Learning Objectives

• Understand the core principles underlying Google Cloud security
• Set up IAM roles and policies to enforce least-privilege access
• Apply security controls to Compute Engine, Cloud Storage, and Kubernetes workloads
• Build secure VPC networks and implement network-level controls
• Use built-in GCP tools to detect, monitor, and respond to security threats
• Address common vulnerabilities and reduce exposure to DDoS attacks

Course Outline

Module 1: Google Cloud Security Fundamentals

Introduces the shared responsibility model and provides an overview of the security controls and tools available within Google Cloud Platform.

Module 2: Managing Access to Google Cloud

Examines identity types and Cloud Identity, covering IAM fundamentals and advanced permission configurations for controlling access to GCP resources.

Module 3: Identity and Access Management (IAM)

Discusses IAM policies, roles, and service accounts, with guidance on applying least-privilege access control throughout the environment.

Module 4: Configuring Virtual Private Cloud for Isolation and Security

Covers subnet design, firewall rule configuration, and Private Google Access, as well as VPC flow logs and methods for securing communication between resources.

Module 5: Securing Compute Engine

Addresses instance identity, metadata management, OS patching strategies, and image management practices for protecting virtual machine workloads.

Module 6: Securing Cloud Data

Reviews Cloud Storage security configurations, encryption options in GCP, and how to use IAM to control and audit access to data.

Module 7: Securing Applications

Covers secure application design principles and the use of Web Security Scanner and content protection mechanisms to identify and remediate application-level vulnerabilities.

Module 8: Securing Google Kubernetes Engine (GKE)

Addresses workload identity, role-based access control (RBAC), and network policies in GKE, along with approaches for secure pod deployment in containerized environments.

Module 9: Protecting Against DDoS Attacks

Covers the use of Cloud Armor, load balancing, and autoscaling to build DDoS protection strategies for workloads running on GCP.

Module 10: Addressing Content-Related Vulnerabilities

Focuses on Cloud Data Loss Prevention (DLP), BeyondCorp Enterprise, and data classification to manage and reduce content-related security risks.

Module 11: Monitoring, Logging, Auditing, and Scanning

Covers Cloud Audit Logs, Security Command Center, and Cloud Monitoring as tools for threat detection, incident response, and maintaining security visibility across the GCP environment.