​
Event Information

  1. The v1.compute.targetHttpsProxies.setQuicOverride event in GCP for Compute refers to an action taken to set the QUIC (Quick UDP Internet Connections) override for a target HTTPS proxy.
  2. QUIC is a transport protocol developed by Google that aims to improve the performance of web applications by reducing latency and improving security.
  3. By setting the QUIC override for a target HTTPS proxy, it allows the proxy to handle QUIC traffic, enabling faster and more secure communication between clients and servers.

​
Examples

  1. Insecure communication: By enabling the v1.compute.targetHttpsProxies.setQuicOverride feature in GCP Compute, the security of HTTPS communication may be impacted. This can result in the use of the QUIC (Quick UDP Internet Connections) protocol, which is designed for performance rather than security. As a result, sensitive data transmitted over HTTPS may be more vulnerable to interception or tampering.

  2. Lack of encryption: Enabling the v1.compute.targetHttpsProxies.setQuicOverride feature may disable or weaken the encryption mechanisms used in HTTPS communication. This can lead to the transmission of data in plaintext or with weaker encryption algorithms, increasing the risk of unauthorized access or data breaches.

  3. Compliance violations: If your organization is subject to specific compliance standards or regulations, enabling the v1.compute.targetHttpsProxies.setQuicOverride feature without proper security measures may result in non-compliance. Compliance frameworks such as PCI DSS or HIPAA require the use of strong encryption and secure communication protocols, and disabling or weakening these security measures can lead to compliance violations and potential penalties.

​
Remediation

​
Using Console

  1. Enable VPC Flow Logs:
  • Go to the GCP Console and navigate to the VPC network where the Compute instances are located.
  • Select the subnet(s) associated with the Compute instances.
  • Click on “Edit” to modify the subnet configuration.
  • Scroll down to the “Flow logs” section and click on “Enable flow logs”.
  • Configure the desired flow log settings, such as the log destination and filter.
  • Click on “Save” to enable VPC flow logs for the selected subnet(s).
  1. Implement Network Security Groups:
  • Go to the GCP Console and navigate to the VPC network where the Compute instances are located.
  • Select the subnet(s) associated with the Compute instances.
  • Click on “Edit” to modify the subnet configuration.
  • Scroll down to the “Firewall rules” section and click on “Add firewall rule”.
  • Configure the necessary firewall rule(s) to restrict inbound and outbound traffic based on the desired security requirements.
  • Click on “Save” to apply the firewall rule(s) to the selected subnet(s).
  1. Implement Identity and Access Management (IAM) Roles:
  • Go to the GCP Console and navigate to the IAM & Admin section.
  • Click on “IAM” to manage IAM roles and permissions.
  • Identify the relevant IAM roles that need to be assigned to the Compute instances.
  • Click on “Add” to add a new IAM role assignment.
  • Select the desired Compute instances or instance groups.
  • Choose the appropriate IAM role(s) based on the required access level.
  • Click on “Save” to apply the IAM role(s) to the selected Compute instances.

​
Using CLI

  1. Enable VPC Flow Logs for GCP Compute instances:

    • Use the following command to enable VPC Flow Logs for a specific subnet: 
      gcloud compute networks subnets update [SUBNET_NAME] --enable-flow-logs

  2. Restrict SSH access to GCP Compute instances:

    • Create a new firewall rule to allow SSH access only from specific IP ranges: 
      gcloud compute firewall-rules create allow-ssh --allow tcp:22 --source-ranges [IP_RANGE]
    • Apply the firewall rule to the desired GCP Compute instances: 
      gcloud compute instances add-tags [INSTANCE_NAME] --tags allow-ssh

  3. Enable automatic OS patch management for GCP Compute instances:

    • Create a patch management policy: 
      gcloud compute os-config patch-policies create [POLICY_NAME] --os-filter=[OS_FILTER] --patch-window-start=[START_TIME] --patch-window-duration=[DURATION]
    • Apply the patch management policy to the desired GCP Compute instances: 
      gcloud compute instances add-metadata [INSTANCE_NAME] --metadata patch-policy=[POLICY_NAME]

​
Using Python

To remediate the issues mentioned in the previous response for GCP Compute using Python, you can use the following approaches:

  1. Enforce strong password policies:

    • Use the Google Cloud Identity and Access Management (IAM) API to create a custom password policy for GCP Compute instances.
    • Write a Python script that utilizes the IAM API to enforce password complexity requirements, such as minimum length, special characters, and regular password rotation.

  2. Enable disk encryption:

    • Use the Google Cloud Key Management Service (KMS) API to create and manage encryption keys.
    • Write a Python script that utilizes the KMS API to enable disk encryption for GCP Compute instances. This script can be used to encrypt existing unencrypted disks or to ensure that new disks are automatically encrypted upon creation.

  3. Implement network security groups:

    • Use the Google Cloud Firewall API to create and manage network security groups for GCP Compute instances.

    • Write a Python script that utilizes the Firewall API to define and enforce network access rules, such as allowing only specific IP ranges or protocols to access the instances. This script can be used to create and update firewall rules for Compute instances.