Google Distributed Cloud (GDC) air-gapped supports continuous security monitoring, vulnerability management, incident response, audit logging, emergency access, disaster recovery, and rolling upgrades.
Security operations
GDC Security Operations (SecOps) provides continuous monitoring, threat detection, vulnerability management, and incident response to protect regulated air-gapped workloads. System security operations monitor the underlying hardware and platform infrastructure, while you can monitor tenant organizations and workloads using the organization observability stack and external security information and event management (SIEM) log export.
Infrastructure security monitoring and incident response
Infrastructure security operations include the following capabilities:
- Continuous telemetry and endpoint monitoring: infrastructure security operations collect and correlate infrastructure audit logs, network flow logs, host telemetry, and endpoint detection alerts across the root admin cluster, bare-metal hosts, switches, and storage appliances to detect behavioral anomalies and unauthorized activity.
- Vulnerability management: GDC performs pre-release common vulnerabilities and exposures (CVE) scanning on the low side prior to software delivery and continuous vulnerability and configuration compliance scanning on the high side, updated through signed offline advisories and threat intelligence bundles.
- Incident response lifecycle: security operations follow standardized runbooks across detection, triage, containment, investigation, response, and recovery. When a CVE or security incident is identified, an incident commander (IC) coordinates verification, common vulnerability scoring system (CVSS) assessment, air-gapped patch delivery, and customer communication.
Customer security monitoring and external SIEM export
You can monitor security and operational activity within your organizations and projects:
- Organization observability stack: query and view authentication events, API audit logs, network flow logs, and workload metrics directly in the built-in organization observability platform.
- External SIEM export: export audit and operational logs to an external SIEM system for centralized correlation within your enterprise security operations center (SOC).
- Audit log backup and restoration: back up and restore audit logs to immutable storage to support long-term retention and forensic investigation.
For more information, see the following documentation:
| Topic | Documentation and configuration guides |
|---|---|
| Logging and SIEM export | Logging overview and Export logs to an external SIEM system |
| Audit logs and retention | Audit logs overview and Secure and restore audit logs |
Reliability operations
Security and availability in GDC are reinforced through continuous audit logging, audited emergency access procedures, multi-zone disaster recovery, non-disruptive rolling upgrades, and declarative change management.
- Audit logging and observability: GDC records authentication requests, token lifecycle events, administrative changes, control-plane API calls, and security events (firewall, intrusion detection and prevention systems (IDPS), and anti-malware) in alignment with federal logging visibility requirements. Audit logs can be backed up to immutable write-once-read-many (WORM) object storage and restored for forensic investigation.
- Audited emergency access: infrastructure operators have no routine access to customer data. In emergency troubleshooting scenarios, you can explicitly grant temporary access using time-bound, dual-authorized just-in-time (JIT) credentials protected by the hardware security module (HSM) or offline safes and SSH certificate authentication. GDC logs all actions and rotates SSH keys immediately after the incident.
- Backup, disaster recovery, and multi-zone resiliency: you can deploy workloads across multi-zone universes to tolerate zone failures, replicate block volumes and object buckets asynchronously across zones, and schedule automated backups for Kubernetes clusters, namespaces, virtual machines (VMs), and databases.
- Rolling upgrades and infrastructure as code (IaC): automated lifecycle management tooling orchestrates non-disruptive rolling software, firmware, and signature upgrades across the air gap after verifying cryptographic signatures and SHA-256 checksums. Configuration changes are managed through IaC with multi-party review and approval to prevent unilateral changes and configuration drift.
For more information, see the following documentation:
| Topic | Documentation and configuration guides |
|---|---|
| Observability and alerting | Observability overview and Alerting overview |
| Backup, disaster recovery, and cluster upgrades | Disaster recovery overview, Back up and restore overview, Deploy highly available applications, and Upgrade a Kubernetes cluster |