Question

A financial services company has hundreds of Google Cloud projects across multiple folders. The CISO wants a centralized way to continuously detect misconfigured resources (such as public storage buckets and overly permissive firewall rules), identify active threats like crypto-mining on Compute Engine VMs, and map findings against compliance benchmarks like CIS and PCI DSS. The solution must aggregate findings organization-wide with minimal per-project setup. Which approach best meets these requirements?

Accepted Answer

Enable Security Command Center Premium at the organization level and use its built-in Security Health Analytics, Event Threat Detection, and compliance reports.

Answer

Deploy Cloud Logging sinks in each project to export logs to BigQuery, then write scheduled queries to detect misconfigurations and threats.

Answer

Configure organization policy constraints on every folder to block public buckets and permissive firewall rules, and rely on policy violations as the detection mechanism.

Answer

Install a third-party agent on each Compute Engine VM and forward findings to a self-managed SIEM running on GKE.