Postura predefinida para una IA segura,

En esta página, se describen las políticas preventivas y de detección que se incluyen en la versión v1.0 de la postura predefinida para una IA segura, extendida. Esta postura incluye dos conjuntos de políticas:

  • Un conjunto de políticas que incluye políticas de la organización que se aplican a cargas de trabajo de Vertex AI.

  • Un conjunto de políticas que incluye detectores de Security Health Analytics personalizados que se aplican a cargas de trabajo de Vertex AI.

Puedes usar esta postura predefinida para configurar una postura de seguridad que ayude a proteger Gemini y recursos de Vertex AI. Si quieres implementar esta postura predefinida, debes personalizar algunas de las políticas para que se apliquen a tu entorno.

Restricciones de las políticas de la organización

En la siguiente tabla, se describen las políticas de la organización que se incluyen en esta postura.

Política Descripción Estándar de cumplimiento
ainotebooks.accessMode

Esta restricción Define los modos de acceso que se permiten en Vertex AI Workbench notebooks e instancias.

Debes configurar este valor cuando adoptes esta postura predefinida.

 Control de NIST SP 800-53: AC-3(3) y AC-6(1)
ainotebooks.disableFileDownloads

Esta restricción impide la creación de instancias de Vertex AI Workbench con el archivo opción de descarga habilitada. De forma predeterminada, la opción de descarga de archivos se puede habilitar en en cualquier instancia de Vertex AI Workbench.

El valor es de true a desactivar las descargas de archivos en instancias nuevas de Vertex AI Workbench.

 Control de NIST SP 800-53: AC-3(1)
ainotebooks.disableRootAccess

Esta restricción evita Instancias y notebooks recientemente creados y administrados por el usuario de Vertex AI Workbench de habilitar el acceso raíz. De forma predeterminada, Vertex AI Workbench lo administra los notebooks y las instancias pueden tener habilitado el acceso raíz.

El valor es true para inhabilitar el acceso raíz en el nuevo Vertex AI Workbench con instancias y notebooks administrados por el usuario.

 Control de NIST SP 800-53: AC-3 y AC-6(2)
ainotebooks.disableTerminal

Esta restricción impide la creación de instancias de Vertex AI Workbench con la terminal habilitada. De forma predeterminada, la terminal se puede habilitar en Instancias de Vertex AI Workbench.

El valor es de true a inhabilitar la terminal en instancias nuevas de Vertex AI Workbench.

 Control de NIST SP 800-53: AC-3, AC-6 y CM-2
ainotebooks.environmentOptions

Esta restricción define las opciones de imagen de contenedor y VM que un usuario puede seleccionar cuando crea una Instancias y notebooks de Vertex AI Workbench en los que se aplica esta restricción de manera forzosa. Las opciones que se permitan o se denieguen deben estar enumeradas de manera explícita.

Los valores son los siguientes:

policy_rules:
        - values:
            allowed_values:
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/caffe1-latest-cpu-experimental
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/r-3-6-cpu-experimental-20200617
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-ent-2-1-cpu-20200613
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-2-2-cu101-20200616
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf-1-15-cu100-20200615
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:latest
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m48
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m46
            - is:ainotebooks-container/custom-container:latest
Control de NIST SP 800-53: AC-3, AC-6 y CM-2
ainotebooks.requireAutoUpgradeSchedule

Esta restricción requiere que los notebooks recién creados y administrados por el usuario de Vertex AI Workbench tienen configurado un programa de actualización automática.

El valor es true requerirán actualizaciones programadas automáticas en los dispositivos nuevos Instancias y notebooks administrados por el usuario de Vertex AI Workbench.

 Control de NIST SP 800-53: AU-9, CM-2 y CM-6
ainotebooks.restrictPublicIp

Esta restricción restringe acceso de IP pública a notebooks de Vertex AI Workbench recién creados y individuales. De forma predeterminada, las IP públicas pueden acceder a los notebooks de Vertex AI Workbench e instancias.

El valor es true para restringir el acceso de IP pública en nuevos notebooks e instancias de Vertex AI Workbench.

 Control de NIST SP 800-53: AC-3, AC-4 y SC-7
ainotebooks.restrictVpcNetworks

Esta lista define Redes de VPC que un usuario puede seleccionar cuando crea una nueva instancia de Vertex AI Workbench instancias en las que se aplica esta restricción.

Debes configurar este valor cuando adoptes esta postura predefinida.

 Control de NIST SP 800-53: AC-3, AC-4 y CM-2

Detectores de estadísticas de estado de seguridad

En la siguiente tabla, se describen los módulos personalizados para Security Health Analytics que se incluidas en la postura predefinida.

Nombre del detector Recurso aplicable Descripción Estándares de cumplimiento
vertexAIDataSetCMEKDisabled aiplatform.googleapis.com/Dataset

Este detector verifica si cualquier conjunto de datos no se encripta con una clave de encriptación administrada por el cliente (CMEK).

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu de tu conjunto de datos. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13
vertexAIModelCMEKDisabled aiplatform.googleapis.com/Model

Este detector verifica si un modelo no está encriptado con una CMEK.

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu model. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13
vertexAIEndpointCMEKDisabled aiplatform.googleapis.com/Endpoint

Este detector verifica si un extremo no está encriptado con una CMEK.

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu extremo. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13
vertexAITrainingPipelineCMEKDisabled aiplatform.googleapis.com/TrainingPipeline

Este detector verifica si una canalización de entrenamiento no está encriptada con una CMEK.

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu en una canalización de entrenamiento. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13
vertexAIDataLabelingJobCMEKDisabled aiplatform.googleapis.com/DataLabelingJob

Este detector verifica si una etiqueta de datos no está encriptada con una CMEK.

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu etiqueta de datos. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13
vertexAICustomJobCMEKDisabled aiplatform.googleapis.com/CustomJob

Este detector verifica si un trabajo que ejecuta una carga de trabajo personalizada no está encriptado con una CMEK.

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu trabajo personalizado. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13
vertexAIDataLabelingJobHyperparameterTuningJobCMEKDisabled aiplatform.googleapis.com/HyperparameterTuningJob

Este detector verifica si un trabajo de ajuste de hiperparámetros no está encriptado con una CMEK.

Para resolver este hallazgo, verifica que creaste la clave y de claves, configuraste permisos y proporcionaste la clave cuando creaste tu de ajuste de hiperparámetros. Para obtener instrucciones, consulta Configura CMEK para tu recursos.

 Control de la SP 800-53 del NIST: SC12 y SC13

Definición de YAML

A continuación, se incluye la definición YAML de la postura predefinida para una IA segura.

name: organizations/123/locations/global/postureTemplates/secure_ai_extended
description: Posture Template to make your AI workload secure.
revision_id: v.1.0
state: ACTIVE
policy_sets:
- policy_set_id: Secure-AI policy_set
  description: 8 org policies that new customers can automatically enable.
  policies:
  - policy_id: Define access mode for Vertex AI Workbench notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3(3)
    - standard: NIST SP 800-53
      control: AC-6(1)
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.accessMode
        policy_rules:
        - values:
            allowed_values:
            - is:service-account
            - is:single-user
    description: This list constraint defines the modes of access allowed to Vertex AI Workbench notebooks and instances where enforced. The allow or deny list can specify multiple users with the service-account mode or single-user access with the single-user mode. The access mode to be allowed or denied must be listed explicitly.
  - policy_id: Disable file downloads on new Vertex AI Workbench instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3(1)
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.disableFileDownloads
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, prevents the creation of Vertex AI Workbench instances with the file download option enabled. By default, the file download option can be enabled on any Vertex AI Workbench instance.
  - policy_id: Disable root access on new Vertex AI Workbench user-managed notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6(2)
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.disableRootAccess
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, prevents newly created Vertex AI Workbench user-managed notebooks and instances from enabling root access. By default, Vertex AI Workbench user-managed notebooks and instances can have root access enabled.
  - policy_id: Disable terminal on new Vertex AI Workbench instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    - standard: NIST SP 800-53
      control: CM-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.disableTerminal
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, prevents the creation of Vertex AI Workbench instances with the terminal enabled. By default, the terminal can be enabled on Vertex AI Workbench instances.
  - policy_id: Restrict environment options on new Vertex AI Workbench notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    - standard: NIST SP 800-53
      control: CM-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.environmentOptions
        policy_rules:
        - values:
            allowed_values:
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-cpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-gpu
            - is:ainotebooks-vm/deeplearning-platform-release/image-family/caffe1-latest-cpu-experimental
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/r-3-6-cpu-experimental-20200617
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-ent-2-1-cpu-20200613
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-2-2-cu101-20200616
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/tf-1-15-cu100-20200615
            - is:ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:latest
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m48
            - is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m46
            - is:ainotebooks-container/custom-container:latest
    description: "This list constraint defines the VM and container image options a user can select when creating new Vertex AI Workbench notebooks and instances where this constraint is enforced. The options to be allowed or denied must be listed explicitly. \n
    The expected format for VM instances is ainotebooks-vm/PROJECT_ID/IMAGE_TYPE/CONSTRAINED_VALUE. Replace IMAGE_TYPE with image-family or image-name. Examples: ainotebooks-vm/deeplearning-platform-release/image-family/pytorch-1-4-cpu, ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615. \n
    The expected format for container images will be ainotebooks-container/CONTAINER_REPOSITORY:TAG. Examples: ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15:latest, ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15:m48."
  - policy_id: Require automatic scheduled upgrades on new Vertex AI Workbench user-managed notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AU-9
    - standard: NIST SP 800-53
      control: CM-2
    - standard: NIST SP 800-53
      control: CM-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.requireAutoUpgradeSchedule
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, requires that newly created Vertex AI Workbench user-managed notebooks and instances have an automatic upgrade schedule set. The automatic upgrade schedule can be defined by using the `notebook-upgrade-schedule` metadata flag to specify a cron schedule for the automatic upgrades.
  - policy_id: Restrict public IP access on new Vertex AI Workbench notebooks and instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-4
    - standard: NIST SP 800-53
      control: SC-7
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.restrictPublicIp
        policy_rules:
        - enforce: true
    description: This boolean constraint, when enforced, restricts public IP access to newly created Vertex AI Workbench notebooks and instances. By default, public IPs can access Vertex AI Workbench notebooks and instances.
  - policy_id: Restrict VPC networks on new Vertex AI Workbench instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-4
    - standard: NIST SP 800-53
      control: CM-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: ainotebooks.restrictVpcNetworks
        policy_rules:
        - values:
            allowed_values:
            - is:organizations/ORGANIZATION_ID
            - is:folders/FOLDER_ID
            - is:projects/PROJECT_ID
            - is:projects/PROJECT_ID/global/networks/NETWORK_NAME
    description: This list constraint defines the VPC networks a user can select when creating new Vertex AI Workbench instances where this constraint is enforced. By default, a Vertex AI Workbench instance can be created with any VPC networks. The allowed or denied list of networks must be identified in the form.
- policy_set_id: Secure-AI SHA_policy_set
  description: 5 custome SHA modules that new customers can automatically enable.
  policies:
  - policy_id: CMEK key is use for Vertex AI DataSet
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIDataSetCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/Dataset
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI Model
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIModelCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/Model
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI Endpoint
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIEndpointCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/Endpoint
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI TrainingPipeline
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAITrainingPipelineCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/TrainingPipeline
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI DataLabelingJob
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIDataLabelingJobCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/DataLabelingJob
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI CustomJob
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAICustomJobCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/CustomJob
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED
  - policy_id: CMEK key is use for Vertex AI HyperparameterTuningJob
    compliance_standards:
    - standard: NIST SP 800-53
      control: SC-12
    - standard: NIST SP 800-53
      control: SC-13
    constraint:
      security_health_analytics_custom_module:
        display_name: "vertexAIDataLabelingJobHyperparameterTuningJobCMEKDisabled"
        config:
          customOutput: {}
          predicate:
            expression: "!has(resource.encryptionSpec)"
          resource_selector:
            resource_types:
            - aiplatform.googleapis.com/HyperparameterTuningJob
          severity: CRITICAL
          description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
          recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
        module_enablement_state: ENABLED

¿Qué sigue?