Cloud Identity Overview, Google Cloud Directory Sync, Google authentication vs. SAML-based SSO. Authentication Best Practices

Objectives

• Learn what Cloud Identity is and what it does.
• Learn how Directory Sync securely syncs users and permissions between your on-prem LDAP or AD server and the cloud.
• Understand the two ways GCP handles authentication and how to set up SSO.
• Explore best practices for managing groups, permissions, domains and admins with Cloud Identity.

Activities

• 4 lectures and 1 demo

Resource Manager, IAM Roles, IAM Policies, IAM Recommender, IAM Trouble shooter, IAM Audit Logs, IAM Best Practices, Configuring IAM and Custom Roles

Objectives

• Understand Resource Manager: projects, folders, and organizations.
• Learn how to implement IAM roles, including custom roles
• Understand IAM policies, including organization policies.
• Understand best practices, including separation of duties and least privilege, the use of Google groups in policies, and avoiding the use of primitive roles.
• Learn how to configure IAM, including custom roles and organization policies.

Activities

• 8 lectures and 1 lab

VPC Firewalls, Load Balancing and SSL Policies, Interconnect and Peering Policies, Best Practices for VPC Networks, VPC Service Controls, VPC Flow Logs

Objectives

• Learn best practices for configuring VPC firewalls (both ingress and egress rules).
• Understand load balancing and SSL policies
• Understand how to set up private Google API access.
• Understand SSL proxy use.

• Learn best practices for VPC networks, including peering and shared VPC use, and the correct use of subnetworks
• Learn best security practices for VPNs.
• Understand security considerations for interconnect and peering options.

• Become familiar with available security products from partners.
• Learn to configure VPC firewalls.
• Prevent data exfiltration with VPC Service Controls.

Activities

• 5 lectures, 1 demo and 2 labs

Service Accounts, IAM Roles and API Scopes, Managing VM Logins, Organization Policy Controls, Compute Engine Best Practices, Encrypting Disks with CSEK

Objectives

• Learn about Compute Engine service accounts, default and customer-defined
• Understand IAM roles and scopes for VMs
• Understand how Shielded VMs help maintain your system and application integrity.

Activities

• 5 lectures and 2 labs

Cloud Storage IAM permissions and ACLs, Auditing Cloud Data, Signed URLs and Policy Documents, Encrypting with CMEK and CSEK, Cloud HSM, BigQuery IAM  Roles and Authorized Views, Storage Best Practices

Objectives

• Use cloud permissions and roles to secure cloud resources.
• Audit cloud data.
• Use signed URLs to give access to objects in a Cloud Storage bucket.

Activities

• Manage what can be placed in a Cloud Storage bucket using Signed Policy Document.
• Encrypt cloud data using customer managed encryption keys (CMEK), customer supplied encryption keys (CSEK), and Cloud HS
• Protecting data in BigQuery using IAM roles and authorized views.
• 7 lectures, 1 demo and 3 labs

Types of Application Security Vulnerabilities, Cloud Security Scanner, Threat: Identity and Oauth Phishing, Identity-Aware Proxy, Secret Manager

Objectives

• Recall various types of application security vulnerabilities.
• Understand DoS protections in App Engine and Cloud Functions
• Understand the role of Web Security Scanner in mitigating risks
• Define and recall the threats posed by Identity and Oauth phishing.

• Understand the role of Identity-Aware Proxy in mitigating risks
• Store application credentials and metadata securely using Secret Manager.

Activities

• 5 lectures and 3 labs

GKE/Kubernetes Overview, Securing Google Kubernetes Engine, Monitoring Google Kubernetes Engine

Objectives

• Understand the basic components of a Kubernetes environment.
• Understand how authentication and authorization works in Google Kubernetes Engine.
• Recall how to harden Kubernetes Clusters against attack.
• Recall how to harden Kubernetes workloads against attack.
• Understand logging and monitoring options in Google Kubernetes Engine.

Activities

• 3 lectures

How DDoS Attacks Work, GCP Mitigations, Types of Complementary Partner Products

Objectives

• Understand how DDoS attacks work.
• Recall common mitigations: GCLB, Cloud CDN, autoscaling, VPC ingress and egress firewalls, Cloud Armor.
• Recall the various types of complementary partner products available.
• Use Cloud Armor to blacklist an IP address and restrict access to an HTTP Load Balancer.

Activities

• 3 lectures and 1 lab

Threat Ransomware, Ransomware Mitigations, Content Related Mitigations

Objectives

• Discuss the threat of Ransomware.
• Understand Ransomware Mitigations: Backups, IAM, Data Loss Prevention API.
• Understand Threats to Content: Data misuse, privacy violations, sensitive/restricted/unacceptable content.
• Recall Mitigations for threats to Content: Classifying content using Cloud ML APIs; scanning and redacting data using Cloud Data Loss Prevention API

Activities

• 4 lectures and 1 lab

Security Command Center, Operations Monitoring and Logging, Cloud Audit Logging, Deploying and Using Forseti

Objectives

• Understand and use Security Command Center
• Understand and use Cloud Monitoring and Logging.
• Install the Monitoring and Logging Agents.
• Understand Cloud Audit logging.• Gain experience configuring and viewing Cloud Audit logs.
• Gain experience deploying and using Forseti.
• Learn how to inventory a deployment with Forseti Inventory.
• Learn how to scan a deployment with Forseti Scanner.

Activities

• 4 lectures, 2 demos and 3 labs