​
Event Information

  • The v1.compute.targetHttpsProxies.setSslCertificates event in GCP for Compute refers to an action taken to set the SSL certificates for a target HTTPS proxy.
  • This event indicates that a change has been made to the SSL certificates associated with a target HTTPS proxy in GCP Compute.
  • It signifies that the SSL certificates used for securing HTTPS traffic to a specific target have been updated or modified.

​
Examples

  1. Misconfiguration of SSL certificates: If the v1.compute.targetHttpsProxies.setSslCertificates API is used incorrectly or with incorrect SSL certificates, it can lead to a security impact. For example, if an expired or revoked SSL certificate is added to the target HTTPS proxy, it can result in insecure communication and potential security vulnerabilities.

  2. Insecure SSL/TLS protocols and ciphers: When setting SSL certificates using the v1.compute.targetHttpsProxies.setSslCertificates API, it is important to ensure that only secure SSL/TLS protocols and strong ciphers are used. If weak or outdated protocols and ciphers are configured, it can expose the system to potential security risks, such as man-in-the-middle attacks or data interception.

  3. Lack of certificate validation: The v1.compute.targetHttpsProxies.setSslCertificates API should be used with proper certificate validation mechanisms in place. Failing to validate the authenticity and integrity of SSL certificates can result in the acceptance of fraudulent or tampered certificates, compromising the security of the communication channel. It is crucial to implement certificate validation checks, including checking the certificate chain, expiration dates, and revocation status, to mitigate security risks.

​
Remediation

​
Using Console

  1. Enable VPC Flow Logs:
  • Go to the GCP Console and navigate to the VPC network where the Compute instances are located.
  • Select the subnet(s) associated with the Compute instances.
  • Click on “Edit” to modify the subnet configuration.
  • Scroll down to the “Flow logs” section and click on “Enable flow logs”.
  • Configure the desired flow log settings, such as the log destination and filter.
  • Click on “Save” to enable VPC flow logs for the selected subnet(s).
  1. Implement Network Security Groups:
  • Go to the GCP Console and navigate to the VPC network where the Compute instances are located.
  • Select the subnet(s) associated with the Compute instances.
  • Click on “Edit” to modify the subnet configuration.
  • Scroll down to the “Firewall rules” section and click on “Add firewall rule”.
  • Configure the necessary firewall rule(s) to restrict inbound and outbound traffic based on the desired security requirements.
  • Click on “Save” to apply the firewall rule(s) to the selected subnet(s).
  1. Implement Identity and Access Management (IAM) Roles:
  • Go to the GCP Console and navigate to the IAM & Admin section.
  • Click on “IAM” to manage IAM roles and permissions.
  • Identify the relevant IAM roles that need to be assigned to the Compute instances.
  • Click on “Add” to add a new IAM role assignment.
  • Select the desired Compute instances or instance groups.
  • Choose the appropriate IAM role(s) based on the required access level.
  • Click on “Save” to apply the IAM role(s) to the selected Compute instances.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Compute using GCP CLI, you can follow these steps:

  1. Disable public IP for an instance:

    • Use the gcloud compute instances describe command to get the details of the instance.
    • Note down the instance name and zone.
    • Run the gcloud compute instances delete-access-config command to remove the public IP from the instance: 
      gcloud compute instances delete-access-config [INSTANCE_NAME] --zone [ZONE] --access-config-name "External NAT"

  2. Enable OS Login for an instance:

    • Use the gcloud compute instances describe command to get the details of the instance.
    • Note down the instance name and zone.
    • Run the gcloud compute instances add-metadata command to enable OS Login for the instance: 
      gcloud compute instances add-metadata [INSTANCE_NAME] --zone [ZONE] --metadata enable-oslogin=TRUE

  3. Restrict SSH access to specific IP ranges:

    • Use the gcloud compute firewall-rules list command to get the list of firewall rules.
    • Note down the name of the firewall rule that allows SSH access.
    • Run the gcloud compute firewall-rules update command to restrict SSH access to specific IP ranges: 
      gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --source-ranges [IP_RANGE_1],[IP_RANGE_2],... --direction INGRESS

Please replace the placeholders ([INSTANCE_NAME], [ZONE], [FIREWALL_RULE_NAME], [IP_RANGE_1], [IP_RANGE_2], …) with the actual values specific to your environment.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Compute using Python, you can use the following approaches:

  1. Enforce strong passwords:

    • Use the Google Cloud Identity and Access Management (IAM) API to create a custom role with the necessary permissions to manage user accounts.
    • Write a Python script that utilizes the IAM API to enforce strong password policies for GCP Compute instances.
    • The script should iterate through all the instances and update the passwords for the user accounts based on the defined policy.

  2. Enable disk encryption:

    • Use the Google Cloud Key Management Service (KMS) API to create a key ring and a key for disk encryption.
    • Write a Python script that utilizes the Compute Engine API to enable disk encryption for all the Compute instances.
    • The script should iterate through all the instances and enable disk encryption using the created key.

  3. Implement network security groups:

    • Use the Google Cloud Firewall API to create network security groups (firewall rules) to restrict inbound and outbound traffic.
    • Write a Python script that utilizes the Firewall API to create and apply the necessary firewall rules to the Compute instances.
    • The script should iterate through all the instances and apply the defined network security groups to ensure proper traffic filtering.

Please note that the provided scripts are just high-level examples, and you may need to modify them based on your specific requirements and environment setup.