GoogleBar

Security in Google Cloud Platform

Want to understand how to deploy the components of a secure Google Cloud Platform solution? This three-day instructor led course will help.
product
google badge
3 day course
Supporting material
Virtual, Private
Virtual Classroom
A convenient and interactive learning experience, that enables you to attend on of our courses from the comfort of your own home or anywhere you can log on. We offer Virtual Classroom on selected live classroom courses where this will appear as an option under the location drop down if available. These can also be booked as Private Virtual Classrooms for exclusive business sessions.
Private
A private training session for your team. Groups can be of any size, at a location of your choice including our training centres.

As a Google Cloud Partner, we’ll share our years of industry experience to help you understand the Google approach to security.

On this course you’ll gain an understanding of security controls and techniques on Google Cloud Platform. Through a combination of lectures, demonstrations, and hands-on labs, you’ll explore and deploy the components of a secure GCP solution.

You’ll learn mitigation techniques for attacks at many points in a GCP-based infrastructure, including Distributed Denial-of-Service attacks, phishing attacks, and threats involving content classification and use.

This Security on Google Cloud Platform course will run over three consecutive days and is offered as a Virtual Classroom course, which will be hosted from the UK. It is also available as a private training session and can be delivered at our own training venues in the Rosebank Link, Johannesburg or Umhlanga, or any location of your choice.

 
Course overview
Who should attend:
  • Cloud information security analysts, architects, and engineers
  • Information security/cybersecurity specialists
  • Cloud infrastructure architects
  • Developers of cloud applications

By the end of the course (run over three consecutive days) you’ll have a deeper understanding of the main networking infrastructure on Google Cloud Platform and how you can use these solutions to achieve business objectives.

Walk away with the ability to:
  • Managing administrative identities using Cloud Identity
  • Implementing least privilege administrative access using Google Cloud Resource Manager, Cloud IAM
  • Implementing IP traffic controls using VPC firewalls and Cloud Armor
  • Implementing Identity Aware Proxy
  • Analysing changes to the configuration or metadata of resources with GCP audit logs
  • Securing a Kubernetes environment
  • Scanning for and redact sensitive data with the Data Loss Prevention API
  • Scanning a GCP deployment with Forseti
  • Mitigating important types of vulnerabilities, especially in public access to data and VM
Prerequisites

To get the most out of this course you should have completed the Google Cloud Platform Fundamentals: Core Infrastructure and the Networking in Google Cloud Platform courses, or have equivalent experience.
You will need to have knowledge of the foundational concepts in information security, as well as basic proficiency with command-line tools and Linux operating system environments. It is also recommended you have Systems Operations experience, including deploying and managing applications, either on-premises or in a public cloud environment.

Course agenda
Module 1: Foundations of GCP Security
  • Understand the GCP shared security responsibility model
  • Understand Google Cloud’s approach to security
  • Understand the kinds of threats mitigated by Google and by GCP
  • Define and understand Access Transparency and Access Approval (beta)
Module 2: Cloud Identity
  • Cloud Identity
  • Syncing with Microsoft Active Directory using Google Cloud Directory Sync
  • Using Managed Service or Microsoft Active Directory (beta)
  • Choosing between Google authentication and SAML-based SSO
  • Best practices, including DNS configuration, super admin accounts
  • Lab: Defining Users with Cloud Identity Console
Module 3: Identity, Access, and Key Management
  • GCP Resource Manager: projects, folders, and organisations
  • GCP IAM roles, including custom roles
  • GCP IAM policies, including organisation policies
  • GCP IAM Labels
  • GCP IAM Recommender
  • GCP IAM Troubleshooter
  • GCP IAM Audit Logs
  • Best practices, including separation of duties and least privilege, the use of Google groups in policies, and avoiding the use of primitive roles
  • Labs: Configuring Cloud IAM, including custom roles and organisation policies
Module 4: Configuring Google Virtual Private Cloud for Isolation and Security
  • Configuring VPC firewalls (both ingress and egress rules)
  • Load balancing and SSL policies
  • Private Google API access
  • SSL proxy use
  • Best practices for VPC networks, including peering and shared VPC use, correct use of subnetworks
  • Best security practices for VPNs
  • Security considerations for interconnect and peering options
  • Available security products from partners
  • Defining a service perimeter, including perimeter bridges
  • Setting up private connectivity to Google APIs and services
  • Lab: Configuring VPC firewalls
Module 5: Securing Compute Engine: techniques and best practices
  • Compute Engine service accounts, default and customer-defined
  • IAM roles for VMs
  • API scopes for VMs
  • Managing SSH keys for Linux VMs
  • Managing RDP logins for Windows VMs
  • Organisation policy controls: trusted images, public IP address, disabling serial port
  • Encrypting VM images with customer-managed encryption keys and with customer-supplied encryption keys
  • Finding and remediating public access to VMs
  • VM best practices
  • Lab: Configuring, using, and auditing VM service accounts and scopes
  • Encrypting VM disks with customer-supplied encryption keys
  • Lab: Encrypting disks with customer-supplied encryption keys
  • Using Shielded VMs to maintain the integrity of virtual machines
Module 6: Advanced Logging and Analysis
  • Cloud Storage and IAM permissions
  • Cloud Storage and ACLs
  • Auditing cloud data, including finding and remediating publicly accessible data
  • Signed Cloud Storage URLs
  • Signed policy documents
  • Encrypting Cloud Storage objects with customer-managed encryption keys and with customer-supplied encryption keys
  • Best practices, including deleting archived versions of objects after key rotation
  • Lab: Using customer-supplied encryption keys with Cloud Storage
  • Lab: Using customer-managed encryption keys with Cloud Storage and Cloud KM
  • BigQuery authorised views
  • BigQuery IAM roles
  • Best practices, including preferring IAM permissions over ACLs
  • Lab: Creating a BigQuery authorised view
Module 7: Securing Applications: techniques and best practices
  • Types of application security vulnerabilities
  • DoS protections in App Engine and Cloud Functions
  • Cloud Security Scanner
  • Lab: Using Cloud Security Scanner to find vulnerabilities in an App Engine application
  • Identity Aware Proxy
  • Lab: Configuring Identity Aware Proxy to protect a project
Module 8: Securing Kubernetes: techniques and best practices
  • Authorisation
  • Securing Workloads
  • Securing Clusters
  • Logging and Monitoring
Module 9: Protecting against Distributed Denial of Service Attacks
  • How DDoS attacks work
  • Mitigations: GCLB, Cloud CDN, autoscaling, VPC ingress and egress firewalls, Cloud Armor
  • Types of complementary partner products
  • Lab: Configuring GCLB, CDN, traffic blacklisting with Cloud Armor
Module 10: Protecting against content-related vulnerabilities
  • Threat: Ransomware
  • Mitigations: Backups, IAM, Data Loss Prevention API
  • Threats: Data misuse, privacy violations, sensitive/restricted/unacceptable content
  • Threat: Identity and Oauth phishing
  • Mitigations: Classifying content using Cloud ML APIs; scanning and redacting data using Data Loss Prevention API
  • Lab: Redacting Sensitive Data with Data Loss Prevention API
Module 11: Monitoring, Logging, Auditing, and Scanning
  • Security Command Center
  • Stackdriver monitoring and logging
  • Lab: Installing Stackdriver agents
  • Lab: Configuring and using Stackdriver monitoring and logging
  • VPC flow logs
  • Lab: Viewing and using VPC flow logs in Stackdriver
  • Cloud audit logging
  • Lab: Configuring and viewing audit logs in Stackdriver
  • Deploying and Using Forseti
  • Lab: Inventorying a Deployment with Forseti Inventory (demo)
  • Lab: Scanning a Deployment with Forseti Scanner (demo)
Upcoming courses
Virtual Classroom
Security in Google Cloud Platform
Wed, Nov 11 2020
R17,950 ex VAT
ADD TO BASKET
Virtual Classroom
Security in Google Cloud Platform
Wed, Jan 20 2021
R17,950 ex VAT
ADD TO BASKET
Virtual Classroom
Security in Google Cloud Platform
Wed, Mar 10 2021
R17,950 ex VAT
ADD TO BASKET
Upcoming courses
Virtual Classroom
Security in Google Cloud Platform
Wed, Nov 11 2020
R17,950 ex VAT
ADD TO BASKET
Virtual Classroom
Security in Google Cloud Platform
Wed, Jan 20 2021
R17,950 ex VAT
ADD TO BASKET
Virtual Classroom
Security in Google Cloud Platform
Wed, Mar 10 2021
R17,950 ex VAT
ADD TO BASKET
Book this course
R17,950 ex VAT
Loading...
close
Don't miss out
Keep up to date with news, views and offers from Jellyfish Training.
Your data will be handled in accordance with our Privacy Policy