JENNY BROWN: Welcome to Cloud Security Basics, a series where
we explain the ins and outs of securing your application
on Google Cloud.
Sound fun?
Then stick around, because in this episode
you'll learn good practices for securing your application
with Cloud IAM.
[MUSIC PLAYING]
[SIRENS]
[STATIC]
[DIAL UP MODEM SOUND]
BRAD ACTOR: It's been a while, Cloud Detective.
I see you understand the flexibility and capabilities
of the cloud.
As you know, it makes it easier to work faster and collaborate
more effectively.
But it also introduces new responsibilities and security
risks.
And sometimes, those threats are not on the outside.
Accounts can get hacked, credentials leaked,
and employees disgruntled.
Whether accidental or willful, internal users
represent the biggest threat to your organization's cloud
security.
For your sake, Detective, I hope you can keep the wrong people
from accessing the wrong resources at the wrong time.
JENNY BROWN: OK, here's what we know.
Companies need to make sure that only the right people can
access only the right resources at only the right time.
One way to keep bad actors out would
be to cut access for everyone and have a few trusted people
dole out access manually.
But keeping productivity high and getting the most out
of your cloud platform depends on employees having access
to the resources and assets they need with the least
amount of friction or delay.
And while just manually allowing access every time
a person or application needs resources
might work for a very, very small organization, that
would quickly grow unwieldy as the teams grow
or begin to work remotely.
So in order for our organization to grow and function,
we need a better way to manage access.
Luckily, Google Cloud provides a lot of tools and services
to protect its users.
And this seems like a good time to use Google Cloud's Identity
and Access Management, actually.
So IAM is Google Cloud's unified system
for managing resource access, assigning user permissions,
and controlling cloud application service use.
It unifies all access and control
and centralizes it into one place.
Resources are the fundamental, lowest-level components
that make up all Google Cloud Services.
So some examples would include Compute Engine VMs,
Pub/Sub topics, Cloud Storage buckets, and App Engine
instances.
Cloud IAM lets organizations keep track of everything
going on in their Google Cloud environment
and prevent unauthorized resource access.
Let's research more to know how I can
use this to stop those threats.
Cloud IAM's access management system
breaks down into a few basic parts.
There's members, resources, permissions, roles, policies,
and groups.
Members, or identities, can be a Google account for end users,
a service account used to manage apps and virtual machines,
a Google Group, or a Google Workspace Cloud Identity domain
able to access a resource.
The member's identity is usually the associated email address,
service account, or group or domain name.
Resources, these are the fundamental components
that make up all Google Cloud services like VMs,
storage buckets, and more.
The organizations, folders, and projects used to organize them
are also considered resources.
And permissions, which are very fine-grained
access control on a particular resource.
Roles.
A role is a collection of permissions,
and permissions determine what operations
are allowed on a resource.
When you grant a role to a member,
you grant them all the permissions the role contains.
Google Cloud has predefined, built-in roles,
and you can also create custom roles.
Policies, which bind a set of Cloud IAM members to a role.
And if you want to define who has what type of access
on a resource, you create a policy
and attach it to that resource.
The policy also has other information, such as auditing
configuration, but we're going to focus
on identity aspects for now.
And groups.
Groups are used to help you manage users at scale.
Each member of a Google Group inherits the identity
and access management roles that you granted to that group.
And this means that you can use a group's membership
to manage users' roles instead of granting
IAM roles to individual users.
Hmm.
So how should I use IAM to protect my organization
from inside threats?
I could start by using groups from the beginning.
This way, the security admin wouldn't
have to manually change permissions
as employees get hired, fired, or move
throughout the organization because the right policies
would be assigned to anyone I move into the correct group.
This would also make it a lot easier
to minimize mistakes, because instead of assigning roles
and permissions to a specific employee,
we could assign them to groups and then add employees
to the correct groups.
This works even if you already have
an organizational hierarchy and groups in an existing
system like Active Directory.
And in that case, you can continuously
sync that configuration to Cloud IAM,
providing a single source of truth for group membership
and reducing the chance of a mistake.
And once we have groups, we could also
make sure to name the groups descriptively
so that it's obvious to tell at a glance what each of the roles
has access to.
And this should significantly reduce
mistakes that come from assigning the wrong roles
to the wrong groups.
A good strategy here would be to make a nested folder
hierarchy apparent with naming.
One general rule would be to begin with the organization
name and then expand out the folder tree with the project
name.
That's it.
I can use these components to shore up my system's defenses.
Let's see what Brad Actor thinks about that.
[STATIC]
BRAD ACTOR: Argh.
Detective, it seems like you've foiled my attempt again.
Somehow, you figured out that properly using Cloud IAM
greatly reduces the risk of security violations.
I'm surprised you even picked up on using groups
to simplify the process of managing access
rights for employees that move around your organization.
But what about the access you've given to non-human entities
like applications that need to access your secure resources
to function?
Have you secured those?
For your sake, I hope you have, because next time,
I'm not focusing on your employees,
but instead on your scripts and applications.
JENNY BROWN: So there you have it, another episode
of Cloud Security Basics.
Next episode, we'll focus on using service accounts
to protect automated access to your cloud resources.
So stay tuned for the rest of the Cloud Security Basics
series, because when it comes to security,
you can't let bad actors win.
[MUSIC PLAYING]
[SIRENS]