welcome to cloud security basics a new
series where we explain the ins and outs
of securing your application on Google
cloud sound fund and stick around
because in this episode you'll learn
about the second of three distinct areas
of cloud security risk data
[Music]
hello cloud detective you may have found
protections for the first cloud security
risk access but how much have you
thought about the second risk data how
can you prevent problems with the data
you store there are many ways to get
trapped here improper disclosure of your
info by employees imagine accidentally
sending an email containing credit card
or social security numbers your
application could disseminate harmful
data sharing phishing URLs or malware or
data could be stored somewhere without
proper security protocols in place what
can you do to stop that for your data's
sake I hope you know the answer to my
question ok here's what we know data
represents what data gets stored and
where it's located you must be sure that
you don't store personally identifiable
information or PII which is data that
could potentially be used to identify a
user and even if you don't store
sensitive information if you can't find
where you stored it that's not going to
be very useful to you or your customers
typical concerns here include something
bad with the people who can access
machines for example a compromised
employee accessing data they shouldn't
something bad with the data itself like
receiving bad data or storing illegal
data if the data coming into your system
is junked then even if every other
component of data security is working as
normal the system still won't function
as intended
sometimes unsanitized ADA can even be
used to exploit a system to further
compromised application something bad
with the transfer or storage of data for
example not being able to find where
data is stored in this case the cloud
solution would be losing data whether
because it never got stored or because
it got lost once it was either way the
end result is that the data you need
can't be retrieved something bad with
the machine data is being stored on like
it containing malware or if there were
compromised VMS in this case even though
the data is stored correctly it might be
leaked or accessed by the wrong people
luckily Google cloud provides a lot of
tools and services to protect its users
including but not limited to
I am for controlling access to data
resources encryption to make sure it's
stored and transfer data can't be read
even if it is stolen logging and
monitoring to make sure that you can
track what's happening in your system D
ID for making sure PII information is
stripped before it's ever stored in your
system organizational policy to set
rules on who can access what data and
where it's stored and better VMs or VM
management like for set E or Google host
patching etc to make sure that the
machines you use are secure let's see
how they work so how do we prevent
problems of data we store I just listed
a few tools I want to highlight a few of
them cloud iam lets you grant granular
access to specific Google cloud
resources and helps prevent access to
other resources cloud iam lets you adopt
the security principle of least
privilege where you only grant necessary
permissions to access specific resources
this works to prevent people from
accidentally or maliciously accessing
data they shouldn't for example I am
could let you keep UI developers from
access and credit card databases they
didn't need access in the first place
say there was an access violation though
that's where logging and monitoring can
be used to track who was accessing what
and automate the information gathering
and alerting process as much as possible
cloud platform provides tools such as
Google cloud logging and Google cloud
monitoring that make it easy to collect
and analyze request logs and monitor the
availability of your infrastructure
services like VM instances these tools
make it easy for you to create custom
dashboards and set alerts when issues
occur for example you could set up
notifications to warn you of suspicious
activity in your system or to notify you
in access to a resource is taking too
long for instance but really it's good
to be proactive as much as possible and
set up organizational policy in
organizational policies a centralized
configuration of restrictions on how
your organization's resources can be
used they define guardrails for your
development teams to stay within
compliance boundaries and help teams
move quickly without worrying of
breaking compliance for example you
could set a policy to require all newly
created restarted or updated cloud
sequel instances to use customer managed
encryption keys
all of these tools and more work
together to protect data mmm and that's
it I know the answer - Brad actor's
question hello detective I see you've
been busy you answered my little
question what if there's a problem with
the data you store you learned that
Google provides a plethora of tools to
help customers protect data including I
am encryption logging and monitoring
organizational policy and more these
features allow you to make sure only
valid data is being stored control who
can access data that's stored and help
you find the data you do store very good
very good you've answered today's
questions but be ready because next time
I want to see what you know about
securing your virtual and physical
hardware so there you have it another
episode of cloud security basics next
episode will focus on the last of three
distinct areas of cloud security risk
platform in the mean time if you want to
take a deeper dive into the securing
data in the cloud then check out the
article linked in the description below
and stay tuned for the rest of the cloud
security basics series because when it
comes to security you can't let bad
actors win
[Music]