Security
Reader small image

You're reading from  Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

Product typeBook
Published inAug 2023
PublisherPackt
ISBN-139781835468869
Edition1st Edition
Concepts
Information Security
Right arrow
Authors (2):
Ankush Chowdhary
Ankush Chowdhary
author image
Ankush Chowdhary

With an unwavering focus on technology spanning over two decades, Ankush remains genuinely dedicated to the ever-evolving realm of cybersecurity. Throughout his career, he has consistently upheld a deep commitment to assisting businesses on their journey towards modernization and embracing the digital age. His guidance has empowered numerous enterprises to prioritize and implement essential cybersecurity measures. He has had the privilege of being invited as a speaker at various global cybersecurity events, where he had the opportunity to share his insights and exert influence on key decision-makers concerning cloud security and policy matters. Driven by an authentic passion for education and mentorship, he derives immense satisfaction from guiding, teaching, and mentoring others within the intricate domain of cybersecurity. The intent behind writing this book has been a modest endeavor to achieve the same purpose.
Read more about Ankush Chowdhary

Prashant Kulkarni
Prashant Kulkarni
author image
Prashant Kulkarni

In his career, Prashant has worked directly with customers, helping them overcome different security challenges in various product areas. These experiences have made him passionate about continuous learning, especially in the fast-changing security landscape. Joining Google 4 years back, he expanded his knowledge of Cloud Security. He is thankful for the support of customers, the infosec community, and his peers that have sharpened his technical skills and improved his ability to explain complex security concepts in a user-friendly way. This book aims to share his experiences and insights, empowering readers to navigate the ever-evolving security landscape with confidence. In his free time, Prashant indulges in his passion for astronomy, marveling at the vastness and beauty of the universe.
Read more about Prashant Kulkarni

View More author details
Right arrow

11

Secret Manager

In this chapter, we will look at Google Cloud Secret Manager. A secret is any piece of data that needs to be protected, such as passwords, encryption keys, API keys, certificate private keys, and other sensitive information. Secrets can be stored in a secure and encrypted format using Google Cloud Secret Manager. Applications that run on the cloud platform often need to be able to securely store secrets and rotate them as needed. The secrets should also provide redundancy in the event that a region goes down. Traditionally, secrets were stored in configuration files embedded within the application using some form of encryption or in clear text. However, a secure way of storing secrets is by using Secret Manager. Secret Manager is a native offering on Google Cloud to store application secrets such as database passwords or API keys. It provides a single place to store application secrets and be able to manage access and audit who did what.

In this chapter, we...

Overview of Secret Manager

Secret Manager allows you to store and access secrets as binary blobs. It uses IAM permissions to grant access to the secrets and be able to manage them. Secret Manager is used for applications running on Google Cloud to store information such as database passwords, API keys, or certificates.

Note

Cryptographic keys should not be stored in Secret Manager. Cloud KMS is a better service since it allows you to encrypt the key material.

Before we start using Secret Manager, let us go over some core concepts. This will help you understand how Secret Manager works so you can make the right decision for your workloads.

Secret Manager concepts

Let us look at some key definitions related to Secret Manager as defined in the Google Cloud documentation:

  • Secret: A secret is an object at the project level that stores a collection of metadata and secret versions. The metadata includes replication locations, labels, and permissions.
  • Version: A...

Managing secrets and versions

Now let us look at some basic operations you can perform in Secret Manager. These operations can either be performed using gcloud, the Cloud console, or APIs. We have used the console to keep it simple.

Creating a secret

Follow these steps to create a secret using the Google Cloud console:

  1. Go to Console | Security | Secret Manager.
  2. Click on Create secret.
Figure 11.1 – Creating a new secret

Figure 11.1 – Creating a new secret

As shown in Figure 11.1, a secret value can be copied directly into the console or provided via a file. Typically, binary secrets are provided via a file.

  1. Choose the desired rotation period (Set rotation period). Note that this will only set a notification but not rotate the secret automatically.
Figure 11.2 – Creating a new secret—rotation period

Figure 11.2 – Creating a new secret—rotation period

As shown in Figure 11.2, there are additional properties you can set on a secret. We recommend that you do...

Accessing a secret

Accessing a secret version returns the secret contents as well as additional metadata about the secret version. When you access a secret version, you specify its version-id. You can also access the latest version of a secret by specifying latest as the version.

Accessing a secret version requires the secretmanager.secretAccessor IAM role. Typically, this role is granted to the service account used by your application.

The following is a gcloud command that can be used to access a particular version of the secret. However, a common method is to use application libraries for access, as you will see later in the section:

gcloud secrets versions access version-id --secret="secret-id"

You can also use the latest keyword to get the current version, but this is not a recommended best practice.

Accessing a binary secret version

You can access binary secrets directly but note that Cloud SDK formats the output as UTF-8, which can corrupt binary...

Secret replication policy

Secrets are a global resource entity; however, secret payloads (the underlying secret material) are stored locally within a region. Some regulated customers such as financial and healthcare institutions may have strict regionalization requirements, while other customers may want to store the secret near the data. A replication policy allows control over where secret payloads are stored.

There are two replication policy types: automatic and user-managed.

Automatic

With the automatic policy type, the replication of the secret is managed by Google. This policy provides the highest level of availability:

  • When a secret has an automatic replication policy, its payload data is copied as many times as needed. This is the easiest way to set things up, and most users should choose it. This is the policy that is used by default when a secret is created using the Google Cloud CLI or the web UI.
  • A secret that is automatically replicated is stored in...

CMEKs for Secret Manager

By default, secrets are encrypted with Google default encryption. However, some highly regulated customers require control of keys, so Secret Manager supports customer-managed encryption keys (CMEKs) (within Cloud KMS) for encrypting:

Note

However, if you disable or permanently destroy the CMEK, the secret encrypted with that key cannot be decrypted.

  • Secret payloads are encrypted by Google-managed keys before being written to persistent storage with no additional configuration required.
  • Secret Manager encrypts data with a unique data encryption key (DEK) before writing it to persistent storage in a specific location. The Secret Manager service owns a replica-specific key called a key encryption key (KEK), which is used to encrypt the DEK. This is commonly referred to as envelope encryption.
  • The CMEK is a symmetric key that you control within Cloud KMS when using CMEKs with Secret Manager. The CMEK must be stored in the same GCP region...

Best practices for secret management

Here are some general best practices that Google recommends when it comes to managing secrets:

  • As with pretty much all services in Google Cloud, access to the Secret Manager API is protected by IAM. Follow the principle of least privilege when granting permissions to secrets to your applications.
  • Divide applications and environments (staging/production) into independent projects. This can assist in segregating environments with IAM binding at the project level and guarantee that quotas are implemented independently.
  • If necessary, establish a custom role or choose an existing role with the bare minimum of access. Think about who manages the secret (creates the secret, disables/enables it, or creates a new version) and who uses it, such as developers. You should have a separation of duties between these two roles, especially in production.
  • Use secret-level IAM bindings or IAM conditions to limit access to the necessary subset of...

Secret Manager logs

You can consult Cloud Logging to audit or troubleshoot the operation of Secret Manager.

Let us assume project_id = acme-project-id, folder_id = acme-folder, billing_account_id = 123456, and organization_id = 987654321. The logs of interest would have the names listed as follows:

   projects/acme-project-id/logs/cloudaudit.googleapis.com%2Factivity
   projects/acme-project-id/logs/cloudaudit.googleapis.com%2Fdata_access
   projects/acme-project-id/logs /cloudaudit.googleapis.com%2Fsystem_   event
   projects/acme-project-id/logs/cloudaudit.googleapis.com%2Fpolicy
   folders/acme-folder/logs/cloudaudit.googleapis.com%2Factivity
   folders/acme-folder/logs/cloudaudit.googleapis.com%2Fdata_access
   folders/acme-folder/logs/cloudaudit.googleapis.com%2Fsystem_event
   folders/acme-folder/logs/cloudaudit.googleapis.com%2Fpolicy...

Summary

In this chapter, we reviewed Secret Manager, its operations, and some critical aspects of setting secrets for your requirements. We also discussed best practices for the development and deployment of secrets. It is important to follow these best practices so that your application is designed optimally and to reduce the risk of outages. As a member of the application development team or information security team, you should be able to design your applications to leverage Secret Manager.

In the next chapter, we will look at the logging features of Google Cloud. Cloud Logging is one of the critical aspects of cloud deployment. We will also go over the best practices of Cloud Logging.

Further reading

lock icon
The rest of the chapter is locked
Previous Chapter
Chapter 12 of 19
Next Chapter
You have been reading a chapter from
Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide
Published in: Aug 2023Publisher: PacktISBN-13: 9781835468869
© 2023 Packt Publishing Limited All Rights Reserved
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Sign up now
undefined
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Start free trial
Renews at $15.99/month. Cancel anytime

Authors (2)

author image
Ankush Chowdhary

With an unwavering focus on technology spanning over two decades, Ankush remains genuinely dedicated to the ever-evolving realm of cybersecurity. Throughout his career, he has consistently upheld a deep commitment to assisting businesses on their journey towards modernization and embracing the digital age. His guidance has empowered numerous enterprises to prioritize and implement essential cybersecurity measures. He has had the privilege of being invited as a speaker at various global cybersecurity events, where he had the opportunity to share his insights and exert influence on key decision-makers concerning cloud security and policy matters. Driven by an authentic passion for education and mentorship, he derives immense satisfaction from guiding, teaching, and mentoring others within the intricate domain of cybersecurity. The intent behind writing this book has been a modest endeavor to achieve the same purpose.
Read more about Ankush Chowdhary

author image
Prashant Kulkarni

In his career, Prashant has worked directly with customers, helping them overcome different security challenges in various product areas. These experiences have made him passionate about continuous learning, especially in the fast-changing security landscape. Joining Google 4 years back, he expanded his knowledge of Cloud Security. He is thankful for the support of customers, the infosec community, and his peers that have sharpened his technical skills and improved his ability to explain complex security concepts in a user-friendly way. This book aims to share his experiences and insights, empowering readers to navigate the ever-evolving security landscape with confidence. In his free time, Prashant indulges in his passion for astronomy, marveling at the vastness and beauty of the universe.
Read more about Prashant Kulkarni

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages
Automotive Cybersecurity Engineering Handbook

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages
Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages
Cloud Penetration Testing for Red Teamers

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages
ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages5
Burp Suite Cookbook

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages
Building and Automating Penetration Testing Labs in the Cloud

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages
Ethical Hacking Workshop

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages
Windows Forensics Analyst Field Guide

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages
Implementing DevSecOps Practices

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages