[Music]
welcome to the google cloud
security showcase a special web series
where we'll focus on security use cases
that customers can solve with google
cloud my name is andy
and i'm a product manager at google
cloud today we'll be walking through one
of the top
questions we get from customers how can
i configure a secure by design
environment for my cloud deployments to
address your questions about how to
build more securely
and faster on google cloud platform
we're excited to make two announcements
first the best practice resource center
so that there is one place on
cloud.google.com for you to go and
answer your questions around how to
secure yourself on google cloud platform
as well as how google secures itself
in addition we've announced the security
foundation's blueprint
which provides you infrastructure as
code in terraform
a full end end set of scripts to stand
up an organization from greenfield
and encodes google cloud best practices
in security
around your organization structure your
resource hierarchy your im grouping and
segmentation
network structure logging and detective
controls
giving you out of the box encoded best
practices for you to use
our goal here is to enable your teams to
meet the advanced needs of your
workloads and applications in business
without first having to go through the
learning of all the advanced skills
so you can get started faster more
securely from day one
to give you a view of what's included in
this foundation
blueprint we cover the 13
basic steps to go from greenfield to a
fully deployed
secured decentric organization these
include
the federation of identity the
definition of your iam for segmentation
and grouping
definition of key org policies that give
you top down control across all your
projects
the setup of shared vpc projects so you
can centralize the management of
firewall rules
across your projects the segmentation of
your different projects into different
regions for high availability
the ability to use dedicated
interconnect to bring data securely on
to gcp
the ability to protect your publicly
facing applications through firewall
rules and other google services
the setup of cloud logging so that you
have a good
event record as well as to be able to do
detections and forensics in the case of
incidents
that set up the security command center
to give you that one pane of glass view
across your organization your projects
and resources
of your security posture to set up the
eventual service projects
so that you can stand up and run the
different services for your business
the use of vp service controls so you
can create different levels of
restricted networks
that so that sensitive data is that much
more protected within your
gcp infrastructure and the ability to
set up cloud dns
and then landing you to a place where
you have a secured landing zone and you
can start building out your individual
applications and resources
you can find the security foundations
blueprint in our
security resource center and this can be
reached at cloud.google.com
security slash best practices here we
provide best practice guides
across not only the foundation but
amphos and container security
give you a place to find the various
deployable blueprints whether there are
the foundations
or that their particular security
posture ones
give you the background reference white
papers or how we secure things on google
ourselves as well as things like the
beyond beyondprod paper
which provide you insight in how you can
adopt a cloud native security
approach and then also generalize
learning resources around
cis benchmarks and miter threat attack
modeling around gcp
the security foundation's blueprint is
provided as a guide
in addition to the automation scripts
the guide itself covers
a number of key items and can be used as
a step-by-step
guide for deployment or as a reference
we cover things harass through
organization structure in detail
resource deployment authentication
networking
secrets management logging detective
controls and billing
if we think about how this translates
now into
practice from the terraform templates
that are available
you can go to the terraform example
foundations
repository which give you step-by-step
deployment from a bootstrapping for
infrastructure
as code through organization setup the
environments the networking and the
projects
this translates to an actual
organization
where you can either deploy it at the
organization level or as we've shown in
this case
at a folder level where you have the
cloud foundations deployed as a folder
we then have five subfolders the
bootstrap which gives you infrastructure
as code
the common folder which includes things
like the building
logging dns interconnect underlying
aggregate centralized logging across
your org sec command center alerts for
security
and secrets management and then a
production a non-production and a
development
set of environments as folders each of
these individually then has its own set
of shared vpcs
so the production shared vpcs are
the restricted and the base as well as
separate folder level centralized
monitoring and secrets projects
and then example projects for your
different business units
if they were to use either the base
network restricted network
or floating which means that the
applications within those type folders
need no external connectivity and just
rely on google cloud services
if we now dive into the im structure we
give you pre-built im groups
with default roles so that you start out
with admin groups
billing groups user groups already with
separation of duties built in
we also established a set of org
policies out of the box
things like disallowing public ips
across all your vms
or preventing any user who's not part of
your domain
to have any permissions or roles or
access on your
organization these preventive controls
are set up as org policies
and we set up a number of these out of
the box that you already start in a more
secure way
from a networking standpoint here you
can see the three different restricted
shared vpcs and security predictors that
have been set up
one for production one from non-prod one
for
development if we examine the production
one you'll see
we show the examples of projects
connected into that perimeter
the services that are specifically
restricted an access level that's
already been set up that
provides the additional set of policy
controls to who
get uh can get access to the data in
this particular perimeter
and then lastly we have the security
command center set up to give you that
uniform view one pane of glass across
your organization or projects and
resources
for threats vulnerabilities compliance
assets
findings so that you can have one place
to look at
and examine and manage your security
posture so hopefully
these two items the best practice
resource center and the security
foundation blueprints
will help you meet your goal of
accelerating your deployments on google
cloud platforms
and increasing the security of those
platforms
thank you for tuning in please visit
cloud.google.com
security for more content from google
cloud experts
you