Security Flashcards
Cloud Armor
WAF - web application firewall
Layer 7 web app firewall
Prevents DDoS, cross site scripting, SQL injections attacks
Service account email format
[name]@[project_id].[service name].gserviceaccount.com
[name]@appspot.gserviceaccount.com
IAM Conditions
- Definition
- Language conditions expressed in
Access control based on attributes of a resource
Common Expression Language (CEL)
Network Tags
User level annotation for Compute Engine resources
Used to define security groups, network segment, firewall rules
Resource Tags
Key value pairs that can be attached to an org, folder, project
Can be used to conditionally allow or deny policies based on whether a resource has a specific tag
Security Marks
Security Command Center annotations for findings and assets for searching, selecting, filtering
Can group marks for policy, integration with workflow, flag for priority, access level, sensitivity classification
Labels
User level annotation, metadata for resources
Used for billing and admin
Not inherited by children resources
IAM policies written in what format
JSON
Clou IAM API functions (3)
Set policies on resources
Read policies on resources
Test whether an identity has a permission on a resource
IAM Conditions resource attributes (3)
Type of resource
Resource name
Tags attached to resource
IAM conditions request attributes (3)
Access level
Date and time
Destination IP and port
Identity Aware Proxy
Layer 7 based access control for HTTP requests
IAP protected resources can only be accessed via proxy by principal with correct IAM role
Allows fine grained access control and user grouping without requiring VPN
Organization policy constraint
Rule that prevents action or configuration on service or group of services
Implemented across an org
Data at rest encryption occurs at which levels (3)
Platform - database and file data
Infrastructure - data grouped into data chunks in storage system
Hardware - storage device itself
Infrastructure level encryption
- keys used
- encryption type
DEK
KEK
AES256
Data in transit encryption
- Data outside Google network (1)
- Data inside Google network (2)
Data outside Google network - authenticated but not necessarily encrypted
Data inside Google network
- HTTP/HTTPS to GFE - TLS or QUIC
- Within GCP infrastructure - ALTS for authentication and encryption
Default encryption keys used
Google issued and managed DEK and KEK
Cloud KMS
- Definition
- Key type
- Keys from
- Key managed by
- Key rotation
Hosted key management AES, RSA, EC Customer generated or imported keys Customer managed by Google hosted Auto key rotation
Cloud HSM
- Definition
- Key type supported
GCP hosted HSM to host keys and perform cryptographic operations in a cluster of FIPS 140-2 Level 3 certified HSMs
Cloud KMS as frontend
CMEK
Cloud managed encryption keys
Keys managed by customers using Cloud KMS
Cloud EKM
Cloud External Key Manager
Allows customers to manage keys outside GCP and use Cloud KMS to use keys
OS Login
Enabled through VM instance custom metadata
For SSH access to VM
Ties Linux accounts to Google identities and Cloud IAM
Common uses for Organization Policy constraints (3)
Limit resources sharing based on domain
Limit usage of IAM service accounts
Restrict physical location of newly created resources
Ways to restrict access to resources (4)`
Organization Policy Services
Tags
IAM Conditions
VPC Service Controls
VPC Service Control
Clients within perimeter do not have access to resources outside
Data can’t be copied to unauthorized resources
Data exchanged between clients and resources separated by perimeter secured via ingress and egress rules
Confidential computing services (3)
Confidential VMs
Confidential GKE Nodes
Dataproc Confidential Compute
Confidential VM
Encrypts memory to protect data in use
Isolates guests and hypervisor
Provides vTPM attestation everytime AMD SEV boots
K8 Role Based Access Control
K8 mechanism for fine grained access control to any object or type of object in cluster, or in specific Namespace in cluster
BeyondCorp Enterprise
Google’s zero trust solution
Context based user and device authorization and authentication
Cloud IDS
Creates Google managed peered network that has mirrored VMs
Palo Alto Networks threat protection technology to mirror and inspect traffic
For detecting network intrusions and app performance
Workload Identity
Allows K8 service account in GKE cluster to act as an IAM service account.
Pods authenticate as IAM service account when accessing Google Cloud APIs
Which services support CSEK
Compute Engine
Cloud Storage
Acccess Transparency Log
Logs of actions by Google staff when accessing customer content
CMEK and CSEK used to encrypt what for Cloud Storage objects (3)
Object data
Object’s CRC32C checksum
Object’s MD5 hash
reCAPTCHA Enterprise
Finds Bots
provides risk score for progressive action based on risk
Web App and API Protection solution components (3)
Cloud Armor
reCAPTCHA Enterprise
API Security with Apigee
Secure Software Development Lifecycle with GCP - End to End Policy Services
Cloud Code
Cloud Build
Artifact Registry
Secure Software Development Lifecycle with GCP - Binary Auth Services
Cloud Deploy
Run - cloud run, cloud functions, GKE
Container Analysis service
Provides vulnerability scanning for containers in Artifact Registry and Container Registry
Continual analysis
Binary Authorization works for which GCP platforms (4)
Cloud Run
GKE
Anthos Service Mesh
Anthos clusters on VMware
Shielded VM
VMs with firmware that secures boot
Security Command Center
Cloud Asset Inventory - find, monitor, analyze GCP assets
Security Health Analytics - Identifies misconfigurations and baselines
Web Security Scanner - Finds web app vulnerabilities
Event Threat Detection - Finds threats via platform logs
Container Threat Detection - Finds top suspicious activity in container deployments
Open Source Insights
Tool to see dependencies, security advisory, license across open source code
Device Management
API to manage corporate devices and control corporate data on devices
Safe Browsing / Web Risk API
Lets client apps check URLs against Google’s list of unsafe web resources
Titan C
Chip to protect users against phishing attacks
Enables 2 factor auth
Protects OS from tampering
**Chrome devices
Web Security Scanner
Crawls app following all links and URLs and attempts to exercise user inputs and event handlers to look for vulnerabilities
