CYNTHIA THOMAS: Hi.
This is Cynthia Thomas, and I'm back
to give you the latest on Google Cloud Edge and security
networking launches that have recently gone GA.
Stick around.
[MUSIC PLAYING]
Cloud Armor-- what is it?
It's Google Cloud's DDoS defense service and web application
firewall that works to protect your applications and websites.
Cloud Armor protects your applications
against DDoS attacks using the same technology that's
used to protect Google's own services.
Additionally, a host of security capabilities are available.
But in this video, we'll focus on the latest and greatest
that are now GA.
Cloud Armor policies have now been
extended to help you mitigate the top 10 OWASP web app
vulnerabilities in an easy-to-configure fashion.
The new preconfigured WAF rules include scanner detection,
protocol attack, PHP injection, and session fixation.
The available preconfigured rules
are based on OWASP ModSecurity core rules set.
The rules allow Cloud Armor to evaluate
dozens of distinct traffic signatures
by referring to conveniently named rules,
instead of requiring you to define each signature manually.
They can be tuned to different sensitivity levels, as well.
Cloud Armor also launched the capabilities
to parse JSONs, filter based on ASN,
and enable verbose logging.
Incoming requests with JSON as the content type
often report a high rate of noise
and false positive hits from preconfigured WAF rules.
With this release, you can now enable Cloud Armor
to parse the JSON formatted content of HTTP requests
on a per-policy basis.
Once enabled, you can significantly
reduce the noise and false positive alerts for workloads
with requests containing JSON.
Another available rule attribute is filtering based on an ASN.
Cloud Armor lets you allow or deny incoming requests serviced
from a specific network operator defined by their autonomous
system number.
Finally, you can get more logging information
of incoming requests.
By default, event logs contain the security rule
that was triggered.
With verbose logging, Cloud Armor
can generate additional details in the request
logs to include a snippet of the offending content that
triggered the rule.
Next, let's talk about additions to VPC Service
Controls, your Google Cloud service perimeter defense tool.
VPC Service Controls works to prevent data exfiltration
and is a hard requirement for several financial services
customers.
It defines a service perimeter that
lets you protect your organization's information
by controlling access to resources
and manage services data.
Now VPC Service Controls has expanded
the services you can include in the service perimeter.
It now includes the Cloud Filestore API.
Filestore is a Google-managed, network-attached storage
solution.
It works with VMs and Google Kubernetes Engine.
And with VPC Service Controls, you
can now control and protect the Data Exchange with Filestore.
Finally, let's talk about VPC Service Controls
Troubleshooter.
This is a new tool that enables admins to better understand
a denial caused by VPC Service Controls.
Defining your security perimeter can
be tricky while debugging denial errors.
You can now easily investigate issues
related to VPC Service Controls using the Cloud Console.
Use the VPC Service Controls Troubleshooter
via the Logs Explorer or from the VPC Service Controls page.
Once you enter a unique ID for the logged error,
you'll be provided with one of the violation
reasons for further insights into the denial.
Very handy for confirming and defining
your service perimeters.
All right.
Now you're up-to-date on the latest networking and Edge
security launches.
Check out the docs linked below and let us know
what you think in the comments.
Join us next time for "What's New In Networking."