5

Understanding Google Cloud Identity

In this chapter, we will look at Google Cloud Identity, which is Google’s Identity as a Service (IDaaS) and Enterprise Mobility Management (EMM) product. We will cover aspects such as directory management, how to create and manage user accounts and groups, and how to sync directory services such as Active Directory using Google Cloud Directory Sync (GCDS). There are other features and services that will be covered, including Single Sign-On (SSO) and device and application management.

Furthermore, we will look at how you can use Google Cloud Identity to enforce 2-step verification (2SV), password management, session management, and reporting and admin log activity. As the topics within Cloud Identity are very broad and cover some aspects that are related to Google Workspace (formerly known as G Suite), we will limit our discussion in this chapter to the topics that are relevant to the Google Professional Cloud Security Engineer exam...

Overview of Cloud Identity

Google Cloud Identity is different from some of the other cloud security products that we will cover in this book. What makes it different is that it covers two different platforms: Google Workspace and Google Cloud. Google Workspace is out of scope as it’s not covered in the Google Professional Cloud Security Engineer exam; the features and aspects that we will cover will only pertain to the use of Cloud Identity with regard to Google Cloud.

First, let’s understand a few aspects of Cloud Identity. Cloud Identity is accessed via a separate console (admin.google.com). Cloud Identity is also the first product that you will interact with when you configure your Google Cloud environment, as the super administrator account exists in Cloud Identity. There’ll be more on the super administrator account later in this chapter. Cloud Identity only provides an authentication service and not authorization. The authorization aspect is covered by...

Securing your account

Google Cloud Identity provides a number of different options that can help you secure your account and enforce strong security controls. In this section, we will look at how to enforce 2SV using security keys, enforce a password policy and password recovery options, and configure user security settings such as session length, as well as doing a walk-through of the Google security center.

2-step verification

With 2SV, users log in to their accounts using their username and password (also referred to as something the users know) as well as a second factor (something they have), which could be a physical security token or a mobile phone that can generate a key. Google Cloud Identity supports a number of methods that can be used as a second factor for authentication. These methods include the following:

• Security keys: A physical security key, such as Google’s Titan Security Key or a YubiKey.
• Google prompt: Users can set up their mobile phone...

Directory management

This is one of the most important sections of the entire chapter. We will learn how to configure identity provisioning, in particular, how to integrate Microsoft Active Directory (AD) with Google Cloud Identity using the GCDS tool. We will look at some other directory management tasks, such as how to create users and groups and assign admin permissions and how we can provision and de-provision user access using Google Cloud Identity and third-party IdPs. Finally, we will have a look at how to automate user lifecycle management.

Google Cloud Directory Sync

This section will be a deep dive into GCDS. We will start by understanding what GCDS is, the benefits of using it, how it works, and how to configure it using Configuration Manager.

GCDS helps you to synchronize your Microsoft AD or LDAP objects, such as security users and groups, to your Google Cloud Identity account.

Note

To look at the entire list of content that is synced, you can check this...

Summary

In this chapter, we covered Google Cloud Identity. We looked at what services and features are available and how to design and build your authentication strategy on Google Cloud using Cloud Identity. The topics covered included domain setup, super administrator best practices, account security, how to enforce 2SV, how to configure user security settings, session management, how to configure SSO using SAML, how to use GCDS to federate AD with Cloud Identity, user and group provisioning, automated user lifecycle management, identity federation, and SSO.

In the next chapter, we will cover Google Cloud Identity and Access Management, looking at the authorization aspect of Google Cloud.

Further reading

For more information on Google Cloud Identity, refer to the following links:

• Difference between Cloud Identity Free and Premium: https://packt.link/oKxkl
• The Google security center: https://packt.link/f5yss
• Active Directory user account provisioning: https://packt.link/pWIUp
• Automated user provisioning and deprovisioning: https://packt.link/Rsnr2
• Active Directory single sign-on: https://packt.link/4e85k
• Best practices for planning accounts and organizations: https://packt.link/j8eod
• Best practices for federating Google Cloud with an external identity provider: https://packt.link/24owJ
• GCDS FAQ: https://packt.link/EcGwY
• Google Cloud Identity training: https://packt.link/TABqf
• Google Cloud Identity license information: https://packt.link/j03kr