Want to understand how to deploy the components of a secure Google Cloud Platform solution? This three-day instructor led course will help.
3 day course
Supporting material
Google Cloud Partner of the Year
Classroom, Virtual, Private
Classroom
Face to face, interactive classroom training run from our global training centres.
Virtual Classroom
A convenient and interactive learning experience, that enables you to attend one of our courses from the comfort of your own home or anywhere you can log on. We offer Virtual Classroom on selected live classroom courses where this will appear as an option under the location drop down if available. These can also be booked as Private Virtual Classrooms for exclusive business sessions.
Private
A private training session for your team. Groups can be of any size, at a location of your choice including our training centres.
As a Google Cloud Partner, we’ll share our years of industry experience to help you understand the Google approach to security.
On this course you’ll gain an understanding of security controls and techniques on Google Cloud Platform. Through a combination of lectures, demonstrations, and hands-on labs, you’ll explore and deploy the components of a secure GCP solution.
You’ll learn mitigation techniques for attacks at many points in a GCP-based infrastructure, including Distributed Denial-of-Service attacks, phishing attacks, and threats involving content classification and use.
Jellyfish has recently been named a Google Cloud Specialisation Partner of the Year. This title recognises our commitment to provide world-leading Cloud-based Training solutions that help our clients succeed. This Security on Google Cloud Platform course is part of our Cloud Security Engineer learning track and is available at our training centre in The Shard, London. We also offer private training at a location of your choice or via Virtual Classroom.
Course overview
Who should attend:
Cloud information security analysts, architects, and engineers
Information security/cybersecurity specialists
Cloud infrastructure architects
Developers of cloud applications
By the end of the course (run over three consecutive days) you’ll have a deeper understanding of the main networking infrastructure on Google Cloud Platform and how you can use these solutions to achieve business objectives.
Walk away with the ability to:
Managing administrative identities using Cloud Identity
Implementing least privilege administrative access using Google Cloud Resource Manager, Cloud IAM
Implementing IP traffic controls using VPC firewalls and Cloud Armor
Implementing Identity Aware Proxy
Analysing changes to the configuration or metadata of resources with GCP audit logs
Securing a Kubernetes environment
Scanning for and redact sensitive data with the Data Loss Prevention API
Scanning a GCP deployment with Forseti
Mitigating important types of vulnerabilities, especially in public access to data and VM
Prerequisites
To get the most out of this course you should have completed the Google Cloud Platform Fundamentals: Core Infrastructure and the Networking in Google Cloud Platform courses, or have equivalent experience. You will need to have knowledge of the foundational concepts in information security, as well as basic proficiency with command-line tools and Linux operating system environments. It is also recommended you have Systems Operations experience, including deploying and managing applications, either on-premises or in a public cloud environment.
Course agenda
Module 1: Foundations of GCP Security
Understand the GCP shared security responsibility model
Understand Google Cloud’s approach to security
Understand the kinds of threats mitigated by Google and by GCP
Define and understand Access Transparency and Access Approval (beta)
Module 2: Cloud Identity
Cloud Identity
Syncing with Microsoft Active Directory using Google Cloud Directory Sync
Using Managed Service or Microsoft Active Directory (beta)
Choosing between Google authentication and SAML-based SSO
Best practices, including DNS configuration, super admin accounts
Lab: Defining Users with Cloud Identity Console
Module 3: Identity, Access, and Key Management
GCP Resource Manager: projects, folders, and organisations
GCP IAM roles, including custom roles
GCP IAM policies, including organisation policies
GCP IAM Labels
GCP IAM Recommender
GCP IAM Troubleshooter
GCP IAM Audit Logs
Best practices, including separation of duties and least privilege, the use of Google groups in policies, and avoiding the use of primitive roles
Labs: Configuring Cloud IAM, including custom roles and organisation policies
Module 4: Configuring Google Virtual Private Cloud for Isolation and Security
Configuring VPC firewalls (both ingress and egress rules)
Load balancing and SSL policies
Private Google API access
SSL proxy use
Best practices for VPC networks, including peering and shared VPC use, correct use of subnetworks
Best security practices for VPNs
Security considerations for interconnect and peering options
Available security products from partners
Defining a service perimeter, including perimeter bridges
Setting up private connectivity to Google APIs and services
Lab: Configuring VPC firewalls
Module 5: Securing Compute Engine: techniques and best practices
Compute Engine service accounts, default and customer-defined
IAM roles for VMs
API scopes for VMs
Managing SSH keys for Linux VMs
Managing RDP logins for Windows VMs
Organisation policy controls: trusted images, public IP address, disabling serial port
Encrypting VM images with customer-managed encryption keys and with customer-supplied encryption keys
Finding and remediating public access to VMs
VM best practices
Lab: Configuring, using, and auditing VM service accounts and scopes
Encrypting VM disks with customer-supplied encryption keys
Lab: Encrypting disks with customer-supplied encryption keys
Using Shielded VMs to maintain the integrity of virtual machines
Module 6: Advanced Logging and Analysis
Cloud Storage and IAM permissions
Cloud Storage and ACLs
Auditing cloud data, including finding and remediating publicly accessible data
Signed Cloud Storage URLs
Signed policy documents
Encrypting Cloud Storage objects with customer-managed encryption keys and with customer-supplied encryption keys
Best practices, including deleting archived versions of objects after key rotation
Lab: Using customer-supplied encryption keys with Cloud Storage
Lab: Using customer-managed encryption keys with Cloud Storage and Cloud KM
BigQuery authorised views
BigQuery IAM roles
Best practices, including preferring IAM permissions over ACLs
Lab: Creating a BigQuery authorised view
Module 7: Securing Applications: techniques and best practices
Types of application security vulnerabilities
DoS protections in App Engine and Cloud Functions
Cloud Security Scanner
Lab: Using Cloud Security Scanner to find vulnerabilities in an App Engine application
Identity Aware Proxy
Lab: Configuring Identity Aware Proxy to protect a project
Module 8: Securing Kubernetes: techniques and best practices
Authorisation
Securing Workloads
Securing Clusters
Logging and Monitoring
Module 9: Protecting against Distributed Denial of Service Attacks
3 day course
Supporting material
Google Cloud Partner of the Year
Classroom, Virtual, Private
