Security Command Center Premium Findings

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It provides visibility into your cloud assets, detects threats, and helps you manage security and compliance. SCC has two tiers: Standard (free) and Premium (paid). The ACE exam focuses on understanding when to use Premium and its specific features.

SCC Standard is automatically available to all Google Cloud projects. It provides basic security scanning, including:

SCC Premium unlocks advanced capabilities: - Security Health Analytics: Expanded set of detectors (over 150 vs. ~50 in Standard) - Event Threat Detection: Real-time threat detection from logs (e.g., compromised VM, crypto mining) - Container Threat Detection: Runtime threats in GKE clusters (e.g., privilege escalation, malicious binaries) - Access Transparency Logs: Visibility into Google staff access - Third-party integrations: Connect with partners like Palo Alto Networks, Qualys, and more - Continuous monitoring: Premium provides more frequent scans and lower latency for findings - Custom modules: Create custom detectors using YARA-L (for Event Threat Detection) and custom security health analytics

SCC Premium operates as a managed service that aggregates data from multiple sources:

1. Data Collection: SCC Premium collects data from: - Google Cloud APIs: Asset inventory, IAM policies, firewall rules, etc. - Cloud Logging: Audit logs, VPC flow logs, DNS queries - GKE audit logs: Kubernetes audit logs for container threats - Partner integrations: Third-party scanners push findings via API

2. Detection Engines: - Security Health Analytics: Runs a set of rules (detectors) against your cloud configuration. For example, detector FIREWALL_RULE_LOGGING_DISABLED checks if firewall rule logging is off. Each detector has a severity (low, medium, high, critical). Premium has ~150 detectors; Standard has ~50. - Event Threat Detection: Analyzes logs in near real-time (latency ~2-5 minutes) for suspicious patterns. Uses machine learning and signature-based detection. Examples: - PERSISTENT_EVENT: A user creates a service account and then uses it to create a VM (indicates persistence) - CRYPTO_MINING: Detects crypto mining activity via network traffic patterns - Container Threat Detection: Runs on GKE nodes using eBPF (extended Berkeley Packet Filter) to monitor system calls and detect runtime threats like: - PRIVILEGE_ESCALATION: Attempt to run privileged container - MALICIOUS_BINARY: Execution of known malware - Web Security Scanner: Scans App Engine, Compute Engine, and GKE for web vulnerabilities (XSS, Flash injection, etc.)

3. Findings: All detections are normalized into a Finding object. A finding has: - category: e.g., OPEN_FIREWALL, CRYPTO_MINING - severity: CRITICAL, HIGH, MEDIUM, LOW - state: ACTIVE or INACTIVE (muted or resolved) - source_properties: Custom key-value pairs - resource: The affected GCP resource (e.g., VM instance, bucket)

- Security Health Analytics: Categories like CIS_COMPLIANCE, SOX_COMPLIANCE, PCI_COMPLIANCE, GENERAL_SECURITY - Event Threat Detection: Categories like PERSISTENCE, DEFENSE_EVASION, CRYPTO_MINING - Container Threat Detection: Categories like PRIVILEGE_ESCALATION, MALICIOUS_BINARY, SUSPICIOUS_NETWORK_TRAFFIC - Retention: Findings are retained for 90 days in SCC. For longer retention, export to BigQuery. - APIs: SCC Premium provides REST API and gcloud commands: - gcloud scc findings list (list findings) - gcloud scc sources list (list sources like Security Health Analytics) - gcloud scc notifications create (create Pub/Sub notification config)

To enable SCC Premium: 1. Go to Security > Security Command Center > Settings 2. Click "Enable Premium" (requires Org Admin or Security Admin role) 3. Optionally, configure source (e.g., Event Threat Detection) by toggling on

To list findings:

gcloud scc findings list --organization=123456789012 \
  --filter="severity=CRITICAL" --format=json

To create a notification:

gcloud scc notifications create my-notif \
  --organization=123456789012 \
  --pubsub-topic=projects/my-project/topics/scc-findings \
  --filter="severity=CRITICAL OR severity=HIGH"

To enable Event Threat Detection:

gcloud scc services enable event-threat-detection \
  --organization=123456789012

A large financial institution runs 500+ GCP projects across multiple business units. They need to ensure compliance with CIS benchmarks and PCI DSS. They enable SCC Premium at the organization level. Security Health Analytics runs continuously, detecting misconfigurations like public buckets, open firewalls, and disabled logging. The security team creates custom modules to enforce internal policies, e.g., requiring encryption on all Cloud SQL instances. They set up notifications to a central Pub/Sub topic that feeds into a SIEM (Splunk). The team uses the SCC API to programmatically mute known false positives. At scale, they see ~10,000 findings per day. They use severity filters to prioritize critical issues. Without Premium, they would only get basic checks and would miss many PCI-specific requirements. A common pitfall is not enabling Event Threat Detection, which could miss active threats like compromised service accounts.

An e-commerce company with high traffic uses GKE for microservices. They enable SCC Premium and Container Threat Detection. One day, CTD detects a PRIVILEGE_ESCALATION finding in a pod that attempted to mount the host filesystem. The security team receives a notification via Pub/Sub and triggers a Cloud Function that automatically isolates the pod by updating the Kubernetes NetworkPolicy. They also investigate the source using Event Threat Detection logs, which show a compromised CI/CD token. The team rotates the token and patches the pipeline. Without CTD, the attack might have gone unnoticed until data exfiltration. A common mistake is not enabling Workload Identity on GKE clusters, which prevents CTD from working.

A healthcare company uses SCC Premium to integrate with Qualys for vulnerability scanning. They configure Qualys to scan their Compute Engine instances and push findings to SCC via the Security Health Analytics API. Now, all vulnerability data appears in a single dashboard alongside Google Cloud's native findings. They use SCC's IAM to grant the Qualys service account the Security Center Findings Editor role. They set up a notification for critical vulnerabilities. This integration reduces tool sprawl. However, they must ensure that the third-party findings are properly categorized and not duplicated. A common issue is misconfigured API permissions leading to missing findings.