[MUSIC PLAYING]
SPEAKER: One of the best practices
when securing software online is having a zero trust network
posture.
Firewalls are a critical component
of achieving zero trust network posture for your environment.
With increased migration of workloads
to cloud environments, more companies
are turning to cloud-first solutions for their network
security needs.
Google Cloud provides Cloud Firewall,
a scalable, cloud-first stateful inspection firewall
service with advanced protection capabilities.
Its distributed architecture can enable micro-segmentation
through granular controls enforced at the VM level.
You also get an easy-to-deploy intrusion prevention service
that prevents malware, spyware, and command-and-control attacks
on your network by inspecting both TLS and non-TLS traffic.
Depending on the scope and complexity of your cloud
workloads, we have multiple tiers of protection
available that each build off of the lower tier--
Firewall Essentials, Firewall Standard, and Firewall Plus.
There are also add-ons which are available for specific use
cases.
Firewall Essentials, the foundational tier,
gives you global and regional network firewall policies,
micro-segmentation with tags, and address groups.
Global network firewall policies and regional network firewall
policies enable you to group firewall rules
into a policy object applicable to all regions
or specific regions.
This can make it easier to apply changes across your network
or specify regional rules if regulation or business
needs require it.
Using IAM-governed tags along with network firewall policies
provides micro-segmentation and fine-grained control
of your Google Cloud resources.
Tags are managed centrally with unique IDs and strict IAM
control.
You can reference these tags in network firewall policy rules
for tighter and uniform access control
across your regions and network.
Tags and service accounts are used
to fine-tune the control over incoming and outgoing traffic
on the network level.
With address groups, we combine multiple IP addresses and IP
ranges into a single named logical unit.
You can reference the same address group
in multiple firewall rules for ingress and egress control.
This allows the use of automation
to change addresses in group objects
without changing actual firewall rules.
Many cloud workflows will need more.
And that's why we have Firewall Standard.
Firewall Standard adds the use of Google Cloud threat
intelligence as well as Fully Qualified Domain Name, FQDN,
objects and geolocation objects.
Wouldn't it be great to use the threat intelligence
expertise of the company that is the internet to so many people?
Google Cloud Threat Intelligence lets you secure your network
by allowing or blocking traffic based on our threat
intelligence data lists.
Fully Qualified Domain Name, FQDN,
objects in firewall policy rules filter
incoming or outgoing traffic from or to specific domains.
Based on the traffic direction, the IP addresses
associated with the domain names are matched against the source
or destination of the traffic.
So your traffic will only come from
or go to trusted resources.
Geolocation objects in firewall policy rules
filter external IPv4 and IPv6 traffic
based on specific geographic locations or regions.
This simplifies the process of managing traffic
to and from designated countries without the need
to specify individual IP addresses.
But if you want even more control,
Firewall Plus is where you will get it.
Firewall Plus gives you the ability
to detect and block threats from your network based
on the latest threat signatures.
With security profiles and security profile groups,
you can configure your customized threat detection
and prevention logic.
Security profiles contain the threat signatures
along with corresponding corrective actions
to prevent network attacks.
Security profile groups are a collection of security profiles
that are referenced by the firewall policy rules
to enable deep packet inspection for incoming or outgoing
traffic.
Firewall Endpoint is an organization-level resource
that can inspect traffic to and from VMs
deployed in the same zone.
Each firewall endpoint receives intercepted traffic
and performs deep packet inspection
to identify and prevent any threats.
You can deploy Firewall Endpoints at the zonal level
and then attach it to a VPC network
where you want to enforce threat detection and prevention.
Firewall Plus gives you the ability
to inspect encrypted and unencrypted traffic, including
both north-south and east-west traffic.
You can monitor VM-to-VM communication
to detect lateral movement.
So if a fully distributed firewall service
with advanced protection capabilities,
micro-segmentation, and pervasive coverage
to protect your Google Cloud workloads
from internal and external attacks is what you need,
Google Cloud Firewall is the answer.
To find out more information about which service tier is
right for you, as well as pricing
and how to use Cloud Firewall, visit the link on-screen
and in the video's description.