Dampak: Rencana penghapusan Backup and DR Google Cloud

Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh pendeteksi ancaman saat mendeteksi potensi ancaman di resource cloud Anda. Untuk mengetahui daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.

Ringkasan

Security Command Center memeriksa log audit untuk mendeteksi penghapusan anomali pada paket pencadangan Backup and DR Service yang digunakan untuk menerapkan kebijakan pencadangan ke aplikasi.

Event Threat Detection adalah sumber temuan ini.

Cara merespons

Untuk menanggapi temuan ini, lakukan hal berikut:

Langkah 1: Tinjau detail temuan

  1. Buka temuan Impact: Google Cloud Backup and DR remove plan seperti yang dijelaskan dalam Meninjau temuan. Panel detail untuk temuan akan terbuka ke tab Summary.
  2. Di tab Ringkasan, tinjau informasi di bagian berikut:
    • Apa yang terdeteksi, terutama kolom berikut:
      • Nama aplikasi: nama database atau VM yang terhubung ke Backup and DR
      • Nama profil: menentukan target penyimpanan untuk cadangan data aplikasi dan VM
      • Nama template: nama untuk serangkaian kebijakan yang menentukan frekuensi, jadwal, dan waktu retensi pencadangan
    • Resource yang terpengaruh
      • Nama tampilan resource: project tempat paket dihapus
    • Link terkait, terutama kolom berikut:
      • Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK
      • URI Logging: link untuk membuka Logs Explorer

Langkah 2: Meneliti metode serangan dan respons

Hubungi pemilik akun layanan di kolom Principal email. Konfirmasi apakah pemilik yang sah melakukan tindakan tersebut.

Langkah 3: Terapkan respons Anda

  1. Di project tempat tindakan dilakukan, buka konsol pengelolaan.
  2. Di tab Pengelola Aplikasi, temukan aplikasi yang terpengaruh yang tidak lagi dilindungi dan tinjau kebijakan pencadangan untuk setiap aplikasi.

Contoh JSON temuan

Berikut adalah contoh JSON temuan.

{
  "finding": {
    "access": {
      "principalEmail": "USER_EMAIL",
      "callerIp": "IP_ADDRESS",
      "callerIpGeo": {
        "regionCode": "REGION_CODE"
      },
      "serviceName": "backupdr.googleapis.com",
      "methodName": "deleteSla",
      "principalSubject": "user:USER_EMAIL"
    },
    "attackExposure": {},
    "backupDisasterRecovery": {
      "applications": [
        "HOST_NAME"
      ],
      "backupCreateTime": "EVENT_TIMESTAMP"
    },
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/FINDING_LOCATION/findings/FINDING_ID",
    "category": "Inhibit System Recovery: Google Cloud Backup and DR remove plan",
    "cloudDlpDataProfile": {},
    "cloudDlpInspection": {},
    "createTime": "EVENT_TIMESTAMP",
    "database": {},
    "description": "A backup plan with multiple policies for an application was deleted from the Google Cloud Backup and DR Service. The deletion of a backup plan can prevent future backups.",
    "eventTime": "EVENT_TIMESTAMP",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {},
    "mitreAttack": {
      "primaryTactic": "IMPACT",
      "primaryTechniques": [
        "INHIBIT_SYSTEM_RECOVERY"
      ]
    },
    "mute": "UNDEFINED",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "severity": "HIGH",
    "state": "ACTIVE",
    "vulnerability": {},
    "externalSystems": {}
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "display_name": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "project_display_name": "PROJECT_ID",
    "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
    "parent_display_name": "FOLDER_NAME",
    "folders": []
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "backup_remove_plan"
    },
    "detectionPriority": "MEDIUM",
    "affectedResources": [
      {
        "gcpResourceName": "//backupdr.googleapis.com/projects/PROJECT_NUMBER"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "0",
            "nanos": 0.0
          },
          "insertId": "INSERT_ID"
        }
      }
    ],
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1490/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "LINK_TO_LOG_QUERY"
        }
      ],
      "relatedFindingUri": {}
    },
    "description": "A backup plan with multiple policies for an application was deleted from the Google Cloud Backup and DR Service. The deletion of a backup plan can prevent future backups.",
    "backupDisasterRecovery": {
      "applications": [
        "HOST_NAME"
      ]
    }
  }
}

Langkah berikutnya