​
Event Information

  • The v1.compute.firewalls.insert event in GCP for Compute refers to the creation of a new firewall rule in the Compute Engine service.
  • This event occurs when a user or an automated process initiates the creation of a firewall rule to control inbound or outbound traffic to virtual machine instances in GCP.
  • The event signifies the start of the process to define the firewall rule’s properties, such as the source and destination IP ranges, protocols, and ports, which will determine the allowed or denied network traffic.

​
Examples

  1. Unauthorized access: If security is impacted with v1.compute.firewalls.insert in GCP for Compute, it could potentially allow unauthorized users to insert new firewall rules. This could lead to the exposure of sensitive resources or services to the public internet, increasing the risk of unauthorized access and potential data breaches.
  2. Network vulnerabilities: Incorrect or misconfigured firewall rules inserted using v1.compute.firewalls.insert can create network vulnerabilities. For example, if a firewall rule is mistakenly set to allow all incoming traffic, it can expose the compute instances to various types of attacks, such as DDoS or brute-force attempts, compromising the security of the network.
  3. Data exfiltration: Inadequate firewall rules inserted using v1.compute.firewalls.insert can result in data exfiltration. For instance, if a firewall rule allows outbound traffic to any destination, it can enable malicious actors to exfiltrate sensitive data from the compute instances to external locations without detection. This can lead to data breaches and compromise the confidentiality of the data stored in the cloud environment.

​
Remediation

​
Using Console

  1. Enable VPC Flow Logs:
  • Go to the GCP Console and navigate to the VPC network where the Compute instances are located.
  • Select the subnet(s) associated with the instances.
  • Click on “Edit” and scroll down to the “Flow logs” section.
  • Enable flow logs by selecting the desired configuration (e.g., All metadata, Excludes internal traffic).
  • Choose a destination for the logs, either Stackdriver Logging or Cloud Storage.
  • Save the changes.
  1. Implement IAM Roles and Permissions:
  • Go to the GCP Console and navigate to the IAM & Admin section.
  • Click on “IAM” to manage IAM roles and permissions.
  • Identify the specific roles required for the Compute instances (e.g., Compute Instance Admin, Compute Network Admin).
  • Assign these roles to the appropriate users or service accounts.
  • Ensure that the principle of least privilege is followed, granting only the necessary permissions to each entity.
  1. Enable Security Groups and Firewall Rules:
  • Go to the GCP Console and navigate to the VPC network where the Compute instances are located.
  • Click on “Firewall rules” to manage the network’s security groups.
  • Review the existing firewall rules and identify any misconfigurations or unnecessary open ports.
  • Modify or create new firewall rules to restrict access to the Compute instances based on the principle of least privilege.
  • Ensure that only the required ports and protocols are allowed, and restrict access to specific IP ranges if necessary.
  • Save the changes to apply the updated firewall rules.
Note: The steps provided are general guidelines and may vary depending on the specific requirements and configurations of your GCP environment. It is recommended to refer to the official GCP documentation for detailed instructions and best practices.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Compute using GCP CLI, you can follow these steps:
  1. Disable SSH access for the default service account:
    • Use the following command to get the email address of the default service account: 
      gcloud iam service-accounts list --filter="displayName:Compute Engine default service account"
    • Once you have the email address, use the following command to remove the roles associated with SSH access: 
      gcloud projects remove-iam-policy-binding PROJECT_ID --member=serviceAccount:EMAIL_ADDRESS --role=roles/compute.osLogin
  2. Enable VPC Flow Logs for network monitoring:
    • Use the following command to enable VPC Flow Logs for a specific subnet: 
      gcloud compute networks subnets update SUBNET_NAME --region=REGION --enable-flow-logs
  3. Restrict public access to Cloud Storage buckets:
    • Use the following command to update the bucket ACL and remove all public access: 
      gsutil iam ch allUsers:legacyObjectReader gs://BUCKET_NAME
Note: Replace PROJECT_ID with your GCP project ID, EMAIL_ADDRESS with the email address of the default service account, SUBNET_NAME with the name of the subnet, REGION with the region where the subnet is located, and BUCKET_NAME with the name of the Cloud Storage bucket.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Compute using Python, you can use the following approaches:
  1. Enforce secure OS configurations:
    • Use the google-cloud-sdk library to programmatically manage GCP Compute instances.
    • Create a Python script that retrieves a list of instances and their configurations.
    • Implement a function to compare the configurations against a predefined secure baseline.
    • Use the google-cloud-sdk library to update the instances’ configurations to match the secure baseline.
  2. Implement network security controls:
    • Use the google-cloud-sdk library to retrieve a list of GCP Compute instances.
    • Create a Python script that iterates through the instances and checks their network security settings.
    • Implement a function to validate if the instances have the required firewall rules and network tags.
    • Use the google-cloud-sdk library to add or update firewall rules and network tags as needed.
  3. Monitor and detect unauthorized access:
    • Utilize the google-cloud-sdk library to retrieve logs and events related to GCP Compute instances.
    • Create a Python script that analyzes the logs and events to identify any unauthorized access attempts.
    • Implement a function to send notifications or trigger automated actions when unauthorized access is detected.
    • Use the google-cloud-sdk library to implement additional security measures like enabling VPC Flow Logs or Cloud Audit Logs.
Please note that the provided code snippets cannot cover the entire implementation process, but they can serve as a starting point for developing your own scripts.