GCP for DevOps — Security Command Center

Security Command Center

Security Command Center (SCC) is GCP’s centralized security and risk management platform. It provides asset inventory, vulnerability detection, threat detection, and compliance monitoring across your entire organization.

SCC Tiers

Feature	Standard (Free)	Premium
Asset Inventory	✅	✅
Security Health Analytics	Basic	Full
Web Security Scanner	Manual	Managed
Event Threat Detection	❌	✅
Container Threat Detection	❌	✅
Virtual Machine Threat Detection	❌	✅
Compliance Monitoring	❌	✅ (CIS, PCI DSS, NIST)

Security Health Analytics

SCC automatically scans for misconfigurations:

# List findings
$ gcloud scc findings list organizations/123456789 \
    --source=organizations/123456789/sources/- \
    --filter='state="ACTIVE" AND category="PUBLIC_BUCKET_ACL"'

# List all active findings
$ gcloud scc findings list organizations/123456789 \
    --source=organizations/123456789/sources/- \
    --filter='state="ACTIVE"' \
    --format="table(finding.category, finding.resourceName, finding.severity)"

Common Findings

Finding	Severity	Description
PUBLIC_BUCKET_ACL	HIGH	Cloud Storage bucket publicly accessible
OPEN_FIREWALL	HIGH	Firewall rule allows 0.0.0.0/0
MFA_NOT_ENFORCED	HIGH	No 2-step verification required
OVER_PRIVILEGED_SERVICE_ACCOUNT	MEDIUM	SA has owner/editor role
DEFAULT_NETWORK	LOW	Default VPC network exists
LEGACY_NETWORK	MEDIUM	Legacy network in use

Manage Findings

# Update finding state (mark as resolved)
$ gcloud scc findings update FINDING_ID \
    --source=organizations/123456789/sources/SOURCE_ID \
    --organization=123456789 \
    --state=INACTIVE

# Mute a finding (false positive)
$ gcloud scc findings set-mute FINDING_ID \
    --source=organizations/123456789/sources/SOURCE_ID \
    --organization=123456789 \
    --mute=MUTED

# Create a mute rule (auto-mute matching findings)
$ gcloud scc muteconfigs create dev-buckets \
    --organization=123456789 \
    --filter='resource.projectDisplayName="dev-project" AND category="PUBLIC_BUCKET_ACL"' \
    --description="Mute public bucket findings in dev"

Notifications

# Create a Pub/Sub notification for high-severity findings
$ gcloud scc notifications create critical-alerts \
    --organization=123456789 \
    --pubsub-topic=projects/my-project/topics/scc-alerts \
    --filter='state="ACTIVE" AND severity="CRITICAL"'

Event Threat Detection (Premium)

Detects threats in real time:

Threat	Detection
Brute force SSH	Multiple failed SSH attempts
Crypto mining	Suspicious compute usage patterns
Data exfiltration	Unusual data transfer volumes
Malware	Known malicious binary execution
IAM anomalies	Unusual IAM policy changes

Container Threat Detection (Premium)

Container Threat Detection:
┌──────────────┐    ┌──────────────────┐
│  GKE Cluster   │───▶│ Container Threat  │
│                │    │ Detection          │
│  Monitors:     │    │                    │
│  • Binary exec │    │ Alerts on:         │
│  • Libraries   │    │ • Reverse shells   │
│  • Scripts     │    │ • Crypto miners    │
│  • Network     │    │ • Privilege escal. │
└──────────────┘    └──────────────────┘

Common Mistakes

Mistake	Why It’s Wrong	Fix
SCC not enabled	No security visibility	Enable at org level
Not reviewing findings	Misconfigs accumulate	Review weekly
No notifications	Threats go unnoticed	Set up Pub/Sub alerts
Ignoring MEDIUM findings	They become HIGH	Triage all severities
Not using mute rules	Alert fatigue from false positives	Create mute rules for known exceptions

Quick Reference

Command	Description
gcloud scc findings list	List findings
gcloud scc findings update	Update finding state
gcloud scc findings set-mute	Mute a finding
gcloud scc muteconfigs create	Create mute rule
gcloud scc notifications create	Set up notifications

Next → VPC Service Controls