Follow Google Cloud security blueprints
One basic step toward maximizing the security of your Google Cloud environment is to take advantage of the cloud security blueprints that Google provides, which can be accessed for free on the Google Cloud website. Google offers guides devoted to securing a variety of specific types of services and resources, such as data warehouses hosted on BigQuery or hybrid cloud environments created using Anthos.
While there isn’t a security blueprint for every type of Google Cloud service, be sure to use the guides available to enhance the security of your workload where applicable. Keep in mind that the Google Cloud security blueprints are designed to be generic. They are a useful starting point, but you’ll need to adapt or extend their guidance to fit the specific needs of your unique workloads.
Understand Google Cloud shared security responsibility
Like all major public clouds, Google Cloud has a shared responsibility model that defines which security responsibilities fall to customers to manage, and which are handled by Google. In Google’s shared responsibility matrix, customers secure what they can access and control, and Google protects resources like physical servers that customers can’t manage.
Since Google Cloud has invested heavily in hybrid products based on Anthos and its Distributed Cloud portfolio, you need to pay extra attention to the details in Google’s shared responsibility matrix. For example, if you use Anthos to manage Kubernetes clusters hosted on servers that you own, you’ll be responsible for securing those servers, even though Google is managing them.
In this regard, shared security responsibility in Google Cloud can be more complex than in cloud environments where the line separating customer-managed assets from vendor-managed assets is clear.
Leverage Google Cloud audit logs for security visibility
One of the most important sources of security visibility into Google Cloud is audit logs. Audit logs record administrative activities within your cloud environment, making it possible to determine responsibility in the event that you need to investigate a security incident or identify risk patterns.
Be sure to determine whether audit logs are available for each of the Google Cloud services you run. While Google says that it will ultimately enable audit logging for all of its cloud services, the feature is currently available only for certain services.
Enforce least privilege with Google Cloud IAM
Like all major clouds, Google Cloud provides an Identity and Access Management (IAM) framework that you can use to define access controls for resources in your cloud environment. IAM is one of the pillars of constructing a secure cloud. To make the most of Google Cloud IAM, create rules that enforce least privilege. Least privilege means that each user can access only the specific services or resources required for their role. Avoid assigning broad sets of access rights, and grant rights to individual users rather than groups wherever possible.
You should also validate your Google Cloud IAM configurations with Cloud Security Posture Management (CSPM) tools that can detect configuration oversights or errors that may expose your cloud environment to attack.
Understand service-specific security risks
Since Google Cloud is an array of dozens of different solutions that cater to application deployment, data analytics and warehousing, IoT network management, and more, it is subject to security risks, such as DDoS attacks or unauthorized access. You can create layers of protection against these risks using strong access control policies and meeting your security responsibilities under Google’s shared responsibility model.
Certain Google Cloud services pose special security risks that you’ll need to address with specific tools and processes. For example, If you host containerized applications using Google Kubernetes Engine, you’ll need to address the unique risks associated with container images, and manage Kubernetes access control policies and Kubernetes-specific security tooling.
In many cases, deploying generic Google Cloud security tools isn’t enough to protect your workloads. You’ll also need to understand the special security risks associated with the Google Cloud services you use and take steps to mitigate them.
Next steps for Google Cloud security
Although you should strive to establish a strong security posture when you first create your Google Cloud environment, you should also continuously audit and monitor your cloud configurations over time. Always take opportunities to make your cloud more secure. Solutions like Wiz can help by providing holistic visibility into your cloud environment and helping you identify risks, even as your configurations constantly change and new types of threats emerge.