Security and compliance

Network Security and Perimeter Defense

Network Security and Perimeter Defense involves building multiple layers of security around your cloud resources to stop unauthorized access and attacks. The main goal is to keep out external threats, like DDoS attacks, while making sure only the right people and systems can get in. This is done by combining tools that protect the edge of your network, create secure boundaries around services, and check a user's identity before granting access.

Google Cloud Armor

Google Cloud Armor is a web application firewall (WAF) that protects your applications at the internet's edge. It uses security policies to filter incoming traffic, which can block requests from specific IP addresses or countries to stop common attacks like SQL injection. These policies are attached to an External Application Load Balancer, so bad traffic is stopped before it ever reaches your private network. Its Adaptive Protection feature uses machine learning to detect complex attacks, and it comes with pre-built rules to defend against standard web threats.

VPC Service Controls

VPC Service Controls let you draw a virtual security fence, called a service perimeter, around a set of your Google Cloud resources. This is a critical tool for preventing data theft, as it blocks data from moving between services inside the perimeter and any unauthorized entities outside of it. You can set up rules to allow specific, safe data exchanges across this boundary. When you first set it up, you can use a dry run mode to just log potential violations, and later switch to enforced mode to actively block them.

Identity-Aware Proxy (IAP)

Identity-Aware Proxy (IAP) controls secure access to your applications and virtual machines by checking who a user is and the context of their request. Instead of using a traditional VPN, IAP uses context-aware access to look at factors like the user's location and the security of their device before letting them in. For administrative tasks, IAP TCP forwarding provides a secure tunnel for SSH and RDP connections to virtual machines, eliminating the need for those VMs to have risky public IP addresses.

Integration and Best Practices

A strong defense requires using these tools together with others like Cloud Load Balancing and VPC Firewalls. The load balancer is the point where Cloud Armor and IAP are applied, while VPC firewalls give you more detailed control over traffic at the individual VM level. Using hierarchical firewall policies lets you set consistent security rules across all your projects. This layered approach ensures your entire cloud setup is secure and meets your business rules.

Identity and Access Management (IAM) and Resource Governance

Identity and Access Management (IAM) is the system that controls who (a principal) can take what action on which cloud resource. In Google Cloud, you grant permissions by assigning roles to principals like user accounts or service accounts. It's important to follow the principle of least privilege, which means giving users and applications only the bare minimum permissions they need to do their job.

To implement least privilege, avoid using broad basic roles (like Editor or Owner). Instead, use more precise predefined roles designed for specific services, or create your own custom roles with exact permission sets. Applications should run under their own service accounts, not personal user accounts, and you should use different service accounts for different environments (like development vs. production) to limit the scope of any potential breach.

Resource governance is about applying rules across your entire Google Cloud setup using the resource hierarchy (Organization -> Folders -> Projects). Organizational policies are rules you set at a high level, like "no public IP addresses allowed," and they automatically flow down and apply to all child projects and resources. This structure lets administrators maintain control and ensure uniform security settings company-wide.

For protecting sensitive data within services like BigQuery, you can use fine-grained access control with policy tags. You classify your data (for example, tagging a column as "PII"), and then IAM policies can restrict access so only authorized people can see those specific columns, even if they have general access to the database. Tools like Data Catalog help manage these tags.

Keeping a secure environment requires regular checks. The IAM Recommender analyzes how permissions are actually used and suggests where roles can be made less permissive. The Policy Troubleshooter helps administrators debug access problems by showing exactly why a user was granted or denied permission to do something.

Data Protection and Encryption Strategies

Protecting sensitive data requires choosing the right encryption methods and tools to discover and mask that information. A core tool for maintaining control over your encrypted data is Customer-Managed Encryption Keys (CMEK). With CMEK, you create and manage your own encryption keys in Cloud Key Management Service (KMS), instead of using Google's default keys. This means you control which services can decrypt your data, and you can define rules for key rotation and access.

To find and protect sensitive data like credit card numbers or personal IDs within your datasets, you use Cloud Data Loss Prevention (DLP). Cloud DLP automatically scans and identifies this sensitive information. Once found, you can choose to redact it (mask it), tokenize it, or simply report on its presence. This is crucial for ensuring data handled by your applications complies with regulations and internal policies.

Data protection is also vital during major operations like Application Migration. Whether you are doing a simple "lift and shift" or modernizing your database, you must secure the data in transit and at rest in the new environment. Using CMEK for the target databases and DLP to sanitize data before the move helps prevent security gaps during the transition.

Similarly, your Disaster Recovery plans must include data protection. In a model like hot standby, where a backup system is always running and synchronized, the data in both the primary and secondary locations must be encrypted. Ensuring that encryption and access controls are consistently applied across all regions guarantees that your data remains secure even during a regional outage and failover.