47
Misconfigurations
Identified
GCP IAM
Unique permission model secured
Org policies
Enforced at hierarchy level
Cloud SCC
Command Center configured
CIS GCP
Benchmark assessment
GCP IAM Assessment & Hardening
GCP Cloud IAM controls access to every resource in your Google Cloud environment. We assess IAM bindings for over-permissive roles, service account key exposure, workload identity federation configuration, and Organization Policy constraints: identifying privilege escalation paths and unnecessary access grants.
Security Command Center Configuration
Security Command Center (SCC) is GCP's native security posture management platform. We enable and configure SCC Premium, set up findings export to your SIEM, and tune built-in detectors for Event Threat Detection and Container Threat Detection to generate actionable security intelligence.
VPC Security & Firewall Assessment
We assess GCP VPC architecture including firewall rules, VPC Service Controls configuration, Private Google Access, Cloud Armor WAF rules, and Cloud NAT. Network security in GCP requires understanding VPC-native networking patterns that differ significantly from AWS and Azure.
CIS GCP Foundations Benchmark
We assess your GCP environment against the CIS Google Cloud Platform Foundations Benchmark: covering IAM, logging, networking, virtual machines, storage, cloud SQL, and BigQuery: and produce a remediation plan with implementation guidance.
GCP Compliance: SOC 2, PCI DSS, HIPAA
GCP provides compliance tooling through Security Command Center, Assured Workloads, and Access Transparency. We configure these tools for your compliance requirements and produce the control evidence your auditors need for SOC 2, PCI DSS, and HIPAA assessments.
GCP Organization Structure & Landing Zone Review
GCP's resource hierarchy: Organization, Folders, and Projects: determines the blast radius of any security failure. We review your Organization structure, Organization Policy constraints, and folder-level IAM inheritance to ensure security controls apply at the right scope.
What Makes Us Different From Others
- GCP-Specific IAM Expertise GCP IAM has unique concepts: workload identity federation, service account impersonation, and domain-wide delegation: that require GCP-specific expertise to assess correctly.
- VPC Service Controls Assessment VPC Service Controls create security perimeters around GCP resources that prevent data exfiltration. We assess whether your VPC Service Controls are configured correctly and covering the right resources.
- Organization Policy Review Organization policies enforce guardrails across all GCP projects. We assess your current policies and recommend additional constraints that reduce your attack surface.
- Multi-Cloud Experience Many organizations running GCP also use AWS or Azure. We assess GCP in the context of your broader cloud environment and identify cross-cloud risks.
- Compliance Evidence Automation We configure SCC findings export and logging to generate continuous compliance evidence for SOC 2, PCI DSS, and HIPAA.
Our AWS environment had grown organically for three years and nobody had ever done a security review. garrisonOne found 47 misconfigurations in a single assessment: public S3 buckets, overly permissive IAM roles, unencrypted data at rest. Everything was remediated in six weeks and we passed our SOC 2 cloud controls section without a single finding.
Client results
See how we have helped
Technology / SaaS
SaaS Startup — AWS Security Hardening
A seed-stage SaaS startup had customer data in a public S3 bucket. garrisonOne conducted a full AWS security assessment against CIS benchmarks and hardened the environment in 4 weeks.
3
Public S3 buckets closed
19
Overprivileged IAM roles fixed
100%
Security review passed
Industry focus
Industries we serve
Related Services: Cloud Security | AWS Security | Cloud Security Assessment | Cloud Pen Testing
Frequently asked questions
What are the most common GCP security misconfigurations?
The most common GCP security misconfigurations are: service account keys with broad permissions exported and stored insecurely, overly permissive IAM bindings at the Organization or Folder level, storage buckets with public access enabled, disabled audit logging for admin activity and data access, missing VPC Service Controls, and Cloud SQL instances with public IP addresses.
What is GCP Security Command Center?
Google Cloud Security Command Center (SCC) is GCP's unified security posture management platform. It provides asset discovery and inventory, vulnerability scanning through Security Health Analytics, threat detection through Event Threat Detection and Container Threat Detection, and compliance monitoring. SCC Premium includes additional threat detection capabilities and integration with Chronicle.
What are VPC Service Controls?
VPC Service Controls create security perimeters around GCP API services that prevent data exfiltration even from authorized users. Resources inside the perimeter can communicate with each other but cannot send data to resources outside the perimeter. This is particularly important for protecting BigQuery datasets, Cloud Storage buckets, and other data services from insider threat and compromised credential scenarios.
What is workload identity federation in GCP?
Workload identity federation allows external workloads: GitHub Actions, on-premises systems, AWS EC2 instances: to authenticate to GCP APIs without using service account keys. Keys are long-lived credentials that are frequently leaked. Workload identity federation is the recommended alternative because it uses short-lived tokens tied to a specific identity.
How does GCP handle compliance for regulated workloads?
GCP provides Assured Workloads for regulated workloads requiring data residency and sovereignty controls. It also provides Access Transparency for visibility into Google administrator access, Access Approval for requiring explicit approval of certain Google support activities, and compliance posture dashboards in Security Command Center Premium.
How long does a GCP security assessment take?
A focused GCP security assessment covering IAM, networking, SCC configuration, and compliance typically takes one to two weeks for a single-organization environment. Complex multi-project environments with data services and container workloads take two to three weeks.
Resources
Company
Contact
- US: 4752 Euclid Rd Suite 11,
Virginia Beach, VA 23462 - India: Orchard Street, Sector 61,
Gurgaon, Haryana - Phone: (301) 825-5518
- info@garrisonone.com
