Security Command Center conceptual overview

What Security Command Center offers

Security Command Center is Google Cloud's centralized vulnerability and threat reporting service. Security Command Center helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities, and threats; and helping you mitigate and remediate risks.

Security Command Center tiers

The tier you select determines the built-in Security Command Center services that are available for your organization:

Tier details

Standard tier features

  • Security Health Analytics: in the Standard tier, Security Health Analytics provides managed vulnerability assessment scanning for Google Cloud that can automatically detect the highest severity vulnerabilities and misconfigurations for your Google Cloud assets. In the Standard tier, Security Health Analytics includes the following finding types:

    • LEGACY_AUTHORIZATION_ENABLED
    • MFA_NOT_ENFORCED
    • NON_ORG_IAM_MEMBER
    • OPEN_CISCOSECURE_WEBSM_PORT
    • OPEN_DIRECTORY_SERVICES_PORT
    • OPEN_FIREWALL
    • OPEN_RDP_PORT
    • OPEN_SSH_PORT
    • OPEN_TELNET_PORT
    • PUBLIC_BUCKET_ACL
    • PUBLIC_COMPUTE_IMAGE
    • PUBLIC_DATASET
    • PUBLIC_IP_ADDRESS
    • PUBLIC_LOG_BUCKET
    • PUBLIC_SQL_INSTANCE
    • SSL_NOT_ENFORCED
    • WEB_UI_ENABLED
  • Web Security Scanner custom scans: in the Standard tier, Web Security Scanner supports custom scans of deployed applications with public URLs and IP addresses that aren't behind a firewall. Scans are manually configured, managed, and executed for all projects, and support a subset of categories in OWASP Top Ten
  • Support for granting users Identity and Access Management (IAM) roles at the organization level.
  • Access to integrated Google Cloud services, including the following:

  • Integrate with Forseti Security, the open source security toolkit for Google Cloud, and third-party security information and event management (SIEM) applications.

Premium tier features

The Premium tier includes all Standard tier features and adds the following:

  • Event Threat Detection uses threat intelligence, machine learning, and other advanced methods to monitor your organization's Cloud Logging and Google Workspace and detect the following threats:
    • Malware
    • Cryptomining
    • Brute force SSH
    • Outgoing DoS
    • IAM anomalous grant
    • Data exfiltration

    Event Threat Detection also identifies the following Google Workspace threats:

    • Leaked passwords
    • Attempted account breaches
    • Changes to 2-step verification settings
    • Changes to single sign-on (SSO) settings
    • Government-backed attacks
  • Container Threat Detection detects the following container runtime attacks:
    • Added Binary Executed
    • Added Library Loaded
    • Malicious Script Executed
    • Reverse Shell
  • Security Health Analytics: the Premium tier includes managed vulnerability scans for all Security Health Analytics detectors (140+) and provides monitoring for many industry best practices, and compliance monitoring across your Google Cloud assets. These results can also be reviewed in a Compliance dashboard and exported as manageable CSVs.

    In the Premium tier, Security Health Analytics includes monitoring and reporting for the following standards:

    • CIS 1.1
    • CIS 1.0
    • PCI DSS v3.2.1
    • NIST 800-53
    • ISO 27001
  • Web Security Scanner in the Premium tier includes all Standard tier features and adds managed scans that are automatically configured. These scans identify the following security vulnerabilities in your Google Cloud apps:
    • Cross-site scripting (XSS)
    • Flash injection
    • Mixed-content
    • Clear text passwords
    • Usage of insecure JavaScript libraries
  • Support for granting users IAM roles at the organization, folder, and project levels.
  • Continuous Exports, which automatically manage the export of new findings to Pub/Sub.

VM Manager vulnerability reports

  • If you enable VM Manager, the service automatically writes findings from its vulnerability reports, which are in preview, to Security Command Center. The reports identify vulnerabilities in the operating systems installed on Compute Engine virtual machines. For more information, see VM Manager.

For information about costs associated with using a Security Command Center tier, see Pricing.

To subscribe to the Security Command Center Premium tier, contact your account representative.

Strengthen your security posture

Security Command Center works with Cloud Asset Inventory to provide complete visibility into your Google Cloud infrastructure and resources, also referred to as assets. Built-in services—Security Health Analytics, Event Threat Detection, Container Threat Detection, and Web Security Scanner—use nearly 200 detection modules that continuously monitor and scan your assets, web applications, Cloud Logging stream, Google Workspace logs, and Google Groups.

Powered by Google's threat intelligence, machine learning, and unique insights into the architecture of Google Cloud, Security Command Center detects vulnerabilities, misconfigurations, threats, and compliance violations in near-real time. Security findings and compliance reports help you triage and prioritize risks, and provide verified remediation instructions and expert tips for responding to findings.

The following figure illustrates the core services and operations in Security Command Center.

How SCC works

Expansive inventory of assets, data, and services

Security Command Center ingests data about new, modified, and deleted assets from Cloud Asset Inventory, which continuously monitors assets in your cloud environment. Security Command Center supports a large subset of Google Cloud assets. For most assets, configuration changes, including IAM and organization policies, are detected in near-real time. You can quickly identify changes in your organization and answer questions like:

  • How many projects do you have, and how many projects are new?
  • What Google Cloud resources are deployed or in use, like Compute Engine virtual machines (VMs), Cloud Storage buckets, or App Engine instances?
  • What's your deployment history?
  • How to organize, annotate, search, select, filter, and sort across the following categories:
    • Assets and asset properties
    • Security marks, which enable you to annotate assets or findings in Security Command Center
    • Time period

Security Command Center always knows the current state of supported assets and, in the Google Cloud Console or Security Command Center API, lets you review historical discovery scans to compare assets between points in time. You can also look for underused assets, like virtual machines or idle IP addresses.

Actionable security insights

Security Command Center's built-in and integrated services continuously monitor your assets and logs for indicators of compromise and configuration changes that match known threats, vulnerabilities, and misconfigurations. To provide context for incidents, findings are enriched with information from the following sources:

You get notifications for new findings in near real-time, helping your security teams gather data, identify threats, and act on recommendations before they result in business damage or loss.

With a centralized dashboard and robust API, you can quickly do the following:

  • Answer questions like:
    • What static IP addresses are open to the public?
    • What images are running on your VMs?
    • Is there evidence that your VMs are being used for coin-mining or other abusive operations?
    • Which service accounts have been added or removed?
    • How are firewalls configured?
    • Which storage buckets contain personally-identifiable information (PII) or sensitive data? This feature requires integration with Cloud Data Loss Prevention.
    • Which cloud applications are vulnerable to cross-site-scripting (XSS) vulnerabilities?
    • Are any of my Cloud Storage buckets open to the internet?
  • Take actions to protect your assets:
    • Implement verified remediation steps for asset misconfigurations and compliance violations.
    • Combine threat intelligence from Google Cloud and third party providers, such as Palo Alto Networks, to better protect your enterprise from costly compute layer threats.
    • Ensure the appropriate IAM policies are in place and get alerts when policies are misconfigured or unexpectedly changed.
    • Integrate findings from your own or third-party sources for Google Cloud resources, or hybrid or multi-cloud resources. For more information, see Adding a third-party security service.
    • Respond to threats in your Google Workspace environment and unsafe changes in Google Groups.

Security Command Center roles are granted at the organization, folder, or project level. Your ability to view, edit, create, or update findings, assets, security sources, and security marks depends on the level for which you are granted access. To learn more about Security Command Center roles, see Access control.

Remain compliant with industry standards

Compliance reporting is available as part of Security Health Analytics. Most of the service's detectors are mapped to one or more of the following compliance standards:

  • CIS Google Cloud Computing Foundations Benchmark v1.1.0 (CIS Google Cloud Foundation 1.1)
  • CIS Google Cloud Computing Foundations Benchmark v1.0.0 (CIS Google Cloud Foundation 1.0)
  • Payment Card Industry Data Security Standard 3.2.1
  • National Institute of Standards and Technology 800-53
  • International Organization for Standardization 27001
  • Open Web Application Security Project (OWASP) Top Ten

Security Health Analytics continuously evaluates your security posture against compliance standards. In addition, Security Command Center makes it easy to do the following:

  • Monitor and resolve compliance violations that are associated with findings.
  • Integrate Cloud Audit Logging events for Compute Engine, networking services, Cloud Storage, IAM, and Binary Authorization. This will help you meet regulatory requirements or provide an audit trail while investigating incidents.
  • If you subscribe to Security Command Center Premium, you get additional reporting and exporting options to ensure all of your resources are meeting compliance requirements.

Flexible platform to meet your security needs

Security Command Center includes integration options that let you enhance the service's utility to meet your evolving security needs:

When to use Security Command Center

The following table includes high-level product features, use cases, and links to relevant documentation to help you quickly find the content you need.

Feature Use cases Related docs
Asset discovery and inventory
  • Discover assets, services, and data across your organization and view them in one place.
  • Assess vulnerabilities for supported assets, and take action to prioritize fixes for the most severe issues.
  • Review historical discovery scans to identify new, modified, or deleted assets.
Optimize Security Command Center

Access control

Using the Security Command Center dashboard

Configuring asset discovery

Listing assets

Confidential data identification
  • Find out where sensitive and regulated data is stored using Cloud DLP.
  • Help prevent unintended exposure and ensure access is on a need-to-know basis.
Sending Cloud DLP results to SCC

SIEM and SOAR integration
  • Easily export Security Command Center data to external systems.
Exporting Security Command Center data

Continuous Exports

Vulnerability detection
  • Be proactively alerted to new vulnerabilities and changes in your attack surface.
  • Uncover common vulnerabilities like cross-site-scripting (XSS) and Flash injection that put your applications at risk.
Web Security Scanner overview

Vulnerabilities findings

Access control monitoring
  • Help ensure the appropriate access control policies are in place across your Google Cloud resources and get alerted when policies are misconfigured or unexpectedly change.
Access control
Threat detection
  • Detect malicious activities and actors in your infrastructure, and get alerts for active threats.
Event Threat Detection overview

Container Threat Detection overview

Remediate risks
  • Implement verified and recommended remediation instructions to quickly safeguard assets.
  • Focus on the most important fields in a findings to help security analysts quickly make informed triage decisions.
  • Enrich and connect related vulnerabilities and threats to identify and capture TTPs.
Investigating and responding to threats

Remediating Security Health Analytics findings

Remediating Web Security Scanner findings

Security response automation

Third-party security tool inputs
  • Integrate output from your existing security tools like Cloudflare, CrowdStrike, Prisma Cloud by Palo Alto Networks, and Qualys, into Security Command Center. Integrating output can help you to detect the following:

    • DDoS attacks
    • Compromised endpoints
    • Compliance policy violations
    • Network attacks
    • Instance vulnerabilities and threats
Configuring Security Command Center

Creating and managing security sources

Real-time notifications
  • Get Security Command Center alerts through email, SMS, Slack, WebEx, and other services with Pub/Sub notifications.
  • Adjust finding filters to exclude findings on allowlists.
Setting up finding notifications

Enabling real-time email and chat notifications

Using security marks

Exporting Security Command Center data

Filtering notifications

Add assets to allowlists

REST API and Client SDKs
  • Use the Security Command Center REST API or client SDKs for easy integration with your existing security systems and workflows.
Configuring Security Command Center

Accessing Security Command Center programmatically

Security Command Center API

What's next