Question

A SecOps engineer at a healthcare firm has deployed Cloud IDS to inspect north-south and east-west traffic in a VPC hosting patient-facing web applications. During a coverage review, the engineer notices that Cloud IDS is generating very few detections for a set of microservices that communicate over mutually authenticated TLS (mTLS). Leadership asks the engineer to evaluate whether Cloud IDS is providing effective detection coverage for these services and to recommend how to close any gap. What should the engineer conclude and recommend?

Accepted Answer

Cloud IDS cannot inspect the encrypted mTLS payloads, so it is blind to intra-service application-layer threats; the engineer should add application-layer and workload telemetry (e.g., GKE/app logs, endpoint or runtime signals) ingested into Google SecOps to close the gap.

Answer

Cloud IDS decrypts mTLS traffic natively using Packet Mirroring, so the low detection count means the traffic is genuinely clean and no additional action is required.

Answer

The engineer should increase the Cloud IDS threat profile severity to HIGH so it can force inspection of the encrypted sessions and surface hidden threats.

Answer

The gap should be closed by enabling SCC vulnerability scanning on the VPC, which will decrypt and inspect the mTLS microservice traffic in place of Cloud IDS.