The 97 Google Cloud security checks Black Cat runs
Black Cat SSPM evaluates 97 security policies against your Google Cloud configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Google Cloud — what access Black Cat needs, and why.
Identity, MFA & sign-in
4 checks · highest severity: high
Access control & privilege
30 checks · highest severity: critical
Logging & audit
9 checks · highest severity: high
Network security
5 checks · highest severity: critical
Configuration hardening
45 checks · highest severity: critical
Identity, MFA & sign-in (4)
- Instance Uses Full Cloud-Platform API Scope severity: high
- Instance Does Not Block Project-Wide SSH Keys severity: medium
- OS Login Disabled on Instance severity: medium
- Cloud Function Default Service Account severity: medium
Access control & privilege (30)
- Overly Permissive IAM Binding severity: critical
- SA Impersonation Role Binding severity: high
- Excessive Project Owners severity: medium
- Owner Role Group Assignment severity: medium
- Privileged Service Account Binding severity: medium
- Old Service Account Keys severity: high
- User Managed Service Account Keys severity: medium
- Bucket Uniform Access Disabled severity: medium
- SA Key Creation Not Disabled severity: high
- SA Key Upload Not Disabled severity: medium
- Default SA Grant Not Disabled severity: high
- Service Account Key Expiry Not Enforced severity: medium
- Unrestricted API Key severity: high
- Stale API Key severity: medium
- KMS Separation of Duties Violation severity: high
- SA Separation of Duties Violation severity: high
- Org-Level Owner Binding severity: critical
- Org-Level Editor Binding severity: high
- External Members at Org Level severity: high
- Instance Uses Default Service Account severity: high
- Cloud KMS Key Publicly Accessible severity: critical
- Secret Manager Secret Publicly Accessible severity: critical
- GKE Legacy ABAC Enabled severity: critical
- GKE Workload Identity Disabled severity: high
- Unbounded Conditional Privileged Binding severity: high
- WIF Provider Trusts Public Issuer Without Attribute Condition severity: critical
- WIF Provider Missing Attribute Condition severity: high
- Privileged Service Account Impersonable From Unconditioned WIF Pool severity: critical
- Privileged Role Granted to Workload Identity Pool via Wildcard severity: critical
Logging & audit (9)
- Audit Logging Not Enabled severity: high
- Data Access Logs Incomplete severity: medium
- Subnet Flow Logs Disabled severity: high
- PostgreSQL log_connections Not Enabled severity: medium
- PostgreSQL log_disconnections Not Enabled severity: medium
- PostgreSQL log_min_messages Below WARNING severity: low
- PostgreSQL log_min_error_statement Above ERROR severity: low
- PostgreSQL log_min_duration_statement Not Disabled severity: low
- PostgreSQL pgaudit Extension Not Enabled severity: medium
Network security (5)
- IP Forwarding Enabled on Instance severity: medium
- Legacy VPC Network In Use severity: high
- Cloud Function Public Ingress severity: high
- Cloud Run Service Public Ingress severity: high
Configuration hardening (45)
- Public Firewall Rule severity: critical
- Firewall Rule Exposes Dangerous Port severity: critical
- Firewall Rule Egress Open to World severity: medium
- Bucket Versioning Disabled severity: low
- Security Contact Missing severity: high
- Essential Contacts Coverage Incomplete severity: medium
- Instance Serial Port Enabled severity: medium
- Shielded VM Disabled severity: medium
- Default VPC In Use severity: medium
- Cloud SQL Instance Has Public IP severity: high
- Cloud SQL SSL Not Required severity: high
- MySQL skip_show_database Not Enabled severity: medium
- MySQL local_infile Enabled severity: medium
- Cloud SQL Backup Not Enabled severity: medium
- Cloud KMS Key Rotation Period Exceeds 90 Days severity: high
- Cloud KMS Encryption Key Has No Rotation Schedule severity: medium
- Cloud KMS Key Primary Version Not Active severity: high
- Cloud KMS Key Uses Software Protection Level severity: low
- Secret Manager Secret Has No Rotation severity: medium
- Secret Manager Secret Has No Versioning severity: low
- GKE Network Policy Disabled severity: high
- GKE Private Cluster Disabled severity: high
- GKE Shielded Nodes Disabled severity: medium
- GKE Release Channel Not Set severity: medium
- GKE Database Encryption Disabled severity: medium
- GKE Intranode Visibility Disabled severity: low
- GKE Logging Disabled severity: high
- GKE Node Pool Auto-Upgrade Disabled severity: high
- Cloud Logging Sink Missing severity: high
- Log Metric for Project Ownership Missing severity: medium
- Log Metric for Audit Config Changes Missing severity: medium
- Log Metric for Custom Role Changes Missing severity: medium
- Alert Policy Disabled severity: medium
- Alert Policy Has No Notification Channels severity: high
- Log Metric Project Ownership Alert Missing severity: medium
- Log Metric Audit Config Alert Missing severity: medium
- Log Metric Custom Role Alert Missing severity: medium
- DNS DNSSEC Disabled severity: high
- DNS DNSSEC RSASHA1 Key-Signing Key severity: medium
- DNS DNSSEC RSASHA1 Zone-Signing Key severity: medium
- DNS Logging Disabled severity: medium
- No IAM Deny Policy Configured severity: medium
- IAM Deny Policy Does Not Cover Service Account Key Creation severity: medium
- IAM Deny Policy Has Overly Broad Exception Principals severity: medium
Other checks (4)
severity: critical Public Storage Bucket fix difficulty: medium #
Remove public access from GCP Storage buckets and use signed URLs for controlled access
- Navigate to GCP Console > Cloud Storage > Buckets
- Select the public bucket
- Remove allUsers and allAuthenticatedUsers from bucket permissions
- Use signed URLs or IAM conditions for controlled access
Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC8.1 CIS Controls v8 CIS-16.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12
severity: critical BigQuery Dataset Public Access fix difficulty: easy #
Remove allUsers and allAuthenticatedUsers access entries from the BigQuery dataset (CIS 7.1)
- Navigate to GCP Console > BigQuery
- Select the flagged dataset
- Click Sharing > Permissions
- Remove any entries granting access to allUsers or allAuthenticatedUsers
- Save changes
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-16.1 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: high SSL Policy Weak TLS Version fix difficulty: medium #
Update the SSL policy to require TLS 1.2 minimum and use MODERN or RESTRICTED profile (CIS 3.9)
- Navigate to GCP Console > Network Security > SSL Policies
- Select the flagged SSL policy
- Set minimum TLS version to TLS 1.2
- Change profile to MODERN or RESTRICTED
- Save and verify affected target proxies
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.6 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7
severity: high Cloud Function Plaintext Secrets in Environment fix difficulty: medium #
Move secrets from plaintext environment variables to Secret Manager references (CIS 1.17)
- Identify environment variables containing secrets (API keys, tokens, passwords)
- Store each secret in GCP Secret Manager
- Navigate to GCP Console > Cloud Functions
- Edit the function and replace plaintext env vars with Secret Manager references
- Deploy the updated function and verify functionality
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 CIS Controls v8 CIS-16.1 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.e.3 DORA (SaaS Security) DORA-9.8