Issues are notable security concerns that Security Command Center helps identify in your cloud environments. Security Command Center scans and detects issues across your organization.
Issues are discovered through virtual red teaming and rule-based detections. For example, a detection with the name High Risk CVE on GCE with direct access to a high value resource covers the following situation:
- A high-risk common vulnerability or exposure (CVE) has been identified on a Compute Engine VM in your cloud environment.
- That compromised VM has access to a high value resource through a service account.
A detection can discover multiple instances of an issue. By default, in the Google Cloud console, issues with the same severity and detection are grouped together.
Issue sources
Issues are classified as medium, high, or critical severity, and come from the following sources:
- Toxic combinations and chokepoints
- Predefined detection rules
- Correlated Threats (Preview)
- Design-time findings from Application Design Center assessments that are integrated into Security Command Center.
- Runtime detections in the Application Design Center.
Investigate issues
You can find and respond to these security risks on the following the Google Cloud console pages at the organization, folder, project level, or by filtering based on an application:
- The Overview page: Provides an at-a-glance view of your top risks.
- The Issues page: Lists all identified issues with detailed remediation steps for your selected purview.
Viewing issues at different scopes
During an investigation, you can filter by the following:
- Organization: Displays all issues affecting all resources in the organization.
- Folder: Displays issues affecting resources contained in a specific folder or its subfolder when the issue is created by a security graph rule or Correlated Threats rule.
- Project: Displays issues affecting resources contained in a specific project when the issue is created by a security graph rule or Correlated Threats rule.
Security Command Center only generates issues when it is activated at the organization level.
The source of an issue determines whether you can view the issue at the organization, folder, or project level.
- Issues created by security graph rules and Correlated Threats rules can be viewed at the organization, folder, or project level.
- Issues created by Risk Engine for toxic combinations and chokepoints must be viewed at the organization level.
Viewing resource information in a selected resource level
An issue is attributed to a specific folder or project if the primary resource resides in the selected scope. Each security graph rule and Correlated Threats rule identifies the primary resource for the issue.
Scope attribution rules ensure that the issue is attributed to the correct folder and project, even when the security condition is on a primary resource outside of the selected folder or project.
Access control when viewing issues in a selected purview
To view issues and information about related resources in a selected scope, you must have the required IAM role at the organization, folder, or project level.
If you don't have the required permissions to view the resources that reside outside of the your selected scope, Security Command Center displays only the issue category, for example, VM with high-risk CVE with access to sensitive data.
If a secondary resource is in a different project or folder where you don't have the required IAM permissions, details about the resource are hidden.
Issue lifecycle
Issues remain active until they are resolved. You can resolve issues by fixing the findings referenced in the issues or by deleting the affected resources.
Inactive issues have a retention period of 90 days, after which they are deleted. For Correlated Threats issues (Preview), the retention period is 14 days.
View application-related information on the Issues page
When viewing the Issues page for an organization, folder, or project, you can see information about the App Hub application if the primary resource in the issue is registered as a service or workload in an application.
Use the Select app menu to display only issues where the primary resource is registered in the application that you selected as a service or workload. If None is selected, the list isn't filtered by application and displays issues for all resources, including those that are related to an application, and those that aren't related.
When you select a resource in an issue group, the Overview panel displays the application name.