Google 云 Platform (GCP) security refers to the practice of implementing processes, 确保应用程序安全的技术和标准, 资源和数据运行在谷歌的云基础设施服务上.
什么是GCP? It is a cloud computing service distributed all over the world via physical and virtual 资源 and hosted in Google data centers. GCP用户可以使用的各种服务包括数据管理, 混合和多云架构, 人工智能和机器学习(ML).
被称为 责任分担模式，有两种方式来看待 云安全 when using any cloud platform: the cloud provider will work to secure the cloud environment and its perimeter, while a customer will work to secure the operations running within that cloud environment.
By definition, public cloud services like GCP, are delivered over the public internet. That means your sensitive and mission-critical applications and data can be accessed by authorized users and/or 威胁的演员 ——如果没有采取适当的措施来阻止它们的话.
这显然说起来容易做起来难, and can result in so many data breaches from misconfigured 资源 or gaps/weaknesses in an organization's security posture. 为了帮助解决这个问题, 已经开发了各种各样的最佳实践和标准, 包括 谷歌提供的.
GCP security is important because the tapestry of services it offers - backed by globally distributed software and hardware - is leveraged for complex user operations that can be difficult to secure. 这些操作包括:
最后一点, the Center for Internet Security (CIS) recently released an updated version of their GCP Foundation Benchmarks. 这些基准通常采取监管建议的形式, in this instance covering configurations and policies ranging from resource segregation to compute and storage. These are not requirements, but they can go a long way toward mitigating future security headaches.
数据库或容器配置错误是GCP安全性很重要的另一个原因. 不幸的是, 这些缺陷太常见了, 并且会使储存容器易受攻击并暴露在外. 防止, 检测, and repairing improperly configured cloud data services is a crucial part of the security process for running operations on GCP. Detection and response solutions can help mitigate potential exposure by collecting user ingress 事件, 行政活动, 以及由GCP生成的日志数据，以监视正在运行的实例和帐户活动.
在GCP上利用共享责任模型(SRM)意味着什么? 如上所述, a cloud provider is responsible for securing the infrastructure on which a user’s workloads run, 但是用户有责任保护他们的机密工作负载, 资源, 以及云基础设施中的数据.
浏览我们的 Gartner云安全原型实用指南
谷歌:
“Understanding the 责任分担模式 is important when determining how to best protect your data and workloads on Google 云. The 责任分担模式 describes the tasks that you have when it comes to security in the cloud and how these tasks are different for cloud providers.”
了解他们选择了什么样的共同责任模式, 用户必须首先定义需要运行的工作负载类型. 基于这些信息, they’ll then be able to determine the type(s) of cloud service(s) they’ll need to purchase. 在GCP上，这些可以包括:
Key to a hybrid or multi-cloud environment is to educate DevOps talent about a cloud provider’s 责任分担模式 (阅读有关AWS版本的信息). 通过了解谁负责哪种类型的安全, 会有更少的错误导致更少的漏洞.
We now know that cloud providers are responsible for securing the infrastructure of their platforms. Let’s take a look at some of GCP’s overarching security tools to assist customers and fulfill their side of the SRM.
The command center aids in asset discovery and inventory, threat prevention, and threat detection. It enables understanding of which 资源 are deployed at a given time as well as helping to identify misconfigurations and compliance violations.
身份访问管理(IAM) enables user admins to be gatekeepers on who can gain access to certain 资源 within specific cloud operations. 审计功能提供了组织级别的可见性和筛选.
密钥管理服务(KMS)将加密控制权交给用户. Google’s KMS feature enables cryptographic key management in a central cloud service and provides the flexibility to encrypt data with either a symmetric or asymmetric key in control by the user.
云 监控和日志记录 是GCP中必要的安全工具吗. 从集中式套件访问, 日志记录是一种获取应用程序数据的托管服务, 日志数据, 以及来自谷歌云内外其他服务的数据. 监视可以使您了解在GCP上运行的应用程序的运行状况, 包括指标, 事件, 和元数据.
GCP的Web安全扫描器检查用户应用程序引擎中的漏洞, Kubernetes, 和计算引擎web应用程序. 它爬行应用程序以扫描尽可能多的用户输入和事件处理程序. It’s intended as an additive service that complements a user’s existing vulnerability-scanning operations.
经常, 然而, 本地工具不能扩展到保护所有东西，并且很难管理, 因此需要独立的云安全提供商.
It’s a good idea to put in place a few best-practice methodologies to ensure not only that vulnerability risks are mitigated, 而且这种遵从是持续良好的 DevSecOps 组织从一个坚实的知识库运行. 谷歌建议:
构建分层的安全方法
Implement security at each level in your application and infrastructure by applying a defense-in-depth approach. Use the features in each product to limit access and configure encryption where appropriate.
安全解耦系统的设计
在可能的情况下，简化系统设计以适应灵活性, 并记录每个组件的安全需求. 结合一个健壮的安全机制来考虑弹性和恢复.
自动部署敏感任务
通过自动化部署和其他管理任务，将人工从工作流中剔除.
自动化安全监控
使用自动化工具来监视应用程序和基础结构. 扫描您的基础结构以查找漏洞并检测安全事件, use automated scanning in your continuous integration and continuous deployment (CI/CD) pipelines.
满足您所在地区的合规性要求
Be mindful that you might need to obfuscate or redact personally identifiable information (PII) to meet your regulatory requirements. 在可能的情况下，自动化你的工作 合规工作.
遵守数据驻留和主权要求
You might have internal (or external) requirements that require you to control the locations of data storage and processing. 这些需求根据系统设计目标而变化, 行业监管问题, 国家法律, 税收的影响, 和文化. 数据驻留描述了数据存储的位置.
把保安移到左边
DevOps and deployment automation let your organization increase the velocity of delivering products. 以帮助确保您的产品保持安全, 从开发过程的开始就合并安全过程.
2022 云 Misconfigurations Report: Latest 云安全 Breaches and Attack Trends