title
Please take a moment to fill out this form. We will get back to you as soon as possible.
All fields marked with an asterisk (*) are mandatory.
Security in Google Cloud Platform
Course Description
Overview
This course gives students broad study of security controls and techniques on Google Cloud Platform. Through lectures, demonstrations, and hands-on labs, students explore and deploy the components of a secure Google Cloud solution. Students also learn mitigation techniques for attacks at many points in a Google Cloud-based infrastructure, including Distributed Denial-of-Service attacks, phishing attacks, and threats involving content classification and use.Objectives
- Understanding the Google approach to security
- Managing administrative identities using Cloud Identity
- Implementing least privilege administrative access using Google Cloud Resource Manager, Cloud IAM
- Implementing IP traffic controls using VPC firewalls and Cloud Armor
- Implementing Identity Aware Proxy
- Analyzing changes to the configuration or metadata of resources with GCP audit logs
- Scanning for and redact sensitive data with the Data Loss Prevention API
- Scanning a GCP deployment with Forseti
- Remediating important types of vulnerabilities, especially in public access to data and VMs
Audience
- [Cloud] information security analysts, architects, and engineers
- Information security/cybersecurity specialists
- Cloud infrastructure architects
Prerequisites
- Prior completion of Google Cloud Platform Fundamentals: Core Infrastructure or equivalent experience
- Prior completion of Networking in Google Cloud Platform or equivalent experience
- Knowledge of foundational concepts in information security: Fundamental concepts: vulnerability, threat, attack surface, confidentiality, integrity, availability
- Common threat types and their mitigation strategies
- Public-key cryptography: Public and private key pairs, Certificates, Cipher types, Key width
- Certificate authorities
- Transport Layer Security/Secure Sockets Layer encrypted communication
- Public key infrastructures
- Security policy
- Basic proficiency with command-line tools and Linux operating system environments
- Systems Operations experience, including deploying and managing applications, either on-premises or in a public cloud environment
- Reading comprehension of code in Python or JavaScript
Topics
- Google Cloud's approach to security
- The shared security responsibility model
- Threats mitigated by Google and by GCP
- Access Transparency
- Cloud Identity
- Syncing with Microsoft Active Directory
- Choosing between Google authentication and SAML-based SSO
- GCP best practices
- GCP Resource Manager: projects, folders, and organizations
- GCP IAM roles, including custom roles
- GCP IAM policies, including organization policies
- GCP IAM best practices
- Configuring VPC firewalls (both ingress and egress rules)
- Load balancing and SSL policies
- Private Google API access
- SSL proxy use
- Best practices for structuring VPC networks
- Best security practices for VPNs
- Security considerations for interconnect and peering options
- Available security products from partners
- Stackdriver monitoring and logging
- VPC flow logs
- Cloud audit logging
- Deploying and Using Forseti
- Compute Engine service accounts, default and customer-defined
- IAM roles for VMs
- API scopes for VMs
- Managing SSH keys for Linux VMs
- Managing RDP logins for Windows VMs
- Organization policy controls: trusted images, public IP address, disabling serial port
- Encrypting VM images with customer-managed encryption keys and with customer-supplied encryption keys
- Finding and remediating public access to VMs
- VM best practices
- Encrypting VM disks with customer-supplied encryption keys
- Cloud Storage and IAM permissions
- Cloud Storage and ACLs
- Auditing cloud data, including finding and remediating publicly accessible data
- Signed Cloud Storage URLs
- Signed policy documents
- Encrypting Cloud Storage objects with customer-managed encryption keys and with customer-supplied encryption keys
- Best practices, including deleting archived versions of objects after key rotation
- BigQuery authorized views
- BigQuery IAM roles
- Best practices, including preferring IAM permissions over ACLs
- How DDoS attacks work
- Mitigations: GCLB, Cloud CDN, autoscaling, VPC ingress and egress firewalls, Cloud Armor
- Types of complementary partner products
- Types of application security vulnerabilities
- DoS protections in App Engine and Cloud Functions
- Cloud Security Scanner
- Threat: Identity and Oauth phishing
- Identity Aware Proxy
- Threat: Ransomware
- Mitigations: Backups, IAM, Data Loss Prevention API
- Threats: Data misuse, privacy violations, sensitive/restricted/unacceptable content
- Mitigations: Classifying content using Cloud ML APIs; scanning and redacting data using Data Loss Prevention API
Related Courses
-
Google Cloud Platform Fundamentals: Core Infrastructure
GCP-100- Duration: 1 Day
- Delivery Format: Classroom Training, Online Training
- Price: 595.00 USD
-
Architecting with Google Cloud Platform: Design and Process
GCP-300- Duration: 2 Days
- Delivery Format: Classroom Training
- Price: 1,494.00 USD
Self-Paced Training Info
Learn at your own pace with anytime, anywhere training
- Same in-demand topics as instructor-led public and private classes.
- Standalone learning or supplemental reinforcement.
- e-Learning content varies by course and technology.
- View the Self-Paced version of this outline and what is included in the SPVC course.
- Learn more about e-Learning
Course Added To Shopping Cart
bla
bla
bla
bla
bla
bla
Self-Paced Training Terms & Conditions
Exam Terms & Conditions
Sorry, there are no classes that meet your criteria.
Please contact us to schedule a class.
STOP! Before You Leave
Save 0% on this course!
Take advantage of our online-only offer & save 0% on any course !
Promo Code skip0 will be applied to your registration
Purchase Information
title
Please take a moment to fill out this form. We will get back to you as soon as possible.
All fields marked with an asterisk (*) are mandatory.