Cloud-native attacks are evolving fast and becoming increasingly more challenging to protect against. An attack path in the cloud is a combination of multiple risk factors that first lead to initial access to the cloud, and then to lateral movement, creating a path for attackers to reach crown jewels. With these new type of attack paths, identity has become the new perimeter in the cloud. Attackers attempt to assume the initial access to an environment via compromised credentials, like in the LAPSUS$ attack. Not only are identities used for initial access, but attackers also use misconfigured identities to find escalation paths and lateral movement that lead to the crown jewels. That is why organizations must protect their cloud identities and proactively remove identity risks that can lead to an attack path.
Identity and access management in Google Cloud Platform
Many Google Cloud customers use Google Workspace for managing their GCP identities and permissions. Google Workspace, leveraging Google Cloud Identity, offers a comprehensive Identity Provider (IdP) solution for Google Cloud customers, allowing them to easily manage users, groups, domains, applications, and devices through a centralized Admin console. By integrating Google Workspace with GCP, customers can efficiently control authentication of users and their permissions to GCP, allowing them to scale their operations while maintaining a robust identity management framework.
Secure your Google Cloud identities with the new Google Workspace modeling
We are excited to launch support for Google Workspace identity modeling as part of Wiz’s CIEM capabilities, helping Google Cloud customers protect their cloud identities. With the new Google Workspace modeling, Google Cloud customers gain visibility into their Google Cloud entitlements, identify identity misconfigurations in Google Cloud and Google Workspace, and proactively remove attack paths and harden their environment.
This is how Wiz secures Google Cloud entitlements:
Full visibility into Google Cloud identities
The first step in protecting identities and entitlements is gaining a centralized view of all your identities, across humans and services, and their permissions. With this launch, Wiz now provides complete visibility into Google Cloud identities that are managed in Google Workspace, with modeling on the Wiz Security Graph. This visibility enables customers to identify the groups in Google Workspace, the Users within the groups, and their permissions in their Google Cloud environment.
Identify Google Workspace Super Admin users
Wiz now alerts you of Google Workspace users that have a Super Admin role. Google Workspace Super Admin users have access to all permissions in Google Workspace, such as creating additional admin roles, changing passwords, and inviting unmanaged users. A compromised Super Admin user can result in a critical risk to your Google Cloud environment. An attacker could use the Super Admin permissions to add a new user to a Google Workspace group that has Admin permissions in Google Cloud, and gain admin access to your environment. Now, you can quickly identify all users in your Google Workspace that have Super Admin permissions and proactively remove risk.
Analyze effective permissions to identify high-privileges, admin, and excessive GCP permissions
The next step after gaining visibility, is understanding the effective permissions of each identity in your environment. Wiz builds a map of effective access between all Google cloud principals and resources, taking into account advanced cloud-native mitigating controls such as boundaries. This helps you answer questions such as “who has access and to what resources?”.
To help you enforce least privileges, Wiz automatically identifies and alerts of identities with high-privileges and admin permissions in your environment to ensure they are scoped properly. Wiz also identifies identities with excessive permissions and generates granular recommendations to right-size permissions that allow you to follow guided remediation steps to reduce access and revoke unused permissions.
Detect IAM misconfigurations in GCP with built-in Wiz Controls
Misconfigured IAM settings, for example a user with no MFA enabled, can lead to security risks such as unauthorized access. Wiz helps you identify Google Cloud misconfigured users with built-in controls extended to Google Workspace. Such misconfigurations include users with no MFA enabled, identity exposures, inactive users, and publicly exposed admin compute resources.
Proactively remove lateral movement paths
To successfully protect and remove attack paths in your Google Cloud, you need to understand how an attacker can move laterally in your environment. With the new Google Workspace modeling, detect Google Cloud identities that can lead to lateral movement paths such as cross-account, by which an attacker can gain admin permission to your Google Cloud environment and takeover the account.
Detect Google Workspace threats in near real-time
Not only are we enabling Google Cloud customers to proactively remove identity risks in their environment, but we are also excited to enable them to detect threats in Google Workspace in near real-time. We released over 50 new threat detection rules for Google Workspace, helping customers identify and respond to threats quickly. The new rules include detection of suspicious Google Workspace login events, configuration changes such as disabling 2FA across the domain, creation of new users, and more.
Let’s take a look at one of the new rules for Large number of failed logins followed by a successful login to Google Workspace by a high privileged user.
Google Workspace events are correlated back to the GCP cloud context, allowing customers to understand the blast radius of a threat in their cloud environment. For this event, you can quickly understand context around the GCP user in scope and its permissions and look at the remediation guidance to scope down permissions and reduce blast radius.
The new modeling for Google Workspace and the new threat detection rules enables customers to protect their Google Cloud identities from prevention to detection. Get started now with protecting your Google Cloud identities, you can learn more in the Wiz docs (login needed). If you prefer a live demo, we would love to connect with you.
