you want to see. If not, you can make use of query library by identifying which library query you want to use and click on the apply query button and hit the run button to execute a statement source page. It basically will be able to show the information provided by the source security information that you have enabled, and then the output will be presented in a summarization view by identifying the type of categories as well as the counters. And the list is the posture. This is a feature that lets you define and manage the security status of your client assets, but it required organization level security command center activation.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.