How to make your Google Cloud Platform Project More Secure: An introduction

Google Cloud Platform (GCP) has many security features built in and provided by default to its users. You can read more about the platform’s security on this link: https://cloud.google.com/security/. But, as always, security is made up of many separate, highly tunable controls. Each of these can be improved upon until you achieve complete unusability of your system. This series of blog posts will be about how to make your Google Cloud Platform project secure.

Article II.: How to Make Your Google Cloud Platform Project More Secure: IAM security

Article III.: How to Make Your Google Cloud Platform Project More Secure: Built-In GCE Security

Article IV.: How to Make Your Google Cloud Platform Project More Secure: GCE Network Security

Article V.: How to Make Your Google Cloud Platform project more secure: GCE OS Security

Keeping Up With Security Standards

With security controls, your goal is usually to set up an initial target level of security. Look for specific guidelines for your industry or stored data types to find where this level should be for your specific use case. For example, if you store or handle credit card information in any way, you must meet the Payment Card Industry Data Security Standard (PCI DSS). If you’ve determined the right security target for your application, you should aim to reach that while maximizing the ease of system use.

The Concept of Defense in Depth

There’s also a concept in security called defense in depth. This says that you’ll never be able to patch every possible hole in your system. However, you should create security measures with multiple layers. So, if there is a way to circumvent one, there’ll be other measures in place before an attacker can seize full control of your resources. It’s highly advisable to practice defense in depth in most situations regarding information systems. On Google Cloud Platform, besides the built-in security measures, there are some settings and additional controls given to the administrators.

I’ve decided to write a series of posts to describe some of these settings. I also highlighted the expected or at least reasonable values to set them to. In the next post, I’ll write about the security-related options for Identity & Access Management (IAM). Since everything starts there, you should consider securing that part of your project first. If you follow the steps written in the next post, you’ll have a much better chance of protecting yourself against account compromises. You will be protected against runaway spending or even mistakes by human administrators.