Dampak: Gambar Backup and DR Google Cloud kedaluwarsa

Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh pendeteksi ancaman saat mendeteksi potensi ancaman di resource cloud Anda. Untuk mengetahui daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.

Ringkasan

Pihak yang berpotensi berniat jahat telah meminta untuk menghapus gambar cadangan.

Event Threat Detection adalah sumber temuan ini.

Cara merespons

Untuk menanggapi temuan ini, lakukan hal berikut:

Langkah 1: Tinjau detail temuan

  1. Buka temuan Inhibit System Recovery: Google Cloud Backup and DR expire image, seperti yang dijelaskan dalam Meninjau temuan. Panel detail untuk temuan akan terbuka di tab Summary.
  2. Di tab Ringkasan, tinjau informasi di bagian berikut:
    • Apa yang terdeteksi, terutama kolom berikut:
      • Nama kebijakan: nama untuk satu kebijakan, yang menentukan frekuensi, jadwal, dan waktu retensi pencadangan
      • Nama template: nama untuk serangkaian kebijakan yang menentukan frekuensi, jadwal, dan waktu retensi pencadangan
      • Nama profil: menentukan target penyimpanan untuk cadangan data aplikasi dan VM
      • Subjek utama: pengguna yang telah berhasil menjalankan tindakan
    • Resource yang terpengaruh
      • Nama tampilan resource: project tempat gambar cadangan dihapus
    • Link terkait, terutama kolom berikut:
      • Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK
      • URI Logging: link untuk membuka Logs Explorer

Langkah 2: Meneliti metode serangan dan respons

Hubungi pemilik akun layanan di kolom Principal email. Konfirmasi apakah pemilik yang sah melakukan tindakan tersebut.

Langkah 3: Terapkan respons Anda

  1. Di project tempat tindakan dilakukan, buka konsol pengelolaan.
  2. Buka tab Monitor, lalu pilih Tugas untuk meninjau status tugas penghapusan cadangan.
  3. Jika tugas penghapusan tidak diberi otorisasi, buka izin IAM untuk meninjau pengguna yang memiliki akses ke data cadangan.

Contoh JSON temuan

Berikut adalah contoh JSON temuan.

{
  "finding": {
    "access": {
      "principalEmail": "USER_EMAIL",
      "callerIp": "IP_ADDRESS",
      "callerIpGeo": {
        "regionCode": "REGION_CODE"
      },
      "serviceName": "backupdr.googleapis.com",
      "methodName": "expireBackup",
      "principalSubject": "user:USER_EMAIL"
    },
    "attackExposure": {},
    "backupDisasterRecovery": {
      "backupTemplate": "TEMPLATE_NAME",
      "policies": [
        "POLICY_NAME"
      ],
      "profile": "PROFILE_NAME",
      "backupCreateTime": "EVENT_TIMESTAMP"
    },
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/FINDING_LOCATION/findings/FINDING_ID",
    "category": "Impact: Google Cloud Backup and DR expire image",
    "cloudDlpDataProfile": {},
    "cloudDlpInspection": {},
    "createTime": "EVENT_TIMESTAMP",
    "database": {},
    "description": "A user requested the deletion of a backup image from the Google Cloud Backup and DR Service. The deletion of a backup image does not prevent future backups.",
    "eventTime": "EVENT_TIMESTAMP",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {},
    "mitreAttack": {
      "primaryTactic": "IMPACT",
      "primaryTechniques": [
        "DATA_DESTRUCTION"
      ]
    },
    "mute": "UNDEFINED",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "severity": "HIGH",
    "state": "ACTIVE",
    "vulnerability": {},
    "externalSystems": {}
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "display_name": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "project_display_name": "PROJECT_ID",
    "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
    "parent_display_name": "FOLDER_NAME",
    "folders": []
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "backup_expire_image"
    },
    "detectionPriority": "MEDIUM",
    "affectedResources": [
      {
        "gcpResourceName": "//backupdr.googleapis.com/projects/PROJECT_NUMBER"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "0",
            "nanos": 0.0
          },
          "insertId": "INSERT_ID"
        }
      }
    ],
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1485/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "LINK_TO_LOG_QUERY"
        }
      ],
      "relatedFindingUri": {}
    },
    "description": "A user requested the deletion of a backup image from the Google Cloud Backup and DR Service. The deletion of a backup image does not prevent future backups.",
    "backupDisasterRecovery": {
      "backupTemplate": "TEMPLATE_NAME",
      "policies": [
        "POLICY_NAME"
      ],
      "profile": "PROFILE_NAME"
    }
  }
}

Langkah berikutnya