Security in Google Cloud
This training course gives you a broad study of security controls and techniques in Google Cloud. Through lectures, demonstrations, and labs, you explore and deploy the components of a secure Google Cloud solution. You use services including Cloud Identity, Identity and Access Management (IAM), Cloud Load Balancing, Cloud IDS, Web Security Scanner, BeyondCorp Enterprise, and Cloud DNS.
- Duration: 3 days
- Languages: English, German
- Level: Intermediate
- Group size: Up to 16
What you'll learn
- Identify the foundations of Google Cloud security.
- Manage administration identities and implement user administration with IAM.
- Configure Virtual Private Clouds (VPCs) for isolation, security, and logging.
- Apply best practices for securely managing Compute Engine, Google Cloud data, and applications.
- Secure Google Kubernetes Engine (GKE) resources.
- Manage protection against Distributed Denial-of-Service (DDoS) attacks and content-related vulnerabilities.
- Implement Google Cloud monitoring, logging, auditing, and scanning solutions.
Prerequisites
- Prior completion of Google Cloud Fundamentals: Core Infrastructure or equivalent experience.
- Prior completion of the Networking in Google Cloud course or equivalent experience.
- Knowledge of foundational information security concepts (e.g., SANS SEC301).
- Basic proficiency with command-line tools and Linux operating system environments.
- Experience in Systems Operations, including deploying and managing applications.
- Ability to read code in Python or JavaScript.
- Basic understanding of Kubernetes terminology is preferred but not required.
Course outline
Foundations of Google Cloud Security
- The approach of Google Cloud to security
- The shared security responsibility model
- Threats mitigated by Google and Google Cloud
- Access transparency
Securing Access to Google Cloud
- Cloud Identity
- Google Cloud Directory Sync
- Managed Microsoft AD
- Google authentication versus SAML-based SSO
- Identity Platform
- Authentication best practices
Identity and Access Management (IAM)
- Resource Manager
- IAM roles
- Service accounts
- IAM and Organization policies
- Workload identity federation
- Policy Intelligence
Configuring Virtual Private Cloud for Isolation and Security
- VPC firewalls
- Load balancing and SSL policies
- Cloud Interconnect
- VPC Network Peering
- VPC Service Controls
- Access Context Manager
- VPC Flow Logs
- Cloud IDS
Securing Compute Engine: Techniques and Best Practices
- Service accounts, IAM roles, and API scopes
- Managing VM logins
- Organization policy controls
- Shielded VMs and Confidential VMs
- Certificate Authority Service
- Compute Engine best practices
Securing Cloud Data: Techniques and Best Practices
- Cloud Storage IAM permissions and ACLs
- Auditing cloud data
- Signed URLs and policy documents
- Encrypting with Customer-managed encryption keys (CMEK) and Customer-supplied encryption keys (CSEK)
- Cloud HSM
- BigQuery IAM roles and authorized views
- Storage best practices
Securing Applications: Techniques and Best Practices
- Types of application security vulnerabilities
- Web Security Scanner
- Threat: Identity and OAuth phishing
- Identity-Aware Proxy
- Secret Manager
Securing Google Kubernetes Engine: Techniques and Best Practices
- Differences between Kubernetes service accounts and Google service accounts
- Best practices for securely configuring GKE
- Logging and monitoring options in Google Kubernetes Engine
Protecting against Distributed Denial-of-Service Attacks (DDoS)
- How DDoS attacks work
- Google Cloud mitigations
- Types of complementary partner products
Content-Related Vulnerabilities: Techniques and Best Practices
- Threat: Ransomware and mitigations
- Threats: Data misuse, privacy violations, and sensitive content
- Content-related mitigation
- Redacting Sensitive Data with the DLP API
Monitoring, Logging, Auditing, and Scanning
- Security Command Center
- Cloud Monitoring and Cloud Logging
- Cloud Audit Logs
- Cloud security automation
Related courses
Network Security Essentials
This course provides a practical guide to securing networks on Google Cloud.The course will cover core network security principles and their application using Google Cloud's managed services. Network security concepts and best practices will be explored through practical demonstrations and real-world application scenarios. The course uses presentations, demos, and discussions, with real-world examples, to ensure effective learning
Networking in Google Cloud
This training course builds on the networking concepts covered in the Networking Fundamentals in Google Cloud course. Through presentations, demonstrations, and labs, participants explore and deploy Google Cloud networking technologies, including Virtual Private Cloud (VPC) networks, subnets, firewalls, and interconnection among networks. The course also covers load balancing, Cloud DNS, Cloud CDN, Cloud NAT, and common network design patterns.
Security Command Center Enterprise - Essentials
This course provides a comprehensive overview of Google Cloud Security Command Center(SCC) Enterprise, a Cloud-Native Application Protection Plaorm (CNAPP) solution that helpsorganizations prevent, detect, and respond to threats across Google Cloud services.You will learn about core SCC Enterprise features, including enhanced threat detection,in-depth vulnerability management, and integrated case management. Fundamental concepts in threat management and vulnerability assessment will also be covered, along with practical demonstrations of how to use SCC Enterprise to identify, investigate, and remediate security risks within your cloud environment.
Not sure which course fits?
Book a 30-minute call. We'll look at where your team is, what they need to be able to do, and put together either a specific course date or a tailored learning plan.