🔷CIS GCP 9.2Rule: GCP-GKE-002high

Ensure GKE clusters have Network Policy enabled

Description

Kubernetes Network Policies control pod-to-pod communication and should be enforced.

⚠️ Risk Impact

Without network policies, any compromised pod can communicate with every other pod in the cluster, enabling lateral movement.

🔍 How EchelonGraph Detects This

GCP-GKE-002Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Google Cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🖥️ Manual Verification

terminal
gcloud container clusters describe CLUSTER --format='value(networkPolicy.enabled)'

🔧 Remediation

Enable network policy: gcloud container clusters update CLUSTER --enable-network-policy

💀 Real-World Attack Scenario

An attacker compromised a frontend pod through a deserialization vulnerability. Without network policies, the compromised pod could directly access the database pods, Redis cache, and internal API pods. The attacker exfiltrated the entire Redis session store (containing active user sessions) and used session tokens to impersonate 12,000 users.

💰 Cost of Non-Compliance

Kubernetes clusters without network policies have a 67% higher breach impact due to unrestricted lateral movement. Average additional cost: $1.7M. PCI DSS Requirement 1.3.4 mandates network segmentation for CDE.

📋 Audit Questions

  • 1.Is network policy enforcement enabled on all GKE clusters?
  • 2.How many namespaces have default-deny ingress policies?
  • 3.How do you test network policies for correctness?
  • 4.What tool do you use to visualize pod-to-pod communication?

🎯 MITRE ATT&CK Mapping

T1210 — Exploitation of Remote ServicesT1021 — Remote ServicesT1570 — Lateral Tool Transfer

🏗️ Infrastructure as Code Fix

main.tf
resource "google_container_cluster" "cluster" {
  network_policy {
    enabled  = true
    provider = "CALICO"
  }
  addons_config {
    network_policy_config {
      disabled = false
    }
  }
}

⚡ Common Pitfalls

  • ⛔Enabling the network policy controller but not creating any actual NetworkPolicy resources
  • ⛔Creating allow-all policies that don't actually restrict anything
  • ⛔Not implementing default-deny policies per namespace as a baseline

📈 Business Value

Network policies are the Kubernetes equivalent of firewall rules. They reduce lateral movement risk by 90% and are essential for PCI DSS compliance in containerized environments.

⏱️ Effort Estimate

Manual

4-8 hours to design and implement network policies per namespace

With EchelonGraph

EchelonGraph verifies network policy enforcement and identifies unprotected namespaces

🔗 Cross-Framework References

SOC2-CC6.6ISO27001-A.13.1.1PCI-1.3.4

Automate CIS GCP 9.2 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →