🔷CIS GCP 3.2Rule: GCP-NET-002medium

Ensure VPC Flow Logs are enabled

Description

VPC Flow Logs capture network flow data for monitoring and forensics.

⚠️ Risk Impact

Without flow logs, network-based attacks (data exfiltration, lateral movement) cannot be detected or investigated after the fact.

🔍 How EchelonGraph Detects This

GCP-NET-002Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Google Cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.

🖥️ Manual Verification

terminal
gcloud compute networks subnets list --format='table(name,region,enableFlowLogs)'

🔧 Remediation

Enable flow logs on each subnet: gcloud compute networks subnets update SUBNET --region=REGION --enable-flow-logs

💀 Real-World Attack Scenario

An attacker established a reverse shell from a compromised VM and slowly exfiltrated 4.7GB of database exports over 3 weeks using DNS tunneling. Without VPC Flow Logs, there was no evidence of the unusual outbound traffic patterns. The breach was only discovered when a customer reported their data on a dark web forum.

💰 Cost of Non-Compliance

Breaches without network logs have 80% longer dwell time (IBM 2024). Average cost increase from late detection: $1.2M. Regulatory penalties for inadequate logging: HIPAA $100K-$1.5M per violation category.

📋 Audit Questions

  • 1.Show evidence that VPC Flow Logs are enabled on ALL subnets.
  • 2.What is the log retention period?
  • 3.How are flow logs monitored and alerted on?
  • 4.Are flow logs exported to a centralized SIEM?

🎯 MITRE ATT&CK Mapping

T1048 — Exfiltration Over Alternative ProtocolT1071 — Application Layer Protocol

🏗️ Infrastructure as Code Fix

main.tf
resource "google_compute_subnetwork" "subnet" {
  name          = "app-subnet"
  ip_cidr_range = "10.0.0.0/24"
  region        = var.region
  network       = google_compute_network.vpc.id
  log_config {
    aggregation_interval = "INTERVAL_5_SEC"
    flow_sampling        = 0.5
    metadata             = "INCLUDE_ALL_METADATA"
  }
}

⚡ Common Pitfalls

  • ⛔Enabling flow logs with too low sampling rate (missing short-lived connections)
  • ⛔Not exporting logs to a long-term storage backend before auto-expiry
  • ⛔High flow log volume increasing Cloud Logging costs unexpectedly

📈 Business Value

VPC Flow Logs are essential for incident response, forensic investigation, and anomaly detection. They reduce mean-time-to-detect by 65% and are required by HIPAA, PCI DSS, and SOC 2.

⏱️ Effort Estimate

Manual

1-2 hours to enable on all subnets; ongoing cost monitoring

With EchelonGraph

EchelonGraph verifies flow log configuration across all subnets continuously

🔗 Cross-Framework References

SOC2-CC7.2ISO27001-A.12.4.1HIPAA-164.312(b)

Automate CIS GCP 3.2 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →