Postura predefinita per AI sicura, estesa

In questa pagina vengono descritte le norme di prevenzione e indagine incluse in la versione v1.0 della postura predefinita per AI sicura, estesa. Questa postura include due set di criteri:

  • Un set di criteri che include i criteri dell'organizzazione che si applicano a carichi di lavoro Vertex AI.

  • Un set di criteri che include rilevatori personalizzati di Security Health Analytics applicabili a carichi di lavoro Vertex AI.

Puoi utilizzare questa postura predefinita per configurare una security posture che aiuti a proteggere Gemini alle risorse di Vertex AI. Se vuoi eseguire il deployment di questa postura predefinita, devi personalizzare alcuni dei criteri in modo che vengano applicati al tuo ambiente.

Vincoli dei criteri dell'organizzazione

La tabella seguente descrive i criteri dell'organizzazione inclusi in per questa postura.

Norme Descrizione Standard di conformità
ainotebooks.accessMode

Questo vincolo definisce le modalità di accesso consentite a Vertex AI Workbench blocchi note e istanze di Compute Engine.

Devi configurare questo valore quando adotti per questa postura predefinita.

 Controllo NIST SP 800-53: AC-3(3) e AC-6(1)
ainotebooks.disableFileDownloads

Questo vincolo impedisce di creare istanze di Vertex AI Workbench con il file abilitata l'opzione di download. Per impostazione predefinita, l'opzione di download di file può essere attivata su qualsiasi istanza di Vertex AI Workbench.

Il valore va da true a e disattivare i download dei file sulle nuove istanze di Vertex AI Workbench.

 Controllo NIST SP 800-53: AC-3(1)
ainotebooks.disableRootAccess

Questo vincolo impedisce istanze e blocchi note gestiti dall'utente di Vertex AI Workbench appena creati di abilitare l'accesso root. Per impostazione predefinita, Vertex AI Workbench è gestito dall'utente blocchi note e istanze possono avere l'accesso root abilitato.

Il valore è true per disattivare l'accesso root al nuovo Vertex AI Workbench e istanze di blocchi note gestiti dall'utente.

 Controllo NIST SP 800-53: AC-3 e AC-6(2)
ainotebooks.disableTerminal

Questo vincolo impedisce di creare istanze di Vertex AI Workbench. con il terminale abilitato. Per impostazione predefinita, il terminale può essere abilitato di Vertex AI Workbench.

Il valore va da true a e disattivare il terminale sulle nuove istanze di Vertex AI Workbench.

 Controllo NIST SP 800-53: AC-3, AC-6 e CM-2
ainotebooks.environmentOptions

Questo vincolo definisce le opzioni per l'immagine container e VM che un utente può selezionare quando crea Blocchi note e istanze di Vertex AI Workbench in cui questo vincolo è in modo forzato. Le opzioni da consentire o negare devono essere elencate esplicitamente.

I valori sono i seguenti:

policy_rules:
        - values:
            allowed_values:
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/caffe1-latest-cpu-experimental
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/r-3-6-cpu-experimental-20200617
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-ent-2-1-cpu-20200613
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-2-2-cu101-20200616
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf-1-15-cu100-20200615
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:latest
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m48
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m46
            - is:ainotebooks-container/custom-container:latest
Controllo NIST SP 800-53: AC-3, AC-6 e CM-2
ainotebooks.requireAutoUpgradeSchedule

Questo vincolo richiede che i nuovi blocchi note gestiti dall'utente di Vertex AI Workbench appena creati per le istanze VM è impostata una pianificazione automatica degli upgrade.

Il valore è true per richiedere upgrade automatici pianificati sui nuovi Istanze e blocchi note gestiti dall'utente di Vertex AI Workbench.

 Controllo NIST SP 800-53: AU-9, CM-2 e CM-6
ainotebooks.restrictPublicIp

Questo vincolo limita accesso IP pubblico ai blocchi note Vertex AI Workbench appena creati e di Compute Engine. Per impostazione predefinita, gli IP pubblici possono accedere ai blocchi note di Vertex AI Workbench e istanze di blocco note.

Il valore è true per limitare l'accesso IP pubblico su nuovi blocchi note e istanze di Vertex AI Workbench.

 Controllo NIST SP 800-53: AC-3, AC-4 e SC-7
ainotebooks.restrictVpcNetworks

Questo elenco definisce Reti VPC che l'utente può selezionare quando crea un nuovo Vertex AI Workbench e istanze VM in cui questo vincolo è applicato.

Devi configurare questo valore quando adotti questa postura predefinita.

 Controllo NIST SP 800-53: AC-3, AC-4 e CM-2

Rilevatori Security Health Analytics

La tabella seguente descrive i moduli personalizzati per Security Health Analytics che sono incluse nella postura predefinita.

Nome rilevatore Risorsa applicabile Descrizione Standard di conformità
vertexAIDataSetCMEKDisabled aiplatform.googleapis.com/Dataset

Questo rilevatore verifica se Qualsiasi set di dati non sia criptato utilizzando una chiave di crittografia gestita dal cliente (CMEK).

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento del set di dati. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13
vertexAIModelCMEKDisabled aiplatform.googleapis.com/Model

Questo rilevatore controlla se un modello non è criptato utilizzando una CMEK.

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento un modello di machine learning. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13
vertexAIEndpointCMEKDisabled aiplatform.googleapis.com/Endpoint

Questo rilevatore controlla se un endpoint non è criptato con una CMEK.

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento endpoint. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13
vertexAITrainingPipelineCMEKDisabled aiplatform.googleapis.com/TrainingPipeline

Questo rilevatore controlla se una pipeline di addestramento non è criptata utilizzando una CMEK.

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento di addestramento personalizzato. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13
vertexAIDataLabelingJobCMEKDisabled aiplatform.googleapis.com/DataLabelingJob

Questo rilevatore controlla se un'etichetta dati non è criptata utilizzando una CMEK.

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento etichetta dati. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13
vertexAICustomJobCMEKDisabled aiplatform.googleapis.com/CustomJob

Questo rilevatore controlla se un job che esegue un carico di lavoro personalizzato non è criptato usando una CMEK.

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento un job personalizzato. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13
vertexAIDataLabelingJobHyperparameterTuningJobCMEKDisabled aiplatform.googleapis.com/HyperparameterTuningJob

Questo rilevatore controlla se un job di ottimizzazione degli iperparametri non è criptato usando una CMEK.

Per risolvere questo risultato, verifica di aver creato la chiave e keyring, configurato le autorizzazioni e fornito la chiave al momento un job di ottimizzazione degli iperparametri. Per le istruzioni, vedi Configurare CMEK per Google Cloud.

 Controllo NIST SP 800-53: SC12 e SC13

Definizione YAML

Di seguito è riportata la definizione YAML per la postura predefinita per AI sicura.

name: organizations/123/locations/global/postureTemplates/secure_ai_extended
description: Posture Template to make your AI workload secure.
revision_id: v.1.0
state: ACTIVE
policy_sets:
- policy_set_id: Secure-AI policy_set
  description: 8 org policies that new customers can automatically enable.
  policies:
  - policy_id: Define access mode for Vertex AI Workbench notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3(3)
    - standard: NIST SP 800-53
      control: AC-6(1)
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.accessMode
        policy_rules:
        - values:
            allowed_values:
            - is:service-account
            - is:single-user
    description: This list constraint defines the modes of access allowed to Vertex AI Workbench notebooks and instances where enforced. The allow or deny list can specify multiple users with the service-account mode or single-user access with the single-user mode. The access mode to be allowed or denied must be listed explicitly.
  - policy_id: Disable file downloads on new Vertex AI Workbench instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3(1)
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.disableFileDownloads
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, prevents the creation of Vertex AI Workbench instances with the file download option enabled. By default, the file download option can be enabled on any Vertex AI Workbench instance.
  - policy_id: Disable root access on new Vertex AI Workbench user-managed notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6(2)
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.disableRootAccess
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, prevents newly created Vertex AI Workbench user-managed notebooks and instances from enabling root access. By default, Vertex AI Workbench user-managed notebooks and instances can have root access enabled.
  - policy_id: Disable terminal on new Vertex AI Workbench instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    - standard: NIST SP 800-53
      control: CM-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.disableTerminal
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, prevents the creation of Vertex AI Workbench instances with the terminal enabled. By default, the terminal can be enabled on Vertex AI Workbench instances.
  - policy_id: Restrict environment options on new Vertex AI Workbench notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    - standard: NIST SP 800-53
      control: CM-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.environmentOptions
        policy_rules:
        - values:
            allowed_values:
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/caffe1-latest-cpu-experimental
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/r-3-6-cpu-experimental-20200617
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-ent-2-1-cpu-20200613
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-2-2-cu101-20200616
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf-1-15-cu100-20200615
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:latest
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m48
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m46
            - is:ainotebooks-container/custom-container:latest
    description: "This list constraint defines the VM and container image options a user can select when creating new Vertex AI Workbench notebooks and instances where this constraint is enforced. The options to be allowed or denied must be listed explicitly. \n
    The expected format for VM instances is ainotebooks-vm/PROJECT_ID/IMAGE_TYPE/CONSTRAINED_VALUE. Replace IMAGE_TYPE with image-family or image-name. Examples: ainotebooks-vm/deeplearning-platform-release/image-family/pytorch-1-4-cpu, ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615. \n
    The expected format for container images will be ainotebooks-container/CONTAINER_REPOSITORY:TAG. Examples: ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15:latest, ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15:m48."
  - policy_id: Require automatic scheduled upgrades on new Vertex AI Workbench user-managed notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AU-9
    - standard: NIST SP 800-53
      control: CM-2
    - standard: NIST SP 800-53
      control: CM-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.requireAutoUpgradeSchedule
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, requires that newly created Vertex AI Workbench user-managed notebooks and instances have an automatic upgrade schedule set. The automatic upgrade schedule can be defined by using the `notebook-upgrade-schedule` metadata flag to specify a cron schedule for the automatic upgrades.
  - policy_id: Restrict public IP access on new Vertex AI Workbench notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-4
    - standard: NIST SP 800-53
      control: SC-7
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.restrictPublicIp
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, restricts public IP access to newly created Vertex AI Workbench notebooks and instances. By default, public IPs can access Vertex AI Workbench notebooks and instances.
  - policy_id: Restrict VPC networks on new Vertex AI Workbench instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-4
    - standard: NIST SP 800-53
      control: CM-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.restrictVpcNetworks
        policy_rules:
        - values:
            allowed_values:
            - is:organizations/ORGANIZATION_ID
            - is:folders/FOLDER_ID
            - is:projects/PROJECT_ID
            - is:projects/PROJECT_ID/global/networks/NETWORK_NAME
    description: This list constraint defines the VPC networks a user can select when creating new Vertex AI Workbench instances where this constraint is enforced. By default, a Vertex AI Workbench instance can be created with any VPC networks. The allowed or denied list of networks must be identified in the form.
- policy_set_id: Secure-AI SHA_policy_set
  description: 5 custome SHA modules that new customers can automatically enable.
  policies:
  - policy_id: CMEK key is use for Vertex AI DataSet
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIDataSetCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/Dataset
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI Model
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIModelCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/Model
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI Endpoint
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIEndpointCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/Endpoint
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI TrainingPipeline
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAITrainingPipelineCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/TrainingPipeline
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI DataLabelingJob
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIDataLabelingJobCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/DataLabelingJob
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI CustomJob
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAICustomJobCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/CustomJob
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI HyperparameterTuningJob
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIDataLabelingJobHyperparameterTuningJobCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/HyperparameterTuningJob
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED

Passaggi successivi