Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Profil keamanan membantu Anda menentukan kebijakan inspeksi Layer 7 untuk
Google Cloud resource Anda. Struktur kebijakan ini bersifat umum
yang digunakan oleh endpoint firewall untuk memindai traffic yang dicegat guna menyediakan
layanan Layer aplikasi, seperti deteksi dan pencegahan penyusupan.
Dokumen ini memberikan ringkasan mendetail tentang profil keamanan dan kemampuannya.
Spesifikasi
Profil keamanan adalah resource tingkat organisasi.
Cloud Next Generation Firewall mendukung profil keamanan jenis threat prevention.
Setiap profil keamanan diidentifikasi secara unik oleh URL dengan
elemen berikut:
ID Organisasi: ID organisasi.
Lokasi: cakupan profil keamanan. Lokasi selalu
ditetapkan ke global.
Nama: nama profil keamanan dalam format berikut:
String sepanjang 1-63 karakter
Hanya berisi karakter alfanumerik atau tanda hubung (-)
Tidak boleh diawali dengan angka
Untuk membuat ID URL unik untuk profil keamanan,
gunakan format berikut:
Setelah membuat profil keamanan, Anda memiliki opsi untuk melampirkannya ke grup profil keamanan atau melampirkannya nanti.
Grup profil keamanan ini dirujuk oleh kebijakan firewall jaringan Virtual Private Cloud (VPC) tempat Anda ingin menerapkan inspeksi Layer 7.
Setiap profil keamanan harus memiliki ID project terkait. Project terkait digunakan untuk kuota dan batasan akses pada resource profil keamanan. Jika Anda mengautentikasi akun layanan menggunakan
perintah gcloud auth activate-service-account,
Anda dapat mengaitkan akun layanan dengan profil keamanan.
Untuk mempelajari lebih lanjut cara membuat profil keamanan, lihat Membuat dan mengelola profil keamanan.
Saat Anda membuat profil keamanan jenis threat-prevention, tanda tangan ancaman default dengan tingkat keseriusan default dan tindakan terkait akan ditambahkan ke profil:
Tanda tangan deteksi kerentanan
Tanda tangan anti-spyware
Tanda tangan antivirus
Tanda tangan DNS
Anda memiliki opsi untuk menambahkan penggantian tingkat keparahan ke profil keamanan Anda. Setiap tanda tangan default memiliki tingkat keparahan ancaman.
Tingkat keparahan menunjukkan risiko ancaman yang terdeteksi. Setiap tingkat
keparahan juga memiliki tindakan default terkait. Tindakan default menentukan
langkah-langkah yang dilakukan Cloud NGFW untuk menangani ancaman dengan tingkat
keparahan tertentu. Anda dapat menggunakan profil keamanan untuk mengganti tindakan default
untuk tingkat keparahan.
Tindakan berikut didukung:
Tanpa penggantian: melakukan tindakan default yang terkait
dengan ancaman.
Tolak: mencatat ancaman dan membuang paket.
Peringatan: mencatat ancaman dan mengizinkan sesi.
Izinkan: mengabaikan ancaman, jika terdeteksi.
Saat Anda membuat profil keamanan, tindakan penggantian default untuk semua
tingkat keparahan ditetapkan ke No override.
Anda juga dapat menambahkan penggantian tanda tangan ke profil keamanan Anda. Setiap tanda tangan ancaman memiliki tindakan default terkait. Anda dapat menggunakan profil keamanan untuk mengganti tindakan default tanda tangan ancaman dengan menggunakan tindakan sebelumnya. Penggantian tanda tangan lebih diutamakan daripada penggantian tingkat keparahan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[[["\u003cp\u003eSecurity profiles are organizational-level resources that define Layer 7 inspection policies for Google Cloud resources, enabling services like intrusion prevention by scanning intercepted traffic.\u003c/p\u003e\n"],["\u003cp\u003eCloud Next Generation Firewall (NGFW) supports threat prevention security profiles, which include default threat signatures such as vulnerability detection, anti-spyware, antivirus, and DNS signatures.\u003c/p\u003e\n"],["\u003cp\u003eSecurity profiles can override default actions for threat severity levels or specific threat signatures, with signature overrides taking precedence over severity overrides.\u003c/p\u003e\n"],["\u003cp\u003eEach security profile is uniquely identified by a URL that includes the organization ID, location (always set to global), and the security profile name, following a specific format.\u003c/p\u003e\n"],["\u003cp\u003eIdentity and Access Management (IAM) roles determine the ability to create, modify, view, or use security profiles, with the Security Profile Admin role being required for creating and modifying them.\u003c/p\u003e\n"]]],[],null,["# Security profile overview\n\nSecurity profiles help you define Layer 7 inspection policy for your\nGoogle Cloud resources. They are generic policy structures\nthat are used by firewall endpoints to scan intercepted traffic to provide\napplication Layer services, such as intrusion detection and prevention.\n\nThis document provides a detailed overview of security profiles and their\ncapabilities.\n\nSpecifications\n--------------\n\n- A security profile is an organizational level resource.\n\n- Cloud Next Generation Firewall supports security profiles of type `threat prevention`.\n\n- Each security profile is uniquely identified by a URL with\n the following elements:\n\n - **Organization ID:** ID of the organization.\n - **Location:** scope of security profile. Location is always set to `global`.\n - **Name:** security profile name in the following format:\n - A string 1-63 characters long\n - Includes only alphanumeric characters or hyphens (-)\n - Must not start with a number\n- To construct a unique URL identifier for a security profile,\n use the following format:\n\n organization/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/securityProfiles/\u003cvar translate=\"no\"\u003eSECURITY_PROFILE_NAME\u003c/var\u003e\n\n For example, a `global` security profile `example-security-profile`\n in organization `2345678432` has the following unique identifier: \n\n organization/2345678432/locations/global/securityProfiles/example-security-profile\n\n- After you create a security profile, you have the option to attach it\n to a [security profile group](/firewall/docs/about-security-profile-groups)\n or to attach it later.\n This security profile group is referenced by the firewall policy of the\n Virtual Private Cloud (VPC) network where you want to enforce Layer 7 inspection.\n\n- Each security profile must have an associated project ID. The associated\n project is used for quotas and access restrictions on security profile\n resources. If you authenticate your service account by using the\n [`gcloud auth activate-service-account` command](/sdk/gcloud/reference/auth/activate-service-account),\n you can associate your service account with the security profile.\n To learn more about how to create a security profile,\n see [Create and manage security profiles](/firewall/docs/configure-security-profiles#create-security-profile).\n\nThreat prevention security profile\n----------------------------------\n\nCloud NGFW uses threat prevention security profiles to provide\n[intrusion detection and prevention service](/firewall/docs/about-intrusion-prevention).\n\nWhen you create a security profile of type `threat-prevention`, the following\n[default threat signatures](/firewall/docs/about-threats#default_signature_set)\nwith default severity and associated actions are added to the profile:\n\n- Vulnerability detection signatures\n- Anti-spyware signatures\n- Antivirus signatures\n- DNS signatures\n\nYou have the option to add severity overrides to your security profiles. Each\ndefault signature has a [threat severity level](/firewall/docs/about-threats#threat-severity-level).\nThe severity level indicates the risk of the detected threat. Each severity\nlevel also has an associated default action. The default action specifies the\nmeasures Cloud NGFW takes to handle threats with a specific\nseverity level. You can use security profiles to override the default action\nfor a severity level.\n\nThe following actions are supported:\n\n- **No override**: performs the default action associated with the threat.\n- **Deny**: logs the threat and drops the packet.\n- **Alert**: logs the threat and allows the session.\n- **Allow**: ignores the threat, if detected.\n\nWhen you create a security profile, the default override action for all\nseverity levels is set to `No override`.\n\nYou can also add signature overrides to your security profiles. Each threat\nsignature has an associated default action. You can use security profiles to\noverride the default actions of the threat signatures by using the preceding\nactions. Signature overrides take precedence over severity overrides.\n| **Note:** If you override the default threat signature action or modify the default severity level action in a security profile, it might take up to 15 minutes for these changes to take effect.\n\nTo learn more about how to configure threat prevention, see\n[Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention).\n\nIdentity and Access Management roles\n------------------------------------\n\nIdentity and Access Management (IAM) roles govern the following security profiles actions:\n\n- Creating a security profile in an organization\n- Modifying or deleting a security profile\n- Viewing details of a security profile\n- Viewing a list of security profiles in an organization\n- Using a security profile in a security profile group\n\nThe following table describes the roles that are necessary for each step.\n\nQuotas\n------\n\nTo view quotas associated with security profiles, see [Quotas and limits](/firewall/docs/quotas).\n\nPricing\n-------\n\nPricing for security profiles is described in [Cloud NGFW pricing](/firewall/pricing).\n\nWhat's next\n-----------\n\n- [Configure intrusion detection and prevention service](/firewall/docs/configure-intrusion-prevention)\n- [Create and manage security profiles](/firewall/docs/configure-security-profiles)"]]
