Cloud Computing & Virtualisation - Category Banner

Security in Google Cloud

Length 3 days

Course overview

View dates &
book now

Course locations >>

Why study this course

This three-day instructor-led course gives you a broad study of security controls and techniques in Google Cloud.

Through lectures, demonstrations, and hands-on labs, you’ll explore and deploy the components of a secure Google Cloud solution, using services like Cloud Identity, Identity and Access Management (IAM), Cloud Load Balancing, Cloud IDS, Web Security Scanner, BeyondCorp Enterprise, Cloud DNS, and much more.

This course is a continuation of the Networking in Google Cloud Platform course and assumes hands-on experience with the technologies covered in that course.

Aligns to certification

Google Cloud Certified: Professional Cloud Security Engineer

Request Course Information

What you’ll learn

This course teaches participants the following skills:

Identify the foundations of Google Cloud security.
Manage administration identities with Google Cloud.
Implement user administration with Identity and Access Management (IAM).
Configure Virtual Private Clouds (VPCs) for isolation, security, and logging.
Apply techniques and best practices for securely managing Compute Engine.
Apply techniques and best practices for securely managing Google Cloud data.
Apply techniques and best practices for securing Google Cloud applications.
Apply techniques and best practices for securing Google Kubernetes Engine (GKE) resources.
Manage protection against distributed denial of service attacks (DDoS).
Manage content-related vulnerabilities.
Implement Google Cloud monitoring, logging, auditing, and scanning solutions.

Google Cloud at Lumify Work

Lumify Work is Australia's only national Google Cloud Authorised Training Partner. Get the skills needed to build, test, and deploy applications on this highly scalable infrastructure. Engineered to handle the most data-intensive work you can throw at it, Lumify Work can support you through training wherever you are in your Cloud adoption journey.

View all Google Cloud courses

Who is the course for?

This course is intended for the following participants:

Cloud information security analysts, architects, and engineers
Information security/cybersecurity specialists
Cloud infrastructure architects.

Course subjects

Module 1: Foundations of Google Cloud Security

Google Cloud’s approach to security
The shared security responsibility model
Threats mitigated by Google and Google Cloud
Access transparency

Module 2: Securing Access to Google Cloud

Cloud Identity
Google Cloud Directory Sync
Managed Microsoft AD
Google authentication versus SAML-based SSO
Identity Platform
Authentication best practices
Demo: Defining Users with Cloud Identity Console

Module 3: Identity and Access Management (IAM)

Resource Manager
IAM roles
Service accounts
IAM and Organisation policies
Workload Identity Federation
Policy Intelligence
Lab: Configuring IAM

Module 4: Configuring Virtual Private Cloud for Isolation and Security

VPC firewalls
Load balancing and SSL policies
Interconnect and Peering options
VPC Service Controls
Access Context Manager
VPC Flow Logs
Cloud IDS
Lab: Configuring VPC Firewalls
Lab: Configuring and Using VPC Flow Logs in Cloud Logging
Demo: Securing Projects with VPC Service Controls
Lab: Getting Started with Cloud IDS

Module 5: Securing Compute Engine: Techniques and Best Practices

Service accounts, IAM roles, and API scopes
Managing VM logins
Organisation policy controls
Shielded VMs and Confidential VMs
Certificate Authority Service
Compute Engine best practices
Lab: Configuring, Using, and Auditing VM Service Accounts and Scopes

Module 6: Securing Cloud Data: Techniques and Best Practices

Cloud Storage IAM permissions, and ACLs
Auditing cloud data
Signed URLs and policy documents
Encrypting with CMEK and CSEK
Cloud HSM
BigQuery IAM roles and authorised views
Storage best practices
Lab: Using Customer-Supplied Encryption Keys with Cloud Storage
Lab: Using Customer-Managed Encryption Keys with Cloud Storage and Cloud KMS
Lab: Creating a BigQuery Authorised View

Module 7: Securing Applications: Techniques and Best Practices

Types of application security vulnerabilities
Web Security Scanner
Threat: Identity and Oauth phishing
Identity-Aware Proxy
Secret Manager
Lab: Using Web Security Scanner to Find Vulnerabilities in an App Engine Application
Lab: Securing Compute Engine Applications with BeyondCorp Enterprise
Lab: Configuring and Using Credentials with Secret Manager

Module 8: Securing Google Kubernetes Engine: Techniques and Best Practices

Types of application security vulnerabilities
Web Security Scanner
Threat: Identity and OAuth phishing
Identity-Aware Proxy
Secret Manager

Module 9: Protecting Against Distributed Denial of Service Attacks (DDoS)

How DDoS attacks work
Google Cloud mitigations
Types of complementary partner products
Lab: Configuring Traffic Blocklisting with Google Cloud Armor

Module 10: Content-Related Vulnerabilities: Techniques and Best Practice

Threat: Ransomware
Ransomware mitigations
Threats: Data misuse, privacy violations, sensitive content
Content-related mitigation
Redacting Sensitive Data with the DLP API
Lab: Redacting Sensitive Data with the DLP API

Module 11: Monitoring, Logging, Auditing, and Scanning

Security Command Center
Cloud Monitoring and Cloud Logging
Cloud Audit Logs
Cloud security automation
Lab: Configuring and Using Cloud Monitoring and Cloud Logging
Lab: Configuring and Viewing Cloud Audit Logs

Prerequisites

To get the most out of this course, participants should have:

Completed Google Cloud Fundamentals: Core Infrastructure or equivalent experience
Completed Networking in Google Cloud Platform or equivalent experience
Knowledge of foundational concepts in information security, through experience or through online training such as SANS’s SEC301: Introduction to Cyber Security
Basic proficiency with command-line tools and Linux operating system environments
Systems Operations experience, including deploying and managing applications, either on-premises or in a public cloud environment
Reading comprehension of code in Python or JavaScript
Basic understanding of Kubernetes terminology (preferred but not required)

Terms & Conditions

The supply of this course by Lumify Work is governed by the booking terms and conditions. Please read the terms and conditions carefully before enrolling in this course, as enrolment in the course is conditional on acceptance of these terms and conditions.