0

An independent security auditor discovered many open ports by using nmap while auditing a web service deployed on GCP. The service is a Cloud Run instance behind an HTTP(s) load balancer. The auditor wants to flag these as risks in the audit report.

However Documentation from Google specifically mentions that a security auditor shouldn't use namp or similar scanning tools. Instead, inspect the forwarding rules configuration for the load balancer's configuration and inspect the firewall rule configuration applicable to backend VMs.

So far we've pointed out the documentation from Google and shared screenshots of the load balancer configuration from GCP console. However the auditor is not fully satisfied.

Have anyone else been in this situation? How did you/would you handle this? Since the auditor is independent, they do not have access to our GCP console and we prefer to keep it that way. Unless there is no other option. Thanks in advance and apologies in case this is not the right place to ask this question.

Improve this question
2
  • Surely an auditor should be able to look at whatever he likes.
    – Chenmunka
    Commented Oct 26, 2021 at 17:19
  • @Chenmunka - In large-scale audits, several auditors are deployed. Each auditor only has access to an agreed-upon set of information. Therefore, an auditor cannot look at anything he likes.
    – John Hanley
    Commented Oct 27, 2021 at 4:09

1 Answer 1

Reset to default
1

Your Cloud Run service is behind a shared service (GFE). To an auditor that is a risk. He should document that fact. You can then request an exemption. A security officer can then review the risk analysis and the exemptions and make a final determination on security. In the cloud, it is rare to have a perfect environment. Today resources are global and shared among many customers to reduce costs. There is a tradeoff between security, cost, and convenience.

In your question, you state that the auditor does not have access to the Google Console. That means the auditor is performing a black box audit. In the cloud that is not sufficient. The auditor should also be validating the internal security which includes identities, firewalls, network configurations, etc. In the cloud detecting backdoors is just as important as auditing open frontends.

Improve this answer
2
  • Thanks, I'll share this with my team. For reference, is there a standard procedure or a checklist specifically designed for cloud?
    – Raiyan
    Commented Oct 27, 2021 at 0:36
  • Since saying the cloud is like saying the planet, each checklist should be a series of checklists, one for each service deployed, and should be written/reviewed at each point in time. There are some generalized checklists that the security vendors use. Google search.
    – John Hanley
    Commented Oct 27, 2021 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .