The best practice is security, so under this first one is like applying minor privileged access controls or identity and management. The principle of least privilege is a critical foundation element in GCP security. The direction is the concept of only providing employees with access to applications and resources they need to do the jobs properly.
The second is managing free traffic, and firewalls limit the IP ranges you assign to each firewall to only the networks that need access to those resources. Advanced PVC features allow you to get any granular traffic by giving targets by tag and service accounts. This will enable you to express traffic flows logically in a way you can identify later, such as allowing a front-end service to communicate to virtual machines in the back and service account. The third one is ensuring your bucket names are unique across the platform.
It is recommended to append random characters to the bucket name and not include the company name. This will make it harder for an attacker to locate buckets in a targeted attack; fourth, set up a google cloud organization structure. When you first log into your google admin console, everything will be grouped into a single organizational unit; any settings you apply to this group will apply to all the users and devices in the organization, so plan out how you want to organize your units. Before diving, it will help you save time and create name-structured security strictly.
How is Google’s Cloud Infrastructure Secured?
Secure Service Deployment:
Google uses various measures to secure their infrastructure. Here are key security controls implemented to secure service deployment:
Cryptographic authentication and authorization—applied at the application level for all inter-service communication. This feature provides granular access control.
Service account identity—associated with any service that runs on the Google cloud infrastructure. The service must use its cryptographic credentials to receive or make remote procedure calls (RPCs) to other services, or identify itself to clients.
Segmentation and firewalls—Google cloud infrastructure is protected by firewalls, and uses ingress and egress filtering at important network junctions, to prevent IP spoofing.
Safeguards From Privileged Access Attacks:
Google designs infrastructure with security in mind. This includes measures that safeguard against privileged access attacks that originate at the hypervisor, the operating system (OS) image, or the bootloader. For example, Google uses various components from different vendors, all carefully chosen, in its infrastructure, to ensure security.
Data Disposal Features:
Google provides data disposal, which frequently performs a thorough logical wiping of persistent disks and other storage devices. Once disks are wiped, an inspection follows, typically performed by an authorized individual. All processes are logged and stored alongside related outcomes. In the end of the process, all usable wiped drivers are sent for reuse and damaged disks are retired. Additionally, data disposal facilities undergo a weekly audit.
Encryption of Data:
Google provides encryption for data at rest and in transit. This process is automated and does not require user intervention. AES-256, for example, is a process that encrypts persistent disks using regular keys and master keys. Google manages all keys and rotation of this process.
Secure Internet Communication:
Google Front End (GFE) is an infrastructure service that secures services available on the Internet. GFE ensures that TLS connections use correct certificates and follow best practices, and also protects against Denial of Service (DoS) attacks.
Operational Security:
Here are several operational security measures performed and implemented by Google:
Data sources—integrate network signals from monitoring, infrastructure services, and host-based signals on individual devices.
Machine learning analysis—analyses data and provides Google teams with warnings of possible incidents.
Investigation—Google incident responders are responsible for prioritizing alert, investigating events, and responding to potential incidents. They operate 24/365 and conduct Blue Team/Red Team exercises to improve operational practices.
8 Google Cloud Platform Security Tools:
Google offers several tools that can help you implement security measures for your workloads.
Google Cloud KMS:
Google Cloud Key Management Service (KMS) lets you manage cryptographic keys. You can use Google’s KMS to create, rotate and destroy several types of cryptographic keys, including AES256, RSA 3072, RSA 2048, RSA 4096, EC P384, and EC P256. You can either manually rotate keys or opt to automate the process.
Google Cloud IAM:
Google provides an identity and access management (IAM) service that provides you with granular access control. You can use IAM to specify which users or groups can gain access to cloud resources. You can assign roles, including primitive, predefined, and custom. Google’s IAM automatically creates audit trails of permission authorizations and deletions.
Google Cloud Identity:
Google Cloud Identity lets you manage the security of your cloud applications and devices. You can access the service through the Google Admin Console. You can also use Cloud Identity to enable multi factor authentication and single sign-on authentication.
Stackdriver Logging:
Google Stackdriver is a monitoring service designed for hybrid clouds. It provides various capabilities, including Stackdriver Logging, which is a managed service that lets you manage and analyze log data.
Stackdriver Logging comes with its own API and can ingest data from custom logs. You can use Stackdriver logs for your security monitoring and management efforts.
Google Access Transparency:
Google Access Transparency lets you view near-real-time log data, which indicates why and when Google’s internal IT staff accessed their environment. Typically, the IT staff accesses the environment when responding to support requests or when trying to recover from an outage. You can integrate this service with Stackdriver Logging.
Google Cloud Security Scanner:
The Google Cloud Security Scanner service can detect vulnerabilities in Google Kubernetes Engine (GKE), Google Compute Engine (GCE), and Google App Engine (GAE). Cloud Security Scanner lets you create, schedule, run and manage scans via the GCP console. The scanner can detect many vulnerabilities, such as Flash injection, cross-site scripting (XSS), and mixed content, as well as outdated or insecure JavaScript (JS) libraries.
Learn more in our detailed guide to cloud security scanners (coming soon), including the Google Cloud scanner.
Google Cloud Resource Manager:
The Resource Manager lets you manage and organize your Google cloud resources. You can use the service to manage access controls and IAM policies across multiple groups of resources, which are sorted as organizations, folders, or projects.
Google Cloud Compliance:
Google provides a wide range of resources and services you can use to maintain compliance in your global and regional resources. For more information see Google’s Cloud Compliance Resource Center. You can use Google Anthos to enforce compliance and security policies across your cloud environment. Additionally, GCP supports integration with third-party services.
5 Google Cloud Security Best Practices:
The following best practices can help you improve security for your GCP deployments.
Visibility:
Cloud resources are often ephemeral and difficult to monitor. Research indicates that the average lifespan of a cloud resource is 127 minutes. Multi cloud and hybrid environments further complicate the infrastructure. To ensure visibility, you can leverage first-party and third-party cloud security and monitoring services. Look for services that let you implement granular policies across all environments.
Resource Hierarchy:
GCP lets you define your own resource hierarchy. For example, you can organize folders, projects, and teams under an organization, and assign permissions accordingly. While this provides a high level of flexibility, it can also lead to sprawl and confusion. To prevent unnecessary complexities, create a hierarchy that matches the corporate structure of your organization.
Centralized Logging and Monitoring:
You can implement logging and monitoring to ensure the health of your applications, pipelines, and various processes. Logging and monitoring systems collect and analyzing the data needed to trace, profile, and debug. If you are running multiple environments, you should implement a centralized logging and monitoring solution that provides you with visibility of all assets.
Cloud Logging:
To collect logs—which provide diagnostic information about the health of your assets—you can use Cloud Logging, which is a native GCP service. Cloud Logging integrates with the majority of GCP services. If you are using other cloud services, like Amazon Elastic Compute Cloud (EC2), you can install a logging agent that automatically forwards logs from EC2 to Cloud Logging. Additionally, Cloud Logging provides an API that can write logs from any source, including on-premise applications.
Cloud Monitoring:
To monitor your assets, you can use Cloud Monitoring. This is a native GCP service that enables you to gain information about the overall performance and health of your infrastructure and applications. Cloud Monitoring can ingest metrics, metadata, and events. It then generates insights, which are visualized in customizable dashboards. You can also get alerts when certain events occur. Cloud Monitoring integrates with Cloud Logging, a wide range of GCP services, and third parties.
Misconfigurations:
Many cloud data breaches occur due to misconfigurations. Here are some best practices you can implement to protect your cloud environment:
Continuously manage access controls—to ensure permissions are always relevant and assigned according to current roles. You can do this by monitoring IAM policies to ensure they are properly implemented.
Enforce the principle of least privileges—you can do this by only giving users only the permissions they require for their jobs.
Implement logging—to identify changes across your cloud environments and determine the extent of incidents.
Automate as much as possible—to ensure you rapidly discover vulnerabilities, misconfigurations, and unauthorized activities.
Privilege and Scope:
Google’s IAM provides you with granular access control. You can do this efficiently by creating groups of users, and assigning rules to each group. Make sure your group is well-defined and only users that require access are added. You can also create custom roles to ensure permissions are as accurate as possible.