Google Cloud Security Command Center Reviews

I am primarily working with Google Cloud Security Command Center, which is their CSPM, and also with the next-generation firewall.

I have worked in different phases with it. Sometimes organizations do not have an understanding of Google Cloud Security Command Center, so I worked as a consultant, and later on, they agreed to take this product or services, so I implement those things and created the security postures on GCP in Google Cloud Security Command Center.

The effectiveness of automated threat detection in Google Cloud Security Command Center can be evaluated using different tiers available in GCP, where each tier has different features for threat detections. For example, Google Cloud Security Command Center Standard helps with VM or container threat detection, and the premium feature has enhanced options for in-depth analyses, with settings for VMs or containers to provide automatic detections of vulnerabilities or previous logs.

The custom security dashboards of Google Cloud Security Command Center provide actionable insights for refining my organization's security policies by allowing for automation, where alerts can be scheduled, and actions can be taken, utilizing Google services such as binary authorization for ensuring secure deployments, and setting up rules for vulnerabilities in container images or VMs, ensuring they do not enter the system.

I am currently a security consultant in my company, and based on the requirements from customers, I assess what they need, such as setting up secure landing zones for GCP, and I get involved according to their statements of work.

The best feature of Google Cloud Security Command Center is that it is flexible to integrate with several third-party tools or services, and it is more customized. For example, it is already giving a misconfiguration and the vulnerability, and if somebody wants to do some in-depth analysis for patterns such as metrics, they can export the continuous log on the spot with that tool. From an integration point of view, I would say it is more customized with different tools.

The asset discovery feature of Google Cloud Security Command Center enhances my security strategy because, nowadays, data sensitivity and data privacy are very important, and using some DLP utility, I can classify and set up rules to generate reports based on the classification in their asset discovery. This can also include data classification on Google storage buckets, and overall, Google Cloud Security Command Center has that information, which can be used for various analyses or alerts.

It is very important for compliance assessment because every business is global and connects with different geographical locations, meaning each country has its own regulatory systems and internal compliance policies. Google Cloud Security Command Center has the feature to set up security postures based on which resources or assets inside Google Cloud can be marked as compliant or non-compliant, giving a risk score for immediate reporting to higher management or CISO, making it very helpful in terms of security, risk, and compliance.

There is definitely room for improvement in Google Cloud Security Command Center. While the functionality is very native, compared to third-party tools that offer a variety of features for easy integrations and custom KPIs, Google Cloud Security Command Center lacks some of these functionalities, requiring complex workarounds for custom reporting, and given that customers often use hybrid environments, having a broader perspective is necessary for integration.

I have been working with Google Cloud Security Command Center for more than four years.

I have worked on different ones. I have worked with Acuenox, and later on, I worked on different tools.

I rate Google Cloud Security Command Center a seven and a half out of ten. While it is a ten from a security perspective, it requires improvements in areas such as operations, alerting, and automation to enhance the overall system experience.

I would definitely recommend Google Cloud Security Command Center to others. They have different tiers in GCP, with support being one key aspect, making it a reliable system that can meet various needs with strong service options, especially for businesses or research-focused projects.

I would recommend using Google Cloud Security Command Center if a customer has only Google-related environments. However, for customers with AWS, Azure, or hybrid systems, they would need a third-party tool such as Palo Alto Prisma Cloud, which provides various services and can integrate well, especially from a security perspective.

I have worked with Palo Alto and completed their CSPM certification. My overall rating for Google Cloud Security Command Center is seven and a half out of ten.

The primary use case is to monitor the Google Cloud infrastructure across all projects for security-related alerts. The command center provides various features, including real-time alerting for tier-one customers and vulnerability scanning, but no incident or case management. 

This makes it less suitable for clients with multiple clouds, as they need to log into different systems to view alerts. For Google Cloud, you definitely need a unified Cloud Native Application Protection Platform (CNAPP) software. Compared to Azure and Defender, it is less sophisticated.

The continuous security assessment feature impacted my customers' organization's risk management practices. The practice itself involves operations personnel regularly visiting the dashboard, but it's not real-time. 

With software providers deploying directly to Google Cloud, and multiple people responsible for various projects, complexity increases. I don't think Google Cloud Security Command Center will remain effective in those cases.

AI-based capabilities: 

The only AI-related feature I've encountered is an alert notification, but it hasn't improved the alert itself. Most people would search for a CVE (Common Vulnerabilities and Exposures) on Google anyway. 

The AI capabilities have been heavily promoted, but I haven't seen a significant impact.

Most people use the threat detection dashboard, which is barely customizable. For customized views, you need to move the data out of Google or create a learning interface into Jira or the SOC. You can look at vulnerabilities or drill down on the research site. However, learning is on your own, or you need to purchase a Google product for it. Azure Defender is much more sophisticated in this regard.

Google Cloud Security Command Center needs better integration with other cloud solutions. You can integrate Security Command Center logs with Azure, but not the other way around. This makes it difficult to unify everything within the Security Command Center. Usually, you end up sending data away through Pub/Sub, and that could be improved. There's no simple solution for this.

Overall, if they want more people to adopt Google Cloud, they need to make it more widely acceptable and intuitive. There are only a few things people need, but most would probably try to move away from the Google Command Center and into their SOC or a separate app, which doesn't seem easy for an analyst to do without the help of an engineer.

I have been working with it for two and a half years. 

The technical support is fine. The last people I spoke to seemed knowledgeable, but they couldn't solve my problem. They are responsive, though. 

I would rate them a seven out of ten. 

The speed of response is fine. Maybe I'm rating them harshly because they couldn't solve my issue. There's always a bit of a time difference, but they do respond promptly, so I don't have an issue with that.

Neutral

As a consultant, I'm always interested in what's new for various clients and reasons. I run a proof of concept (POC) between the different products.

So, my customers work with Google Cloud Security Command Center and Microsoft Defender.

The community for AWS and Azure is much larger. There are more people who can assist you and more resources available, like YouTube videos, although those are mostly done by people out of India and can be difficult to understand. The pool of people you can hire who understand either AWS or Azure is also going to be larger.

For tier-one customers, it comes for free. 

I would recommend using it but only if you have analysts who understand Google Cloud. If you have an external SOC who doesn't, maybe wait and look for something more widely used. If you're specialized in GCP and have a competent SOC, go for it. I like it to some degree, but not as much as AWS and Azure.

Overall, I would rate the product a six out of ten, with ten being the best. 

The solution has a couple of modules within it. It takes care of it. It also provides visibility on the compliance level against SCC as a benchmark. Secondly, it addresses cloud misconfiguration. For instance, if there is an exposed public VM or an overprivileged account. Thirdly, it will prevent any threats or risks present.

Cloud configuration is the most valuable feature. It provides real-time information on whether somebody is trying to create or has already created something. We receive an alert and notification for every scan if any team creates misconfigurations.

Regarding threat detection, SCC provides out-of-the-box security features added to the containers.

The observability is good, but the visibility part could be improved. The ability to create custom dashboards is currently lacking. The second point which could be improved is the detection of attacks. The attack detection part is crucial because it identifies where the attack is coming from, how it can impact the environment, which vulnerabilities it can exploit, and what damage it can cause to a particular company.

I have been using the Google Cloud Security Command Center for 3 years.

In a managed solution, there's no stability. It is Google's responsibility to ensure that it works well.

I rate the solution's stability a ten out of ten.

There will be 20,000 to 30,000 endpoints, including components and firewalls, using the SCC suite.

I rate the solution’s scalability a ten out of ten.

Once we reached out to Google, Command support for this part where it was getting a bit, where it was fixed within it was fixed quickly.

Positive

We used open-source solutions and trial solutions like Aqua. Additionally, we explored specific tools from Google. However, they were a bit challenging to manage.

There's no setup required. Google manages it. You need to enable it. One person would be sufficient to monitor it if alerts are configured properly. Multiple people would be required to address issues. There will likely be application-level vulnerabilities, necessitating communication with the development or application team. Additionally, network-level issues may require collaboration with the network team.

It's a principle that you don't fully trust your end users, who are prone to making mistakes. There have been instances of misconfigurations in the past. Google Cloud Security Command Center identifies these issues and takes corrective action.

I rate the return on investment as seven out of ten.

The product is expensive with a fixed negotiated rate.

I rate the product’s pricing an eight out of ten, where one is cheap, and ten is expensive.

In terms of identifying, the solution is pretty good. It takes care of all the layers. We have Cloud, Kubernetes cluster, instances running, and network. We have identities, permissions, and access. It provides pictures of everything in GCP.

There's no such integration required. There are Google APIs that you need to enable.

The compliance reporting feature helped us maintain a baseline of compliance within the information security policies.

It's pretty stable and scalable. However, visibility can be improved along with automation. SCC to provide an option to fix those things, perhaps by clicking a button. For example, if a firewall rule allows an application to accept HTTP traffic, I should be able to address that specific issue directly within the interface. It's just a regular call to action button.

There are no prerequisites for the solution. It's a requirement to have good security visibility into your Google Cloud Infrastructure. Cloud Security Command Center could be a good product to consider. There are other open-source solutions available.

There are solutions from Aqua that are pretty decent. I would recommend that if somebody is opting for SCC, they should also explore open-source solutions. Open-source solutions can be very beneficial, especially if they are pursuing a multi-cloud strategy. You won't need additional security tools for platforms like AWS or others.

Whenever a security issue pops up, a generative AI backend provides a summary of what happened. The information provided is quite detailed.

Overall, I rate the solution an eight out of ten.

I primarily use it for customers, especially for compliance purposes, mapping to standards like CIS. Another use case, although rare due to configuration challenges, is web scanning for web applications.

Its valuable feature is the compliance feature that scans the entire environment and provides mapping to the necessary standards. It simplifies compliance efforts.

I have been using the solution for the past two years.

The stability of the solution is somewhat unpredictable. While it's generally close to being stable, occasional issues, even with something as simple as a web scanner, can arise.

The tool is scalable.

The initial setup was straightforward. It took us about 15 minutes to deploy.

In my case, in the last three years, the implementation of the system has become more accessible for small and medium businesses (SMBs). Initially, it used to be relatively expensive, starting at around four or five hundred dollars. However, now businesses can start with a smaller configuration, like one virtual CPU. The adoption varies based on the specific needs and use cases, but many small and medium businesses opt for it, especially those prioritizing business email security.

Google Security Command Center definitely offers a significant return on investment, particularly in terms of compliance. It streamlines the process for companies planning to expand, making it remarkably easy to ensure compliance with various standards. Compared to traditional methods that involve bringing in consultants, mapping assets, and extensive training, this tool allows for swift and efficient infrastructure security configurations, completing the process in a week or less. Overall, I rate the solution an eight out of ten.