PART I: Security Management in the Google Cloud

Module 1: Fundamentals of GC Safety

• • Google Cloud security approach
  
• • The shared responsibility model for security
  
• • Threats mitigated by Google and GC
  
• • Transparency in access

Module 2: Identity in the Cloud

• • Identity in the cloud
  
• • Synchronization with Microsoft Active Directory
  
• • Choice between Google and SAML-based SSO authentication
  
• • GCP best practices
  

Module 3: Identity and Access Management

• • GCP Resource Manager: projects, folders and organizations
  
• • GCP IAM features, including custom features
  
• • GCP IAM policies, including organizational policies
  
• • GCP IAM Best Practices
   

Module 4: Configuring the Google Virtual Private Cloud for Privacy and Security

• • VPC firewall configuration (entry and exit rules)
  
• • Load balancing and SSL policies
  
• • Private access to the Google API
  
• • Use of SSL proxy
  
• • Best practices for structuring VPC networks
  
• • Best security practices for VPNs
  
• • Security considerations for interconnection and peering options
  
• • Security products available from partners
   

Module 5: Monitoring, Logging, Auditing and Scanning

• • Stacker monitoring and logging
  
• • VPC flow records
  
• • Cloud Audit Log
  
• • Deploying and Using Forseti
  

 PART II: Vulnerability Mitigation in the Google Cloud

Module 6: Engine protection for computing: techniques and best practices

• • Calculate default and customer-defined engine service accounts
• • RIO functions for virtual machines
  
• • Virtual Machine API Scopes
  
• • SSH key management for Linux virtual machines
  
• • Managing RDP Logins for Windows Virtual Machines
  
• • Organizational policy controls: trusted images, public IP address, serial port deactivation
  
• • Encryption of VM images with customer-managed and customer-supplied encryption keys
  
• • Find and remedy public access to virtual machines
  
• • WV best practices
• • Encryption of VM discs with encryption keys provided by the customer

Module 7: Data Protection in the Cloud: Techniques and Best Practices

• • Cloud storage and AMI permissions
  
• • Cloud storage and ACLs
  
• • Cloud data auditing, including search and repair of publicly accessible data
  
• • Signed Cloud Storage URLs
  
• • Signed policy documents
  
• • Encrypting Cloud Storage Objects with Customer-Managed and Customer-Supplied Encryption Keys
  
• • Best practices, including deleting archived versions of objects after keystrokes
  
• • Authorized views of BigQuery
  
• • BigQuery IAM features
  
• • Best practices, including preference of IAM permits over ACLs

Module 8: Protection against distributed denial of service attacks: techniques and best practices

• • How DDoS attacks work
  
• • Mitigation: GCLB, Cloud CDN, Auto Scaling, VPC Input/Output Firewalls, Cloud Armor
  
• • Types of complementary partner products

Module 9: Application Security: Techniques and Best Practices

• • Types of application security vulnerabilities
  
• • DoS protections in App Engine and Cloud features
  
• • Cloud Security Scanner
  
• • Threat: Phishing and Oauth phishing
  
• • Identity Recognition Proxy

Module 10: Content-Related Vulnerabilities: Techniques and Best Practices

• • Threat: Ransomware
  
• • Mitigation: backup API, IAM, data loss prevention
  
• • Threats: Data misuse, privacy violations, confidential/restricted/unacceptable content
  
• • Mitigation: Content classification using Cloud ML APIs; data analysis and writing using Data Loss Prevention APIs