Google Cloud network security checks
IP allow-lists, TLS, DNS and edge settings that keep the application reachable only from where it should be.
On Google Cloud, Black Cat runs 5 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Google Cloud connector needs.
Checks (5)
severity: medium IP Forwarding Enabled on Instance fix difficulty: easy #
Disable IP forwarding unless the instance is explicitly acting as a router or network appliance (CIS GCP 4.6)
- Navigate to GCP Console > Compute Engine > VM Instances
- Stop the flagged instance
- Click Edit and under Networking, uncheck IP forwarding
- Save and restart the instance
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.6 CIS Controls v8 CIS-04.6 NIST CSF 2.0 PR.IP NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Legacy VPC Network In Use fix difficulty: hard #
Migrate workloads to a custom-mode VPC network and delete the legacy network (CIS GCP 3.2)
- Navigate to GCP Console > VPC Network > VPC Networks
- Create a new custom-mode VPC network with properly sized subnets
- Migrate all resources from the legacy network to the new VPC
- Delete the legacy VPC network once migration is complete
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-03.2 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: critical Cloud SQL Authorized Networks Open to World fix difficulty: easy #
Remove 0.0.0.0/0 from authorized networks and restrict to specific IP ranges or use Cloud SQL Auth Proxy (CIS GCP 6.5)
- Navigate to GCP Console > SQL > Instances and select the flagged instance
- Click Edit, then open the Connections section
- Under Authorized networks, remove the 0.0.0.0/0 entry
- Add specific IP ranges that need access
- Consider using Cloud SQL Auth Proxy for secure access
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Cloud Function Public Ingress fix difficulty: easy #
Restrict Cloud Function ingress to internal-only or internal-and-GCLB traffic
- Navigate to GCP Console > Cloud Functions
- Select the flagged function
- Click Edit > Runtime, build, connections and security
- Under Ingress settings, select Allow internal traffic only
- Deploy the updated function
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-13.4 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Cloud Run Service Public Ingress fix difficulty: easy #
Restrict Cloud Run service ingress to internal or internal-and-cloud-load-balancing traffic
- Navigate to GCP Console > Cloud Run
- Select the flagged service
- Click Edit & Deploy New Revision
- Under Networking, set Ingress to Internal or Internal and Cloud Load Balancing
- Deploy the new revision
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-13.4 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9