DevOps training

Logo Security in Google Cloud

Security in Google Cloud

Duration 3 days Get a quote
Official icon Official
New icon New
On-site icon On-site
Remote icon Remote
Certifying icon Download the course datasheet
  • Foundations of Google Cloud Security
    • Understand the shared security responsibility model.
    • Understand the kinds of threats mitigated by Google and by Google Cloud.
    • Define and understand access transparency.
  • Cloud Identity
    • Learn what Cloud Identity is and what it does.
    • Learn how Directory Sync securely syncs users and permissions between your on-prem LDAP or AD server and the cloud.
    • Understand the two ways Google Cloud handles authentication and how to set up SSO.
    • Explore best practices for managing groups, permissions, domains and admins with Cloud Identity.
  • Identity and Access Management (IAM)
    • Understand Resource Manager: projects, folders, and organizations.
    • Learn how to implement IAM roles, including custom roles.
    • Understand IAM policies, including organization policies.
    • Understand best practices, including separation of duties and least privilege, the use of Google groups in policies, and avoiding the use of basic roles.
    • Learn how to configure IAM, including custom roles and organization policies.
  • Configuring Virtual Private Cloud for Isolation and Security
    • Learn best practices for configuring VPC firewalls (both ingress and egress rules).
    • Understand load balancing and SSL policies.
    • Understand how to set up private Google API access.
    • Understand SSL proxy use.
    • Learn best practices for VPC networks, including peering and shared VPC use, and the correct use of subnetworks.
    • Learn best security practices for VPNs.
    • Understand security considerations for interconnect and peering options.
    • Become familiar with available security products from partners.
    • Learn to configure VPC firewalls.
    • Prevent data exfiltration with VPC Service Controls.
  • Securing Compute Engine: Techniques and Best Practices
    • Learn about Compute Engine service accounts, default and customer-defined.
    • Understand IAM roles and scopes for VMs.
    • Understand how Shielded VMs help maintain your system and application integrity.
  • Securing Cloud Data: Techniques and Best Practices
    • Use cloud permissions and roles to secure cloud resources.
    • Audit cloud data.
    • Use signed URLs to give access to objects in a Cloud Storage bucket.
    • Manage what can be placed in a Cloud Storage bucket using Signed Policy Document.
    • Encrypt cloud data using customer managed encryption keys (CMEK), customer supplied encryption keys (CSEK), and Cloud HSM.
    • Protecting data in BigQuery using IAM roles and authorized views.
  • Application Security: Techniques and Best Practices
    • Recall various types of application security vulnerabilities.
    • Understand DoS protections in App Engine and Cloud Functions.
    • Understand the role of Web Security Scanner in mitigating risks.
    • Define and recall the threats posed by Identity and Oauth phishing.
    • Understand the role of Identity-Aware Proxy in mitigating risks.
    • Store application credentials and metadata securely using Secret Manager.
  • Securing Google Kubernetes Engine: Techniques and Best Practices
    • Understand the basic components of a Kubernetes environment.
    • Understand how authentication and authorization works in Google Kubernetes Engine.
    • Recall how to harden Kubernetes Clusters against attacks.
    • Recall how to harden Kubernetes workloads against attacks.
    • Understand logging and monitoring options in Google Kubernetes Engine.
  • Protecting against Distributed Denial of Service Attacks (DDoS)
    • Understand how DDoS attacks work.
    • Recall common mitigations: Cloud Load Balancing, Cloud CDN, autoscaling, VPC ingress and egress firewalls, Google Cloud Armor.
    • Recall the various types of complementary partner products available.
    • Use Google Cloud Armor to blocklist an IP address and restrict access to an HTTP load balancer.
  • Content-Related Vulnerabilities: Techniques and Best Practices
    • Discuss the threat of ransomware.
    • Understand ransomware mitigations: Backups, IAM, Cloud Data Loss Prevention API.
    • Understand threats to content: Data misuse, privacy violations, sensitive/restricted/ unacceptable content.
    • Recall mitigations for threats to content: Classifying content using Cloud ML APIs; scanning and redacting data using the DLP API.
  • Monitoring, Logging, Auditing, and Scanning
    • Understand and use Security Command Center.
    • Understand and use Cloud Monitoring and Cloud Logging.
    • Install the Monitoring and Logging Agents.
    • Understand Cloud Audit Logs.
    • Gain experience configuring and viewing Cloud Audit Logs.
    • Gain experience deploying and using Forseti.
    • Learn how to inventory a deployment with Forseti Inventory.
    • Learn how to scan a deployment with Forseti Scanner.