The core requirements are: centralized, tamper-proof, long-term (seven years) immutable audit trails for administrative and data access activity.
Centralization: The current logging is fragmented. To centralize, you need to collect logs from across the organization. Cloud Logging sinks configured at the organization level are designed for this purpose. They allow you to route logs from all projects within an organization to a single destination.Extract Reference: "Aggregated exports allow you to export logs from multiple Google Cloud projects, folders, or your entire organization. An aggregated export can include all logs from all included resources, or you can use queries to include only specific logs." (Google Cloud documentation: https://cloud.google.com/logging/docs/export/aggregated_exports)
Long-Term Storage (Seven Years): Cloud Logging buckets have default retention periods (e.g., 30 days for Data Access logs, 400 days for Admin Activity logs) which are not sufficient for a seven-year requirement. Cloud Storage is ideal for long-term archival.Extract Reference: "Cloud Storage is a highly scalable and durable object storage service suitable for archiving large volumes of data for extended periods." (Google Cloud documentation, general overview of Cloud Storage features)
Tamper-Proof / Immutability: This is a critical requirement for audit trails in financial services under strict regulatory frameworks. Cloud Storage's "object retention lock" feature provides immutability. Once an object retention lock is set on a bucket, objects within that bucket cannot be deleted or overwritten for a specified duration, ensuring data integrity for compliance purposes.Extract Reference: "Object Retention Lock helps you meet compliance requirements by preventing data from being deleted or modified for a fixed amount of time or indefinitely. This feature satisfies SEC Rule 17a-4(f), FINRA Rule 4511(c), and CFTC Regulation 1.31(c)-(d) requirements." (Google Cloud documentation: https://cloud.google.com/storage/docs/bucket-lock)
Let's evaluate the other options:
A. Implement Pub/Sub to stream all audit logs from each project in real-time to an external SIEM: While Pub/Sub can centralize real-time streaming to a SIEM, the solution described does not inherently guarantee tamper-proof storage or 7-year immutability within Google Cloud. The SIEM itself would need to provide those capabilities, which is outside the scope of Google Cloud's direct offering for this specific requirement.
C. Enable Security Command Center across the organization: Security Command Center (SCC) provides centralized visibility into security posture, threats, and compliance. However, SCC is a security management and monitoring platform; it does not serve as the primary long-term, immutable storage for raw audit logs. It consumes information from logs but doesn't store them in a way that meets the 7-year immutable archival requirement.
D. Individually configure Cloud Audit Logs for all Google Cloud services in each project. Store the logs in regional Cloud Logging buckets with 30-day retention policies: This fails on multiple counts: it's not centralized (requires individual configuration), and the 30-day retention in Cloud Logging buckets is far short of the seven-year requirement. It also doesn't explicitly guarantee tamper-proof storage beyond the default logging immutability.
Therefore, option B directly addresses all aspects of the requirement: centralization via organization-level sinks, long-term storage with Cloud Storage, and immutability/tamper-proofing with object retention lock.
