Professional Cloud Security Engineer

Manage Remediation and Reporting of Identified Vulnerabilities

When vulnerability scanners find problems in your code, you need a clear way to handle them. Artifact Analysis and the On-Demand Scanning API work together to detect Common Vulnerabilities and Exposures (CVEs) across operating systems and language packages. The Container Scanning API automatically scans container images stored in Artifact Registry every time you push a new image, and it keeps checking those images even after they are stored. This continuous analysis means that if a new vulnerability is discovered in software you already deployed, you'll know about it.

The scanning tools produce detailed findings that security teams need to act on. Cloud Build Security Insights shows important details like the Software Bill of Materials (SBOM), which lists all the components in your software, and the Vulnerability Exploitability eXchange (VEX) status, which helps you understand if a vulnerability can actually be exploited. Security Command Center collects these findings as vulnerability occurrences across all your projects, giving security teams a single place to see risks. When a new vulnerability is found, Cloud Pub/Sub can automatically send alerts to ticketing systems so engineers can start fixing them right away.

Fixing vulnerabilities happens through several strategies that work together. Base image updates replace the underlying container layers that contain known weaknesses. Dependency vendoring keeps copies of third-party packages in private repositories so you can verify they are safe before using them. VM Manager with the OS Config agent automates patching for virtual machines across your infrastructure. Binary Authorization can be configured to block deployment of any container image that contains critical unresolved CVEs, creating a hard stop that prevents vulnerable code from reaching production.

Integrate Vulnerability Scanning Tools into CI/CD Workflows

Security scanning works best when it happens automatically at every stage of building and deploying software. This approach, called DevSecOps, makes security part of the normal development process rather than something added at the end. On Google Cloud, you integrate scanning into pipelines built with Cloud Build so that every image gets checked before it moves forward.

There are two main ways scanning works: automatic and on-demand. Automatic scanning triggers whenever a new container image is pushed to Artifact Registry, giving you continuous protection without any extra setup. On-Demand Scanning lets you manually trigger a scan during the build process, which is useful when you want to test an image before storing it. You can configure Cloud Build to fail a build if scanning finds vulnerabilities above a certain severity level, such as blocking any build with CRITICAL or HIGH issues.

Getting scan results requires enabling the Container Scanning API and On-Demand Scanning API. Results appear in the Google Cloud console within Artifact Registry or in Cloud Build's Security insights panel. You can also use the gcloud CLI or Container Analysis API to query results programmatically, filtering by vulnerability type, package name, CVE ID, or severity level. This flexibility lets teams focus on the most important issues first.

For more advanced setups, scanning can be scheduled to run regularly against base images using Cloud Scheduler with Cloud Build triggers. Scan results can feed directly into enforcement systems like Binary Authorization and Continuous Validation to stop non-compliant images from deploying to GKE clusters. This creates a closed loop where security findings automatically prevent vulnerable code from reaching production.

Establish Policy Enforcement and Gating Mechanisms

Once you know about vulnerabilities, you need ways to stop them from reaching production. Binary Authorization is a deploy-time control that only allows trusted container images to run in your production environment. It requires attestations, which are digital signatures from authorized parties, before an image can be deployed. If an image doesn't have the required signatures or doesn't meet your security requirements, Binary Authorization blocks it from being deployed.

Security Health Analytics scans your Google Cloud resources for misconfigurations and security problems. It detects issues like exposed credentials, open firewall rules, and missing encryption, then maps them to compliance standards. When combined with Security Command Center, it gives you a complete picture of your security posture and helps teams decide which issues to fix first based on how severe they are.

Setting up gates in your CI/CD pipeline means defining rules for when code can proceed to the next stage. You might allow low-severity vulnerabilities to pass but block deployments that contain critical issues. Cloud Build integrates with Artifact Analysis to show security insights during the build, so teams can see exactly what was found before deciding whether to deploy. These gates create accountability because no one can accidentally push vulnerable code without the team noticing.

Continuous validation through Binary Authorization watches your running Kubernetes clusters for policy violations in real time. If a newly discovered vulnerability affects an image already running in production, the system alerts you or can take automatic action. Cloud Logging tracks all configuration changes and policy violations, giving security teams a clear record of what happened and helping them respond quickly when new threats appear.