Web application security is crucial for the protection of organizational and client data. In 2021, cyber ​​attacks caused approximately 6 trillion USD in damage, which is expected to increase by 15% annually over the next 5 years. Thus, it is essential to use all possible tools to reduce the risk of these cyber attacks.

Google Cloud Armor is a web-application level “firewall” (WAF) capable of protecting companies from a wide variety of cyberattacks in a simple and efficient way. In order to use this tool, we will have to use Google Cloud Platform’s load balancers since that is where Cloud Armor can be enabled on the backend services.

Once the load balancer has been configured and a security policy has been activated for a backend service, it is time to adjust which WAF rules should be applied. There is a wide variety available depending on our needs. The following table shows a list of some of these preconfigured rules grouped by categories:

Each of these rules contains dozens of signatures that are compiled from ModSecurity v3.0.2. Google Cloud Platform (GCP) provides a controlled way to debug these rules with real traffic. The best part is that users are not affected, since we can select them in “preview only” mode. This means that every time one of these rules is triggered, it will simply be logged and let the traffic through. Obviously, by activating preview mode, we will not be securing our platform in any way, Still, in this way, we are able to avoid false positives and gradually add each of these rules. 

In addition to the preview-only mode, GCP uses verbose logging capabilities. What does this mean? For each request blocked by these rules, we will see detailed information in the log on which signature and what part of the request has caused the block. As previously mentioned, each of the rules listed in the previous table contains a number of signatures, so some of these signatures may cause false positives and should thus be disabled.

With this protection we can avoid the following attacks:

• SQL injection
• Cross-site scripting
• Local file inclusion
• Remote file inclusion
• Remote code execution
• Method enforcement (public preview)
• Scanner detection
• Protocol attack
• PHP injection attack
• Session fixation attack

Do you want to know more about how to better secure your websites and applications? The Making Science Cloud team can help. Get in touch at info@makingscience.com. We look forward to hearing from you!

When migrating your infrastructure to the cloud one of your main concerns might be: is the cloud really secure? And how can I maintain control of all that happens in my cloud infrastructure? 

Google Cloud Platform’s Security Command Center is one solution to help answer those questions. It centralizes the visualization of all your organization’s assets and its possible vulnerabilities or misconfigurations.

To start using the Security Command Center, you must first activate it within your organization using an account that has privileged admin roles. Luckily you can get started using the stand tier free of charge.

Standard Tier

Here are some of the useful features the standard tier offers:

• Security Health Analytics scans Google Cloud assets looking for vulnerabilities and misconfigurations like:
  • MFA being inactive for a certain account (we know how risky this is in a privileged account)
  • It detects members outside the organization with access to resources that are included in a group with permissions.
  • Dangerous open ports in the perimetral firewall.
  • Exposed public log buckets.
• With predefined rules against the most common attacks and the possibility to create custom rules like IP filtering, Cloud Armor acts as a WAF, adding another layer of security to all your deployments. We love and use this feature in all our website deployments. The Security Command Center helps us visualize all the incidents it detects and to adapt our rules accordingly.
• You can detect security anomalies in your VMs like potentially leaked credentials and crypto mining.
• All this information can be exported to BigQuery or your favorite third-party SIEM to be processed

For a more detailed rundown of all the features, you can check the official documentation.

Premium Tier

There are additional features in the Security Command Center premium tier, such as:

• Container Threat Detection​: this service continuously monitors the state of deployed container images. It will alert you if there was an added binary to the image that was not in the original one. It will also alert you about the execution of malicious scripts or reverse shells.
• Using threat intelligence and machine learning, Malware, brute force SSH and outgoing DoS anomalies are added to the Event Threat Detection. It also adds the detection of changes to MFA, SSO, or leaked passwords to the user’s account protection.
• One of the most important features of this tier is the possibility to create compliance dashboards and reports following the most used standards in the industry like CIS, NIST, PCI, or ISO27001. You can view and export these compliance reports to help ensure all your resources are meeting all their compliance requirements.
• If you enable VM Manager, you can detect vulnerabilities in the operating systems installed on virtual machines.
• Create SMS alerts, and emails, or have them sent to your favorite chat application with Pub/Sub notifications.

We use the Security Command Center extensively for its defensive security features like Cloud Armor and its health monitoring of the organization’s users and assets. As we discover more of its features, we are integrating them to make the most of its full potential.

Here we have just detailed some of the capabilities of the Security Command Center, but there are many more that can suit your specific needs.

Are you looking to make your site more secure? Making Science has got you covered! We can perform site audits and provide recommendations about where and how to get started.

Get in touch