Beyond the Perimeter Uncovering the Hidden Threat of Data Exfiltration in Google Cloud Platform

The talk opens with how an attacker gets initial access to a Google Cloud Platform environment, such as through leaked service account keys, a compromised user or machine, or a malicious insider. It then explains the audit log categories GCP offers, including admin activity, data access, system event and policy denied logs, and notes that some are off by default.

The core section walks through exfiltration paths in three services. In Cloud Storage, direct object downloads are hard to tell apart from metadata reads, and public buckets generate no data access logs. A storage transfer job can copy objects into another organisation using the service's own identity, so the destination writes and job creation may go unseen in the source project. In BigQuery, queries from an outside organisation can appear without query text, and in Cloud SQL an export to a bucket needs only API permissions and yields a dump that is not encrypted by default.

The closing advice is to route audit logs to longer-retention storage, enable data access logging, and keep an inventory of resources and identities so that resources in outside organisations stand out. Learning what each log looks like helps reveal visibility gaps. In answer to a question, the speaker also pointed to organisation policies and posture-management tools for prevention.