Security Command Center without the wall of findings

The first time someone enables Security Command Center Premium on a mature organisation, the number that comes back is usually in the thousands. The reaction is predictable: a shared spreadsheet, two weeks of enthusiasm, and then the tab stays closed for a year.

The findings are not wrong. The problem is that SCC presents a flat list and your estate has a shape, and until you impose the shape on the list nothing is actionable.

Impose an order before you read anything

Sort findings on two axes that SCC does not give you directly: is it reachable from the internet, and does it grant or expose credentials. Everything in the intersection is this week's work, and it is usually a few dozen items, not thousands.

Concretely, the first pass is:

1. Public exposure with a credential or data path. Public Cloud Storage buckets, Cloud SQL with a public IP and open authorised networks, VMs with external IPs and 0.0.0.0/0 firewall rules on management ports, and any public BigQuery dataset. These are minutes to fix and they are what a scanner on the internet finds first.
2. Identity findings. Service account keys (see why they are the credential that leaks), primitive roles like roles/owner and roles/editor granted broadly, service accounts with token-creator on more privileged accounts, and non-domain members in IAM policies.
3. Missing detection. Audit logs not exported, data access logs off for the projects that hold customer data, no log sink to a separate project. This one is not exploitable by itself, but without it you cannot investigate anything above.
4. Everything else, which is where the thousands live, and which becomes tractable only after the next section.

Kill the recurring classes with org policy, not tickets

Most of the volume in SCC is one misconfiguration repeated across two hundred resources. Fixing them one at a time is a treadmill; preventing the class is a day.

The mapping we use:

• PUBLIC_BUCKET_ACL and friends → storage.publicAccessPrevention enforced org-wide.
• PUBLIC_IP_ADDRESS on VMs → compute.vmExternalIpAccess deny-by-default with an allowlist.
• PUBLIC_SQL_INSTANCE → sql.restrictPublicIp.
• SERVICE_ACCOUNT_KEY findings → iam.disableServiceAccountKeyCreation.
• OS_LOGIN_DISABLED → compute.requireOsLogin, which also removes SSH key management as a category.
• SHIELDED_VM_DISABLED → compute.requireShieldedVm.

Each constraint closes its finding type permanently and prevents recreation, which is the difference between a remediation project and a control. The full list lives in our piece on the GCP hierarchy.

What to do with the rest

Mute rules, with a written reason and an owner. SCC supports mute rules; use them rather than ignoring findings. A muted finding with a justification is a decision. An unmuted finding that everyone scrolls past is a habit of ignoring the console, and that habit is what makes the real finding invisible next quarter.

Route new findings, do not browse them. A Pub/Sub export of high-severity findings into your ticketing system, and a weekly digest of everything else. Nobody should be discovering a critical finding by opening the console.

Event Threat Detection is the part with the shortest fuse. Anomalous IAM grants, cryptomining signatures, data exfiltration to an external bucket, brute force SSH. These are detections, not misconfigurations, and they need an on-call path and a runbook — the same containment pattern as turning GuardDuty into a rota.

The compliance reports

SCC maps findings to CIS, PCI DSS, ISO 27001 and NIST. These reports are genuinely useful for an audit conversation and genuinely misleading as a security measure — a high compliance score with an unmonitored log sink and no incident runbook is a well-documented estate, not a defended one. Use the report to answer the auditor, and use the two-axis triage above to decide what to actually fix.

This is the sequence we run inside a security assessment, and the open-source scanners in our tooling piece will give you most of the same findings before you pay for Premium, which is a reasonable way to size the problem first.

What to do this week

Filter SCC to active, high-severity findings in the "public exposure" category only, in production projects only. That list is short, it is real, and every item on it is visible from the internet right now.