GCP Security Posture Management (CSPM)

Security Posture Management (CSPM) helps to mitigate and minimize cloud data security breaches and to assess the overall posture of the entire cloud environment against best practices and compliance standards to help remediate issues.

CSPM tools verify that cloud configurations follow security best practices and compliance standards such as CIS, Azure, and GCP benchmarks as well as PCI and HIPAA frameworks. As companies are increasingly moving to the cloud, CSPM is becoming a necessary aspect of security insights.

The CSPM can be installed using a Docker container

Coralogix GRPC endpoints

For each installation method, we need to pass the following environment variables:

Installing as a Docker container

Prerequisites

1. Verify the following APIs are enabled on the project before running
   • Cloud Resource Manager API
   • API Keys API
   • Cloud SQL Admin API
   • Compute Engine API
   • Cloud Key Management Service (KMS) API
   • BigQuery API
   • Kubernetes Engine API
2. Create a Role with the following permissions (IAM & Admin > Roles)
   • If you have access to use gcloud command and wish to automate the role creation process, download the following file
   • Now run the command gcloud iam roles create test_coralogix_role1 –project –file=/path/to/yaml.yml
3. Create a service account and attach the previously created role (IAM & Admin > Service Accounts)
4. Create VM Instance
   • Attach the service account (3) to the instance
   • E2-small is sufficient
   • Internet connectivity
5. Docker installed on the VM instance – refer to Docker documentation

Note that the instance type will affect the run time, so it’s up to a personal preference and is affected by the environment size.

Deploying

After prerequisites are met, download the docker image using the following command (if the following command hasn’t run, the image will still be downloaded automatically in the next step):

docker pull coralogixrepo/snowbit-cspm

In order to automate the process, use Crontab in the following manner:

Create the crontab using your favorite editor

sudo crontab -e

Inside the document, on the bottom, paste the following one-liner (note that the API_KEY and the CORALOGIX_ENDPOINT_HOST fields are mandatory)

*/10 * * * *  docker rm snowbit-cspm ; docker rmi coralogixrepo/snowbit-cspm:latest ; docker run --name snowbit-cspm -d -e PYTHONUNBUFFERED=1 -e CLOUD_PROVIDER="gcp" -e COMPANY_ID=<coralogix_company_ID> -e CORALOGIX_ENDPOINT_HOST="coralogix_grpc_endpoint" -e APPLICATION_NAME="application_name" -e SUBSYSTEM_NAME="subsystem_name" -e TESTER_LIST="" -e API_KEY="send_your_data_api_key" -e REGION_LIST="" -e GOOGLE_APPLICATION_CREDENTIALS="path_to_credentials_file_in_the_container" -v <local_folder_that_contains_gcp_credentials>:<location_to_map_the_credentials_inside_the_container> coralogixrepo/snowbit-cspm

Configuring the scan settings

Inside the security tab in your Coralogix account, you will find the SCAN SETTINGS button:

1. Scan Now will start the scan of the selected environment(s) in up to 10 minutes from pressing (according to the configured cronjob)
2. Scan Schedule allows choosing the frequency of the scans, and the start time of each scan. the default is every 24 hours