​

Chapter 14: Hardening the Perimeter - Security and Compliance

​

1. VPC Service Controls (VPC SC): The Virtual Moat

​

The Service Perimeter with Access Context Manager

• Data Exfiltration Protection: Even if an attacker compromises a VM and gets hold of a service account key, VPC SC prevents them from copying data from your BigQuery table to an external bucket if that bucket is outside the perimeter.
• Service-to-Service Protection: It ensures that only authorized resources inside the perimeter can talk to each other.
• Access Context Manager: You can define “Access Levels” based on IP addresses, user identity, or device health (e.g., “Allow access only if the user is on a company-managed laptop with an encrypted disk”).

name: accessPolicies/12345678/accessLevels/corporate_devices
title: "Corporate Managed Devices Only"
basic:
  conditions:
    - devicePolicy:
        requireScreenlock: true
        requireAdminApproval: false
        allowedEncryptionStatuses:
          - ENCRYPTED
        allowedDeviceManagementLevels:
          - COMPLETE
        osConstraints:
          - osType: DESKTOP_WINDOWS
            minimumVersion: "10.0.19041"  # Windows 10 version 2004+

​

2. Sensitive Data Protection (Cloud DLP)

​

Discovery and De-identification

• Inspection: Automatically scan buckets, BigQuery tables, and Datastore instances for over 150 built-in infoTypes (Credit card numbers, SSNs, passports).
• De-identification:
  • Masking: Replacing 1234-5678 with XXXX-XXXX.
  • Tokenization: Replacing sensitive data with a cryptographically secure token.
  • Bucketing: Changing “Age: 27” to “Age: 20-30” to preserve privacy while maintaining analytical value.

​

3. Cloud KMS: Managing the Keys to the Kingdom

​

Key Types and Tiers

• Software Keys: Fast and cost-effective, managed by Google.
• HSM (Hardware Security Module): Keys are stored on physical FIPS 140-2 Level 3 validated hardware. The raw key never leaves the hardware.
• External Key Manager (EKM): You store your keys on-premise or in a 3rd party vault (like Thales or Fortanix), and Google Cloud calls your vault every time it needs to encrypt/decrypt. You have ultimate control—if you pull the plug on your vault, Google can no longer read your data.

​

4. Security Command Center (SCC)

• Event Threat Detection: Scans your Cloud Audit Logs for signs of account hijacking, brute force attacks, or suspicious IAM changes.
• Container Threat Detection: Detects malicious activity inside your GKE containers, such as the execution of unauthorized binaries or reverse shells.
• Compliance Monitoring: Provides real-time reports on how your infrastructure aligns with industry standards like CIS, PCI-DSS, and HIPAA.

​

5. Identity-Aware Proxy (IAP) and Zero Trust

• Context-Aware Access: Access is granted based on the user’s identity and the “context” of their request (location, device security, etc.).
• IAP TCP Forwarding: Allows you to SSH into a VM that has no public IP address. You connect to the IAP tunnel, which then securely forwards your traffic to the internal VM.

​

6. Secret Manager

• Version Control: Rotate secrets easily by adding new versions and letting applications always pull the latest version.
• IAM-Integrated: Grant access to specific secrets only to the service accounts that need them.

​

7. Advanced Perimeter Defense: IAP and SCC

​

7.1 IAP TCP Forwarding

• How it works: You connect to the IAP service endpoint. IAP verifies your IAM identity and the context of your request. If authorized, it creates a tunnel into your VPC and delivers the traffic to the VM’s internal IP.
• Command: gcloud compute ssh [VM_NAME] --tunnel-through-iap.

​

7.2 Security Command Center (SCC) Premium

• Event Threat Detection: Scans logs for brute-force attacks and account hijacks.
• Container Threat Detection: Detects unauthorized binary execution inside your GKE pods.
• Virtual Machine Threat Detection: Scans VM memory for signs of malware (cryptominers, rootkits) without needing an agent.

​

8. Interview Preparation

• Software Keys: Cryptographic keys are stored and managed in a Google-managed software environment. They are cost-effective and fast.
• HSM Keys: Keys are stored on Hardware Security Modules (FIPS 140-2 Level 3 validated). The raw key material never leaves the hardware. This is a requirement for high-compliance industries (Banking, Government) that need physical separation of keys.

• Masking: Replacing part of the data (e.g., 4532-XXXX).
• Tokenization: Replacing sensitive data with a surrogate “token.”
• K-Anonymity (Bucketing): Generalizing data (e.g., changing “Age 27” to “Age 20-30”) so that individuals cannot be re-identified in a dataset.

• Disable External IPs: Preventing any VM in the company from having a public IP.
• Restrict Resource Usage: Only allowing specific machine types or regions.
• Enforce Shielded VMs: Requiring all GCE instances to use boot integrity checks. It prevents “Configuration Drift” and human error across thousands of projects.

​

Implementation: The “Security Officer” Lab

​

Protecting a BigQuery Dataset with VPC Service Controls

# 1. Create an Access Level (Allow only from a specific CIDR)
# (Done via Access Context Manager in the Console)

# 2. Create a Service Perimeter
# Include your Project and the BigQuery API in the perimeter.

# 3. Test Exfiltration
# Try to run a query that exports data to a bucket in a DIFFERENT project.
# VPC SC will block this even if you are the Project Owner!

# 4. Use DLP to De-identify a Column in BigQuery
# Create a DLP Job to scan a table and mask the 'credit_card' column.

​

Pro-Tip: The “Organization Policy” Service