Data in transit encryption - Data outside Google network (1) - Data inside Google network (2)

Data outside Google network - authenticated but not necessarily encrypted Data inside Google network - HTTP/HTTPS to GFE - TLS or QUIC - Within GCP infrastructure - ALTS for authentication and encryption

Security Flashcards by Christie Liu

Cloud Armor

WAF - web application firewall
Layer 7 web app firewall
Prevents DDoS, cross site scripting, SQL injections attacks

How well did you know this?

Not at all

Perfectly

Service account email format

[name]@[project_id].[service name].gserviceaccount.com

[name]@appspot.gserviceaccount.com

How well did you know this?

Not at all

Perfectly

IAM Conditions

Definition
Language conditions expressed in

Access control based on attributes of a resource

Common Expression Language (CEL)

How well did you know this?

Not at all

Perfectly

Network Tags

User level annotation for Compute Engine resources

Used to define security groups, network segment, firewall rules

How well did you know this?

Not at all

Perfectly

Resource Tags

Key value pairs that can be attached to an org, folder, project

Can be used to conditionally allow or deny policies based on whether a resource has a specific tag

How well did you know this?

Not at all

Perfectly

Security Marks

Security Command Center annotations for findings and assets for searching, selecting, filtering
Can group marks for policy, integration with workflow, flag for priority, access level, sensitivity classification

How well did you know this?

Not at all

Perfectly

Labels

User level annotation, metadata for resources
Used for billing and admin
Not inherited by children resources

How well did you know this?

Not at all

Perfectly

IAM policies written in what format

JSON

How well did you know this?

Not at all

Perfectly

Clou IAM API functions (3)

Set policies on resources
Read policies on resources
Test whether an identity has a permission on a resource

How well did you know this?

Not at all

Perfectly

IAM Conditions resource attributes (3)

Type of resource
Resource name
Tags attached to resource

How well did you know this?

Not at all

Perfectly

IAM conditions request attributes (3)

Access level
Date and time
Destination IP and port

How well did you know this?

Not at all

Perfectly

Identity Aware Proxy

Layer 7 based access control for HTTP requests
IAP protected resources can only be accessed via proxy by principal with correct IAM role
Allows fine grained access control and user grouping without requiring VPN

How well did you know this?

Not at all

Perfectly

Organization policy constraint

Rule that prevents action or configuration on service or group of services
Implemented across an org

How well did you know this?

Not at all

Perfectly

Data at rest encryption occurs at which levels (3)

Platform - database and file data

Infrastructure - data grouped into data chunks in storage system

Hardware - storage device itself

How well did you know this?

Not at all

Perfectly

Infrastructure level encryption

keys used
encryption type

DEK
KEK
AES256

How well did you know this?

Not at all

Perfectly

Data in transit encryption

Data outside Google network (1)
Data inside Google network (2)

Data outside Google network - authenticated but not necessarily encrypted

Data inside Google network

HTTP/HTTPS to GFE - TLS or QUIC
Within GCP infrastructure - ALTS for authentication and encryption

How well did you know this?

Not at all

Perfectly

Default encryption keys used

Google issued and managed DEK and KEK

How well did you know this?

Not at all

Perfectly

Cloud KMS

Definition
Key type
Keys from
Key managed by
Key rotation

Hosted key management
AES, RSA, EC
Customer generated or imported keys
Customer managed by Google hosted
Auto key rotation

How well did you know this?

Not at all

Perfectly

Cloud HSM

Definition
Key type supported

GCP hosted HSM to host keys and perform cryptographic operations in a cluster of FIPS 140-2 Level 3 certified HSMs
Cloud KMS as frontend

CMEK

Cloud managed encryption keys

Keys managed by customers using Cloud KMS

Cloud EKM

Cloud External Key Manager

Allows customers to manage keys outside GCP and use Cloud KMS to use keys

OS Login

Enabled through VM instance custom metadata
For SSH access to VM
Ties Linux accounts to Google identities and Cloud IAM

Common uses for Organization Policy constraints (3)

Limit resources sharing based on domain
Limit usage of IAM service accounts
Restrict physical location of newly created resources

Ways to restrict access to resources (4)`

Organization Policy Services
Tags
IAM Conditions
VPC Service Controls

VPC Service Control

Clients within perimeter do not have access to resources outside Data can't be copied to unauthorized resources Data exchanged between clients and resources separated by perimeter secured via ingress and egress rules

Confidential computing services (3)

Confidential VMs Confidential GKE Nodes Dataproc Confidential Compute

Confidential VM

Encrypts memory to protect data in use Isolates guests and hypervisor Provides vTPM attestation everytime AMD SEV boots

K8 Role Based Access Control

K8 mechanism for fine grained access control to any object or type of object in cluster, or in specific Namespace in cluster

BeyondCorp Enterprise

Google's zero trust solution Context based user and device authorization and authentication

Cloud IDS

Creates Google managed peered network that has mirrored VMs Palo Alto Networks threat protection technology to mirror and inspect traffic For detecting network intrusions and app performance

Workload Identity

Allows K8 service account in GKE cluster to act as an IAM service account. Pods authenticate as IAM service account when accessing Google Cloud APIs

Which services support CSEK

Compute Engine | Cloud Storage

Acccess Transparency Log

Logs of actions by Google staff when accessing customer content

CMEK and CSEK used to encrypt what for Cloud Storage objects (3)

Object data Object's CRC32C checksum Object's MD5 hash

reCAPTCHA Enterprise

Finds Bots | provides risk score for progressive action based on risk

Web App and API Protection solution components (3)

Cloud Armor reCAPTCHA Enterprise API Security with Apigee

Secure Software Development Lifecycle with GCP - End to End Policy Services

Cloud Code Cloud Build Artifact Registry

Secure Software Development Lifecycle with GCP - Binary Auth Services

Cloud Deploy | Run - cloud run, cloud functions, GKE

Container Analysis service

Provides vulnerability scanning for containers in Artifact Registry and Container Registry Continual analysis

Binary Authorization works for which GCP platforms (4)

Cloud Run GKE Anthos Service Mesh Anthos clusters on VMware

Shielded VM

VMs with firmware that secures boot

Security Command Center

Cloud Asset Inventory - find, monitor, analyze GCP assets Security Health Analytics - Identifies misconfigurations and baselines Web Security Scanner - Finds web app vulnerabilities Event Threat Detection - Finds threats via platform logs Container Threat Detection - Finds top suspicious activity in container deployments

Open Source Insights

Tool to see dependencies, security advisory, license across open source code

Device Management

API to manage corporate devices and control corporate data on devices

Safe Browsing / Web Risk API

Lets client apps check URLs against Google's list of unsafe web resources

Titan C

Chip to protect users against phishing attacks Enables 2 factor auth Protects OS from tampering **Chrome devices

Web Security Scanner

Crawls app following all links and URLs and attempts to exercise user inputs and event handlers to look for vulnerabilities