Google Cloud’s Approach to Security

This chapter will help readers understand some of the foundational principles of security in the cloud space, particularly Google Cloud. We’ll go over things such as the shared responsibility model, understand the differences between Google’s approach to security relative to other providers, and dig into the threats to privacy. Lastly, we’ll explore how to properly control and manage cloud resources.

After completing this chapter, you will be able to do the following:

• Understand the core concepts of securing a cloud environment and data privacy
• Describe the security benefits of using Google Cloud
• Identify today’s top cybersecurity challenges and threats to data privacy
• Describe important controls for managing and securing cloud resources

The chapter covers the following topics:

• Security fundamentals
• Overview of the shared responsibility model
• The benefits and differentiators...

Security fundamentals

Security is a topic that can feel overwhelming, particularly as you start to dig deeper into the tech stack. In this chapter, we’ll explore the most important topics relating to the certification exam. You can think of this as a simplified introduction, touching on different attack vectors, approaches to compromising systems, and the associated defense strategies.

At a very high level, there are two types of attacks: social engineering and technical engineering. Social engineering refers to the exploitation of humans in order to obtain information that will help compromise a system or obtain sensitive information. This is a very common attack vector and is often connected to phishing. Phishing is when an attacker sends malicious emails, for example, to a set of legitimate users in the hopes that they will be compromised. This can be a fake landing page asking them to sign into a website, which then captures their login credentials for accessing systems...

Overview of the shared responsibility model

The shared responsibility model is a concept relating to the delineation of responsibility when someone adopts a cloud solution. Depending on the solution and its architecture, a cloud provider will take ownership of ensuring the security up to a certain level of the technology stack, beyond which the customer is responsible. It defines a set of responsibilities to be designated across portions of the stack. These responsibilities include the hardware, boot, hardened kernel and inter-process communication (IPC), storage and encryption, network, audit logging, operating systems and logging, network security, access and authentication, operations, identity, web application security, deployment, usage, access policy, and content/data.

If an organization is running its infrastructure on premises within its own data centers, it is responsible for everything. It must procure the hardware and software, ensure it is hardened and patched, manage...

The benefits and differentiators of Google Cloud

As highlighted in previous chapters, one of the biggest advantages that Google Cloud has over its competitors is the fact that Google Cloud is built on top of Google infrastructure. This means that Google Cloud customers benefit from many of the technological advances and best practices developed by Google. This includes leveraging a global, proprietary network where all data is encrypted at rest and in transit by default. In addition, Google security teams are engaged in ensuring that the underlying network and data center infrastructure is hardened enough to fight off even the most advanced threats. With Google having 10+ applications with over 500 million users and several with over 1 billion users, their security teams are exposed to threats from all over the world on a daily basis. They then take the knowledge from these attacks, such as malware signatures, and build solutions and defenses, equipping themselves with some of the...

Controlling and managing cloud resources

When managing cloud resources, we can roughly break things down into two buckets; identity and access management (IAM) and operations. Within the world of IAM, we’ll explore how resource hierarchies and permissions function in Google Cloud. In the following chapters, we’ll dig specifically into logging, monitoring, and best practices. Let’s start by digging into IAM and resource hierarchies.

IAM and resource hierarchies

As highlighted in this chapter, a significant component of managing security is the ability to manage access and permissions. Within a Google Cloud environment, there is a resource hierarchy. An organization node is the root authority for an organization underneath which the rest of the resource hierarchy unfolds. Within an organization exist folders and projects. Folders are used to organize multiple projects and assign a set of permissions. Beneath folders in the hierarchy are projects, and within...

Summary

Ensuring that Google Cloud customers have a strong security posture, built with security best practices in mind, gives Google a very strong position in the market. Customers are able to confidently deploy sensitive infrastructure and data in the environment while also ensuring they remain compliant with any legal or customer requirements.

A strong security foundation is critical in driving innovation, especially in the age of big data and AI where issues such as copyright infringement, strict compliance needs, and cost need to be balanced with the need to experiment, launch, and land new offerings that drive net new revenue.

Google Cloud provides extremely mature security capabilities and solutions to address the needs of today. Whether we’re talking about SaaS solutions that joined the Google family through acquisitions (such as Mandiant) or Google Cloud native tooling that helps customers secure their environments (such as Security Command Center), Google Cloud...