1. 1 - Cloud Governance
   1. Ideal State
      1. Automated, governed infrastructure pipeline using Infrastructure as Code (IaC)
   2. Components
      1. Best practices for accounts and organizations
      2. Landing zone design in Google Cloud
      3. Resource Manager
         1. IAM and Org policies are inherited from parent Org/folders.
      4. Policies
         1. Organizational policies
            1. Why these should be used
            2. Preventative Guardrails
            3. Set policies that restrict or enforce resource configurations
            4. eg: VM’s must not have public Ips
            5. eg: Buckets must be provisioned in US-West1
            6. Identity Agnostic
            7. Applies to all users
            8. Platform-level Enforcements
            9. Enforced regardless if entry point is Cloud Console, GCloud, or API
            10. Config-rime Enforcement
            11. Majority of enforcement done during config-time
            12. Config-time policies are non-retroactive
            13. Existing workloads won’t suddenly break
            14. Built-in Constraints
            15. Constraints are available in the platform and currently not extensible
            16. Foundational Set
            17. Prevent access to Google Cloud services except from managed identities in domains allow
            18. Enforce Public Access Prevention
            19. Domain restricted sharing
            20. Domain restricted contacts
            21. Enforce uniform bucket-level access
            22. Require OS Login
            23. Enforce additional security policies for service accounts
            24. Disable service account key creation
            25. Disable Automatic IAM Grants for Default Service Accounts
            26. Disable Service Account Key Upload
            27. Prevent the creation of less secure VPC network configurations
            28. Disable VM serial port access
            29. Restrict shared VPC project lien removal
            30. Define allowed external IPs for VM instances
            31. Skip default network creation
            32. Sets the internal DNS setting for new projects to Zonal DNS Only
            33. Restrict Public IP access on Cloud SQL instances
            34. Restrict Authorized Networks on Cloud SQL instances
            35. Restrict Protocol Forwarding Based on type of IP Address
            36. Disable VPC External IPv6 usage
            37. Disable VM nested virtualization
            38. New default org policies for new Organizations created after Feb 13 2024
            39. Disable Service Account key creation
            40. Prevent users from creating persistent keys for Service Accounts.
            41. Decreases the risk of exposed Service Account credentials.
            42. Disable Service Account key upload
            43. Prevent the upload of external public keys to Service Accounts.
            44. Decreases the risk of exposed Service Account credentials.
            45. Disable automatic IAM grants for default Service Accounts
            46. Prevent default Service Accounts from receiving the overly-permissive IAM role Editor at creation.
            47. The Editor role lets the Service Account create and delete resources for most Google Cloud services, which creates a vulnerability if the Service Account gets compromised.
            48. Enforce Domain Restricted Sharing
            49. Limit IAM policies to only allow managed user identities in selected domain(s) to access resources inside this Organization.
            50. Leaving the Organization open to access by actors with domains other than the customers’ own creates a vulnerability.
            51. Allow only domain restricted contacts
            52. Limit Essential Contacts to only allow managed user identities in selected domain(s) to receive platform notifications.
            53. A bad actor with a different domain might get added as an Essential Contact, leading to a compromised security posture.
            54. Enforce uniform bucket-level access
            55. Prevent GCS buckets from using per-object ACL (a separate system from IAM policies) to provide access.
            56. Enforces consistency for access management and auditing.
            57. Set the internal DNS setting for new projects to zonal DNS only.
            58. Set guardrails that application developers cannot choose legacy DNS settings for Compute instances.
            59. Legacy DNS settings (global) have lower service reliability than modern DNS settings (zonal).
            60. Crating & managing custom constraints
            61. Specific guidance (Section 4.3 has 18+ recommended policies to consider)
            62. Additional Policy Controls (Specific guidance from Section 4.4)
            63. Limit session and gcloud timeouts
            64. Disable Cloud Shell
            65. Use phishingresistant security keys
            66. Enable access transparency
            67. Enable access approval
            68. Setup Trusted Images project
            69. Manage Compute Engine resources using custom constraints
         2. Policy Intelligence
            1. IAM Recommender (ML used to help achieve least privilege)
            2. Policy Troubleshooter (Why principal doesn't have access?)
            3. IAM Policy Analyzer (Who has access to what?)
            4. Org Policy Analyzer
            5. Policy Simulator (Simulate before breaking app/process)
         3. Not just IaC, but also Policy as Code
            1. Declarative
            2. Validate
            3. Automate
            4. Roll back
            5. Scale
      5. VPC Service Controls
         1. Benefits
            1. Mitigate data exfiltration risks
            2. Keep data private inside the VPC
            3. Deliver independent data access controls
         2. Features
            1. Coverage of services
            2. VPC SC offers broad coverage of internet to service, service to service, VPC to service access controls.
            3. Rich security logging
            4. Maintain an ongoing log of access denials to spot potential malicious activity on Google Cloud resources. Flow logs capture information about the IP traffic going to and from network interfaces on Compute Engine. The logs provide near real-time visibility.
            5. Support for hybrid environments
            6. Configure private communication to cloud resources from VPC networks that span cloud and on-premises hybrid deployments using Private Google Access.
            7. Secure communication
            8. Securely share data across service perimeters with full control over what resource can connect to others or to the outside.
            9. Context-aware access
            10. Control access to Google Cloud services from the internet based on context-aware access attributes like IP address and a user’s identity.
            11. Perimeter security for managed Google Cloud services
            12. Configure service perimeters to control communications between virtual machines and managed Google Cloud resources. Service perimeters allow free communication within the zone and block all service communication outside the perimeter.
         3. Use cases
            1. Mitigate threats such as data exfiltration
            2. VPC Service Controls allow customers to address threats such as data theft, accidental data loss, and excessive access to data stored in Google Cloud multi-tenant services. It enables clients to tightly control what entities can access what services in order to reduce both intentional and unintentional losses.
            3. Isolate parts of the environment by trust level
            4. VPC Service Controls delivers a method to segment the multi-tenant services environment and isolate services and data. It enables environment micro-segmentation based on service and identity. Service Controls enables clients to extend their networks to include multi-tenant Google Cloud services and control egress and ingress of data.
            5. Secure access to multi-tenant services
            6. VPC Service Controls delivers zero-trust style access to multi-tenant services. Clients can restrict access to authorized IPs, client context, and device parameters while connecting to multi-tenant services from the internet and other services. Examples include GKE, BigQuery, etc. It enables clients to keep their entire data processing pipeline private.
         4. Visual Example
            1. (Google Cloud official youtube video link)
      6. Notifications
         1. Contacts & Notifications
         2. Audit Logging
         3. Billing Alerts
      7. Assured Workloads
         1. Data residency
            1. To help comply with data residency requirements, Google Cloud gives you the ability to control the regions where data at rest is stored.
            2. During Assured Workloads setup, you create an environment and select your compliance program. When you create resources in the environment, Assured Workloads restricts the regions you can select for those resources based on the compliance program you chose using Organization Policy.
         2. Cryptographic control over data access
            1. Google Cloud applies encryption at rest and in transit by default. To gain more control over how data is encrypted, Google Cloud customers can use Cloud Key Management Service to generate, use, rotate, and destroy encryption keys according to their own policies.
            2. Cryptographic control over data access is achieved through the use of Key Access Justifications (KAJ) together with our Cloud External Key Manager (EKM).
            3. Assured Workloads configures the appropriate encryption services per workload depending on the compliance program you chose.
         3. Assured Support
            1. Regulated customers’ compliance obligations extend to support services. Assured Support is a value-added service to Premium or Enhanced Support to ensure only Google support personnel meeting specific geographical locations and personnel conditions support their workload when raising a support case or needing technical assistance.
            2. By delivering the same features and benefits of Premium or Enhanced Support (including response times) with an added layer of controls and transparency, Assured Support helps customers meet compliance requirements without compromising on the level and quality of support.
         4. Assured Workloads monitoring
            1. Assured Workloads monitoring scans your environment in real time and provides alerts whenever organization policy changes violate the defined compliance posture. The monitoring dashboard shows which policy is being violated and provides instructions on how to resolve the finding.
         5. Assured Workloads Quick Start Guide
      8. Specific Frameworks
         1. FedRamp implementation guide
         2. PCI DSS
            1. Limiting scope of compliance for PCI environments in Google Cloud
            2. PCI Data Security Standard compliance
            3. PCI DSS compliance on GKE
            4. Security blueprint: PCI on GKE
            5. Tokenizing sensitive cardholder data for PCI DSS
      9. Active Assist portfolio
         1. Cost
            1. VM machine type recommender
            2. Committed use discount recommender
            3. Idle VM recommender
            4. Cloud SQL overprovisioned instance recommender
         2. Security
            1. IAM recommender
            2. Firewall insights
            3. Cloud Run recommender
         3. Performance
            1. VM machine type recommender
            2. Managed instance group machine type recommender
         4. Reliability
            1. Compute Engine predictive autoscaling
            2. Cloud SQL out-of-disk recommender
            3. Policy Troubleshooter
            4. Policy Analyzer
         5. Manageability
            1. Network Intelligence Center
            2. Product suggestion recommender
            3. Policy Simulator
         6. Sustainability
            1. Unattended project recommender
      10. Access Transparency and Access Approval
          1. Customer data is not accessed for any reason other than to fulfill contractual obligations
          2. Valid business justification required for any access by support or engineering personnel
          3. Near real-time logs offer insight when Google Cloud administrators access your content
          4. Approve or dismiss requests for access by Google employees working to support your service
      11. Audit Manager (Private Preview)
2. 2- Identity and Access Management
   1. Ideal State
      1. Unified, federated identity. Least privilege policies based on user/service, role, resource, condition.
      2. Only short-term credentials - for everything, everywhere.
   2. Components
      1. Identities in Google Cloud
         1. Google Cloud Identity
         2. Best practices for federating Google Cloud with an external identity provider
         3. Workforce Identity Federation
         4. Workload Identify Federation
         5. Manage just-in-time privileged access to projects
      2. MFA/2FA/2SV for admin accounts
         1. Hardware Keys (prefered)
      3. Least-privilege roles & permissions
         1. IAM Policy Intelligence
            1. Troubleshooter
            2. Simulator
            3. Recommender
            4. Analyzer
      4. Service Accounts
         1. When to use service accounts
         2. 4-min video
         3. Best practices for managing Service Account Keys
            1. Provide alternatives to creating service account keys.
            2. Use organization policy constraints to limit which projects can create service account keys.
            3. Don't leave service account keys in temporary locations.
            4. Don't pass service account keys between users.
            5. Don't submit service account keys to source code repositories.
            6. Don't embed service account keys in program binaries.
            7. Use insights and metrics to identify unused service account keys.
            8. Rotate service account keys to reduce security risk caused by leaked keys.
            9. Use uploaded keys to let keys expire automatically.
         4. Best Practices for using service accounts
         5. Best practices for using service accounts in pipelines
         6. Migrate away from service account keys
            1. Assess: In this phase, you assess your existing environment to understand where service account keys exist and whether the keys are in use.
            2. Plan: In this phase, you decide which controls you will eventually deploy and communicate the migration plan to stakeholders.
            3. Deploy: In this phase, you begin refactoring workloads to authenticate with more secure alternatives to service account keys. You also build additional capabilities to continuously monitor your environment and mitigate future risk.
      5. Identity Aware Proxy (IAP) (leverage identity instead of network access)
         1. Common proxies
            1. App Engine
            2. Cloud Run
            3. Compute Engine
            4. GKE
            5. On-premises
         2. Overview of TCP forwarding
            1. IAP for TCP forwarding (enable admin access to VM's without external IP address or no direct Internet access)
            2. Secure IAP for TCP forwarding with VPC Service Controls
         3. Can be extended with access levels (Access Context Manager)
         4. IAP Best Practices
         5. Leveraging external identities
            1. Email/password
            2. OAuth (Google, Facebook, Twitter, GitHub, Microsoft, etc.)
            3. SAML
            4. OIDC
            5. Phone number
            6. Custom
            7. Anonymous
      6. Access Context Manager
         1. Create access levels for projects and resources
            1. Permit access based on contextual information about the request
         2. Methods
            1. Basic
            2. Collection of conditions
            3. Custom (Google Workspace Premium)
            4. Created using Common Expression Language
         3. Conditions
            1. IP subnetworks (excludes private IP ranges)
            2. Geographic locations
            3. Device policy/ endpoint verification (Google Workspace Premium)
            4. Supported computers
            5. Apple Mac OS X El Capitan (10.11) and later
            6. Devices running ChromeOS 110 and later
            7. Linux Debian and Ubuntu
            8. Note: CPU must support AES instructions.
            9. Microsoft Windows 10 and 11
            10. Criteria
            11. Screen lock
            12. Require admin approval
            13. Require corp owned device
            14. Storage encryption
            15. Operating system policy
            16. Access level dependencies
         4. Leveraged with the following GCP services
            1. VPC Service Controls
            2. Identity-Aware Proxy
            3. Context-Aware Access for Google Workspace
            4. Identity and Access Management (IAM) conditions
      7. Context Aware Access (Google Workspace)
         1. Allow access to apps only from company-issued devices
         2. Allow access to Drive only if a user storage device is encrypted
         3. Restrict access to apps from outside the corporate network
      8. Best practices for securing SSH access to VM instances
      9. Leverage OS Login to manage instances
         1. short video
         2. Setup OS Login
         3. Enforce OS Login at org level
      10. Troubleshooting access problems on Google Cloud
      11. Identity Platform (authenticate users to apps and services)
3. 3 - Logging & Monitoring
   1. Ideal State
      1. Aggregated platform, system, and audit logs.
   2. Components
      1. Log types
         1. Admin Activity Audit Logs
         2. Data Access Audit Logs
         3. Access Transparency Logs & Access Aproval
            1. Enabling Access Transparency
      2. Architecture
      3. Cloud Logging
      4. Log Analytics
      5. Cloud Monitoring
      6. FinOps
      7. Logging best practices
      8. Four steps to managing your Cloud Logging costs on a budget
4. 4 - Security Operations
   1. Ideal State
      1. Continuosly detect and act on vulnerabilities, threats, & misconfigurations.
   2. Components
      1. Native Cloud Signals & Alerts
         1. Security Command Center
            1. Features
            2. Attack path simulation
            3. Duet AI
            4. Cloud Asset Inventory
            5. Supported Asset Types
            6. Services
            7. Web Security Scanner
            8. Overview
            9. OWASP Top 10
            10. Scans
            11. Custom Scans
            12. Managed Scans
            13. Finding Types
            14. Best Practices
            15. Findings
            16. Security Health Analytics
            17. Using SHA
            18. Detectors
            19. Findings
            20. Remediating Security Health Analytics findings
            21. Event Threat Detection
            22. Overview
            23. Using ETD
            24. Log Scoping Tool
            25. Rules
            26. Container Threat Detection
            27. Overview
            28. Using CTD
            29. Detectors
            30. Testing CTD
            31. Virtual Machine Threat Detection
            32. Overview
            33. Using VMTD
            34. Findings
            35. Google internal feeds
            36. Anomaly Detection
            37. Cloud Armor
            38. Security Command Center findings
            39. Data Loss Prevention
            40. Send Cloud DLP scan results to Security Command Center
            41. VM Manager
            42. Pricing
            43. Findings
            44. Vulnerability reports
            45. Secured Landing Zone
            46. Overview
            47. Using SLZ
            48. Remediating SLZ Findings
            49. Findings
            50. Environmental Findings
            51. Behavioral Findings
            52. Stateful findings
            53. Compliance
            54. CIS Benchmarks
            55. Additional standards
            56. Using the Compliance dashboard
            57. Third Party Services
            58. Forseti Security
            59. Notifications
            60. Get Help
            61. GitHub
            62. About
            63. Ansible
            64. Tenable
            65. McAfee
            66. Prisma Cloud
            67. Qualys
            68. Acalvio
            69. Capsule8
            70. SysDig
            71. CrowdStrike
            72. Chef
            73. Security sources
            74. Cloud-native application protection platforms (CNAPP)
            75. Cloud Security Posture Management (CSPM)
            76. Vulnerabilities
            77. Web Security Scanner
            78. Security Health Analytics
            79. VM Manager
            80. Cloud Workload Protection Platform (CWPP)
            81. Threats
            82. Anomaly Detection
            83. Container Threat Detection
            84. Data Loss Prevention
            85. Event Threat Detection
            86. Forseti Security
            87. Virtual Machine Threat Detection
            88. Errors
            89. Inadvertent actions
            90. Integrations
            91. API
            92. Risk Manager
            93. Remediate findings
            94. Manage Reports
            95. Big Query
            96. SIEM/SOAR
            97. Cortex XSOAR
            98. Elastic Stack
            99. Elastic Stack via Docker
            100. Splunk
            101. QRadar
            102. Chronicle
            103. Investigate findings in Chronicle
            104. Using Security Command Center
            105. Access Control
            106. Security Marks
            107. Configuration
            108. Mute Rules
            109. Dashboard
            110. Exporting Data
            111. One-time exports
            112. Continuous Exports
            113. Enable finding notifications for Pub/Sub
            114. Export findings to BigQuery for analysis
            115. Installing Security Command Center tools
            116. Investigating and responding to threats
            117. Enabling real-time email and chat notifications
            118. Documentation
            119. Evaluation Guide
            120. Pricing
            121. Release Notes
            122. Latency
            123. Support
            124. Training
            125. Qwiklabs
            126. Securing Web Applications with Web Security Scanner
            127. Getting Started with Security Command Center - YouTube Playlist
            128. Quickstarts
            129. Set up Security Command Center
            130. Optimize Security Command Center
            131. How do I detect malicious activity in my Google Cloud environment?
            132. Improve cloud security posture guide
            133. Optimize Securitiy Command Center
      2. Respond to security & governance issues
         1. Chronicle Suite (SIEM & SOAR)
            1. Why Chronicle?
            2. Integration into Enterprise SOC Ecosustems
            3. Case Management
            4. Playbooks
            5. Investigation
            6. Threat Intel Platform
            7. Collaboration
            8. Crisis Management
            9. Business Intelligence
            10. All your data - fast!
            11. Hunt for threats 90% faster than traditional SOC tools
            12. Detect by correlating petabytes of your telemetry and identity malicious activity/patters
            13. DNS
            14. Vulnerability data
            15. Cloud data
            16. Threat Intel
            17. EDR/XDR
            18. Authentication
            19. Identity
            20. Firewalls
            21. VPN
            22. Network
            23. Intelligent Data Fusion
            24. Unified data model
            25. Rich, extensible data model spanning Asset, User and IoC dimensions and attributes
            26. IP to host correlation
            27. Automated IP to host correlation enables instant asset and IoC analytics
            28. Canonical event deduplication
            29. Logical event layer (user logins, network connections etc.) and visualization simplifies and expedites analysis
            30. At a disruptive cost
            31. Eliminate the tradeoffs between cost and security with fixed and predictable pricing that is decoupled from capacity, compute and log source count.
            32. SecOps Services
            33. Solutions
            34. SecOps Transformation
            35. SIEM Augmentation
            36. Cloud Detection & Response
            37. Service Providers
            38. Knowledge base
            39. Data Sheets
            40. Chronicle SIEM
            41. Chronicle SOAR
            42. Blogs
            43. Case Studies
            44. Third-party Reports
         2. DIY / manual
            1. SCC + Cloud Logging
            2. Pub/Sub
            3. Cloud Functions
      3. Be prepared with best of breed
         1. Mandiant
            1. Mandiant Advantage Platform
            2. Threat Intelligence (know who's targeting you)
            3. What are the threats and how I detect them?
            4. How do threats affect me?
            5. How do I use threat intelligence effectively?
            6. Attack Surface Management (know what is exposed on the Internet)
            7. Identify and remove sprawl
            8. Reduce software and cloud risk
            9. Monitor and Enforce security policies
            10. Security Validation (know if you're prepared)
            11. Are we prepared?
            12. Proactive Security Validation
            13. Validation as a service
            14. Managed or co-managed validation
            15. Prioritize, Measure, Optimize, Rationalize, Monitor
            16. Alert Investigation and Prioritization (formerly Automated Defense)
            17. Alert Investigation and Prioritization
            18. Managed Defense
            19. 24/7 monitoring
            20. Attacker behavior investigation & analysis
            21. Advanced Detection & Hunting
            22. Response & Remediation
            23. Breach Analytics for Chronicle (are we compromised?)
            24. Consulting Services
            25. Incident Response
            26. Incident Response Service
            27. Incident Response Retainer
            28. Compromise Assessment
            29. Cyber Defense Assessment
            30. Ransomware
            31. Ransomware Defense Assessment
            32. Red Team for Ransomware
            33. Purple Team for Ransomware
            34. Tabletop Exercise
            35. Threatspace Cyber Range Simulation Exercise
            36. Risk Management
            37. Cyber Security Due Diligence
            38. Cyber Security Program Assessment
            39. Cyber Risk Management Operations
            40. Crown Jewels Assessment
            41. Threat and Vulnerability Assessment
            42. Threat Modeling Security Service
            43. Targeted Attack Testing
            44. Red Team Assessment
            45. Purple Team Assessment
            46. Continuous Purple Team Assessment
            47. Tabletop Exercise
            48. Embedded Device Assessment
            49. Penetration Testing
            50. Red Team – TIBER-EU
            51. ThreatSpace Cyber Range Simulation Exercise
            52. Cyber Security Transformation
            53. Cyber Defense Center Development
            54. Cyber Defense Operations
            55. Threat Intelligence, Threat Hunting and Incident Response Training
            56. Identity-First Security
            57. Insider Threat Assessment
            58. Insider Threat as a Service
            59. Remote Security Assessment
            60. Active Directory Assessment
            61. Penetration Testing for Internal Attacks
            62. Penetration Testing for Social Engineering
            63. Industrial Control Systems (ICS) & Operational Technology (OT)
            64. Explore all OT/ICS Solutions
            65. Industrial Control Systems (ICS) Healthcheck
            66. Penetration Testing for ICS
            67. Penetration Testing for Embedded/IoT
            68. Cloud Security
            69. Cloud Security Assessments
            70. Microsoft Office 365 Assessment
            71. Cloud Architecture Assessment: Azure, AWS, GCP
            72. Cloud Penetration Testing
            73. Cyber Security Due Diligence
            74. Cyber Security Due Diligence
            75. Penetration Testing for Web Applications
            76. Penetration Testing for Mobile
            77. Penetration Testing for Wireless
            78. Penetration Testing for Physical Security
            79. Threat Intelligence Services
            80. Applied Intelligence
            81. Cyber Threat Profile
            82. Intelligence Capability Development
            83. Executive Intelligence Briefings
            84. Mandiant Resources
            85. Blog
            86. Customer Stories
            87. Webinars
            88. Events
            89. Datasheets
            90. White Papers
            91. Podcasts
            92. Reports
            93. Cyber Security forecast 2023
            94. Global Perspectives on Threat Intelligence Report
            95. Insights
            96. Infographics
            97. eBooks
            98. Mandiant Academy
            99. Course Catalog
            100. Introductory Courses
            101. Introduction to Cyber Crime for Executives
            102. Cyber Security Awareness
            103. Fundamentals of Industrial Control Systems (ICS) Security
            104. Fundamentals of Cyber Security
            105. Cyber Security Policy and Implementation
            106. Audits and Compliance in the Cyber Domain
            107. Introduction to the Mandiant Security Instrumentation Platform
            108. Intelligence and Attribution Courses
            109. Introduction to Threat Intelligence and Attribution
            110. Cyber Intelligence Foundations
            111. Intelligence Research I—Scoping
            112. Intelligence Research II—Open Source Intelligence (OSINT)
            113. Cyber Intelligence Production
            114. Incident Response Courses
            115. Incident Response for Everyone
            116. Windows Enterprise Incident Response
            117. Linux Enterprise Incident Response
            118. Combined Windows-Linux Enterprise Incident Response
            119. Network Traffic Analysis
            120. Practical Threat Hunting
            121. Digital Forensics and Incident Response for PLCs
            122. Malware Analysis Courses
            123. Malware Analysis Fundamentals
            124. Malware Analysis Crash Course
            125. Malicious Documents Analysis
            126. Advanced Red Teaming Techniques: Malware Authoring and Repurposing
            127. Malware Analysis Master Course
            128. Advanced Acquisition and Testing Techniques Courses
            129. Creative Red Teaming
            130. Practical Mobile Application Security
            131. Workshops
            132. Business Email Compromise
            133. Exercises and Preparedness
            134. ThreatSpace: Real-World Attack Scenarios
            135. Senior Executive Mentorship Program
            136. Upcoming Public Courses
            137. On-Demand Courses
            138. Mandiant Certifications
            139. ThreatSpace Cyber Range
      4. BeyondCorp & Zero Trust
         1. BeyondCorp Access in one minute
         2. Operate with Zero Trust using BeyondCorp Enterprise
         3. Context-aware access
         4. BeyondCorp Alliance
         5. Additional references
            1. An overview: "A New Approach to Enterprise Security"
            2. How Google did it: "Design to Deployment at Google"
            3. Google's frontend infrastructure: "The Access Proxy"
            4. Migrating to BeyondCorp: "Maintaining Productivity while Improving Security"
            5. The human element: "The User Experience"
            6. Secure your endpoints: "Building a Healthy Fleet"
      5. Security Partners
         1. Ecosystem
         2. Infrastructure Protection
            1. Next-gen firewalls
            2. Web application firewalls (WAFs)
            3. Web proxies and cloud gateways
            4. Server endpoint protection
            5. DDoS protection
            6. Container security
         3. Data Protection
            1. Encryption and key management
            2. Data/information loss protection
         4. Logging and monitoring
            1. Logging and monitoring
            2. Configuration, vulnerability, risk, and compliance
         5. Configuration, vulnerability, risk, and compliance
            1. Vulnerability scanners
            2. Governance, risk management, and compliance
5. 5 - Data Protection
   1. Ideal
      1. Identify and protect your most important data.
   2. Components
      1. Data Security Guidance
      2. Encryption of data at rest
         1. Default Encryption
            1. Enabled by default - Google manages encryption keys
         2. Cloud KMS
            1. Customer can manage their own keys, hosted by Google
         3. Cloud HSM
            1. Customer can manage their own keys, hosted by Google on a dedicated hardware module
         4. Cloud EKM
            1. Customer manages & hosts their own keys externally from Google
         5. Sensitive Data Protection (includes Data Loss Prevention)
            1. Features
            2. API Driven & GCP Console
            3. Cover use cases anywhere, on or off cloud with the DLP API
            4. De-identification, masking, tokenization, and bucketing
            5. Powerful and flexible masking of your AI/ML workloads
            6. Streaming content API
            7. Automated sensitive data discovery and classification (for BigQuery)
            8. Sensitive data intelligence for security assessments
            9. Results can be imported into BigQuery for analysis or imported into other systems
            10. With direct feeds into Chronicle and Security Command Center, you can leverage sensitive data intelligence to reduce noise and prioritize threats, vulnerabilities, and security investigations.
            11. Inspection/Analysis
            12. Learn about your data
            13. Discovery/data profiling (for BigQuery)
            14. Get continuous visibility into all your sensitive data.
            15. Deep inspection
            16. Inspect your data in storage systems exhaustively and investigate individual findings.
            17. Risk Analysis (for BigQuery)
            18. Process of analyzing sensitive data to find properties that might increase the risk of subjects being identified
            19. Sensitive information about individuals being revealed
            20. Help determine effective de-identification strategy
            21. Help monitor for any changes or outliers, after de-identification
            22. Methods
            23. Content (streaming data)
            24. Leveraging the DLP API
            25. InspectContent
            26. DeidentifyContent
            27. ReidentifyContent
            28. RedactImage
            29. OUTPUT:
            30. Inspection Findings
            31. De-Id transformed content
            32. Storage (Native GCP sources)
            33. Shards data and works in parallel
            34. Cloud Storage
            35. BigQuery
            36. Datastore
            37. Hybrid (streaming data)
            38. Hybrid jobs and job triggers (requires custom application)
            39. Other cloud providers
            40. On-premises servers or other data repositories
            41. Non-native storage systems, such as systems running inside a virtual machine
            42. Web and mobile apps
            43. Google Cloud-based solutions
            44. Workflow
            45. You write a script or create a workflow that sends data to Sensitive Data Protection for inspection along with some metadata.
            46. You configure and create a hybrid job resource or trigger and enable it to activate when it receives data.
            47. Your script or workflow runs on the client side and sends data to Sensitive Data Protection in the form of a hybridInspect request. The data includes an activation message and the job or job trigger's identifier, which triggers the inspection.
            48. Sensitive Data Protection inspects the data according to the criteria you set in the hybrid job or trigger.
            49. Sensitive Data Protection saves the results of the scan to the hybrid job resource, along with metadata that you provide. You can examine the results using the Sensitive Data Protection UI in Google Cloud console.
            50. Optionally, Sensitive Data Protection can run post-scan actions, such as saving inspection results data to a BigQuery table or notifying you by email or Pub/Sub.
            51. Supported actions
            52. Save findings to Sensitive Data Protection and Save findings to BigQuery
            53. Send Pub/Sub
            54. Send Email
            55. Publish to Cloud Monitoring
            56. Actions from inspection results
            57. On-demand vs continuous profiling
            58. Discovery (continuous profiling)
            59. BigQuery
            60. BigLake
            61. On-demand inspection
            62. BigQuery
            63. Cloud Storage
            64. Datastore
            65. Hybrid
            66. How (Inspection template)
            67. InfoTypes
            68. Built-in (150+)
            69. Country, region-specific sensitive data types
            70. Globally applicable data types
            71. Custom
            72. Regular dictionary detectors
            73. Stored dictionary detectors
            74. Regular expression (regex)
            75. Inspection Rules
            76. Fine-tune
            77. Exclusion rules
            78. Hotword rules
            79. Likelihood Value
            80. Likelihood Unspecified
            81. Very Unlikely
            82. Unlikely
            83. Possible
            84. Likely
            85. Very Likely
            86. Protection/De-Identification
            87. De-identification techniques
            88. Redaction: Deletes all or part of a detected sensitive value.
            89. Replacement: Replaces a detected sensitive value with a specified surrogate value.
            90. Masking: Replaces a number of characters of a sensitive value with a specified surrogate character, such as a hash (#) or asterisk (*).
            91. Crypto-based tokenization: Encrypts the original sensitive data value using a cryptographic key. Sensitive Data Protection supports several types of tokenization, including transformations that can be reversed, or "re-identified."
            92. Bucketing: "Generalizes" a sensitive value by replacing it with a range of values. (For example, replacing a specific age with an age range, or temperatures with ranges corresponding to "Hot," "Medium," and "Cold.")
            93. Date shifting: Shifts sensitive date values by a random amount of time.
            94. Time extraction: Extracts or preserves specified portions of date and time values.
            95. De-identify examples
            96. De-identify data stored in Cloud Storage
            97. De-identify data from any source
            98. De-identify BigQuery data at query time
            99. De-identification and re-identification of PII in large-scale datasets in Cloud Storage
            100. Redact sensitive data from PDF files
            101. Use Sensitive Data Protection with AWS S3
            102. How (De-identification template)
            103. Resources
            104. Documentation
            105. How-to guides
            106. "Traditional" DLP via BeyondCorp Enterprise
            107. Implement DLP with Chrome
            108. Uploads
            109. Downloads
            110. Content copied and pasted
            111. Content dragged and dropped
            112. 90+ content detectors
            113. Visual
      3. Sensitive Data Protection (includes Data Loss Prevention)
         1. 1) Understand/Inspection/Analysis
            1. Learn about your data
            2. Discovery/data profiling
            3. Get continuous visibility into all your sensitive data.
            4. BigQuery - GA
            5. BigLake - GA
            6. Cloud SQL - Preview
            7. Deep inspection
            8. Inspect your data in storage systems exhaustively and investigate individual findings.
            9. Risk Analysis (for BigQuery)
            10. Process of analyzing sensitive data to find properties that might increase the risk of subjects being identified
            11. Sensitive information about individuals being revealed
            12. Help determine effective de-identification strategy
            13. Help monitor for any changes or outliers, after de-identification
            14. Report Credentials & Secrets to SCC
            15. detailed list
            16. Methods
            17. Content (streaming data)
            18. Leveraging the DLP API
            19. InspectContent
            20. DeidentifyContent
            21. ReidentifyContent
            22. RedactImage
            23. OUTPUT:
            24. Inspection Findings
            25. De-Id transformed content
            26. Storage (Native GCP sources)
            27. Shards data and works in parallel
            28. Cloud Storage
            29. BigQuery
            30. Datastore
            31. Hybrid (streaming data)
            32. Hybrid jobs and job triggers (requires custom application)
            33. Other cloud providers
            34. On-premises servers or other data repositories
            35. Non-native storage systems, such as systems running inside a virtual machine
            36. Web and mobile apps
            37. Google Cloud-based solutions
            38. Workflow
            39. You write a script or create a workflow that sends data to Sensitive Data Protection for inspection along with some metadata.
            40. You configure and create a hybrid job resource or trigger and enable it to activate when it receives data.
            41. Your script or workflow runs on the client side and sends data to Sensitive Data Protection in the form of a hybridInspect request. The data includes an activation message and the job or job trigger's identifier, which triggers the inspection.
            42. Sensitive Data Protection inspects the data according to the criteria you set in the hybrid job or trigger.
            43. Sensitive Data Protection saves the results of the scan to the hybrid job resource, along with metadata that you provide. You can examine the results using the Sensitive Data Protection UI in Google Cloud console.
            44. Optionally, Sensitive Data Protection can run post-scan actions, such as saving inspection results data to a BigQuery table or notifying you by email or Pub/Sub.
            45. Supported actions
            46. Save findings to Sensitive Data Protection and Save findings to BigQuery
            47. Send Pub/Sub
            48. Send Email
            49. Publish to Cloud Monitoring
            50. Actions from inspection results
            51. On-demand vs continuous profiling
            52. Discovery (continuous profiling)
            53. BigQuery
            54. BigLake
            55. On-demand inspection
            56. BigQuery
            57. Cloud Storage
            58. Datastore
            59. Hybrid
            60. How (Inspection template)
            61. InfoTypes
            62. Built-in (150+)
            63. Country, region-specific sensitive data types
            64. Globally applicable data types
            65. Custom
            66. Regular dictionary detectors
            67. Stored dictionary detectors
            68. Regular expression (regex)
            69. Inspection Rules
            70. Fine-tune
            71. Exclusion rules
            72. Hotword rules
            73. Likelihood Value
            74. Likelihood Unspecified
            75. Very Unlikely
            76. Unlikely
            77. Possible
            78. Likely
            79. Very Likely
         2. 2) Protect/De-Identification
            1. De-identification techniques
            2. Redaction: Deletes all or part of a detected sensitive value.
            3. Replacement: Replaces a detected sensitive value with a specified surrogate value.
            4. Masking: Replaces a number of characters of a sensitive value with a specified surrogate character, such as a hash (#) or asterisk (*).
            5. Crypto-based tokenization: Encrypts the original sensitive data value using a cryptographic key. Sensitive Data Protection supports several types of tokenization, including transformations that can be reversed, or "re-identified."
            6. Bucketing: "Generalizes" a sensitive value by replacing it with a range of values. (For example, replacing a specific age with an age range, or temperatures with ranges corresponding to "Hot," "Medium," and "Cold.")
            7. Date shifting: Shifts sensitive date values by a random amount of time.
            8. Time extraction: Extracts or preserves specified portions of date and time values.
            9. De-identify examples
            10. De-identify data stored in Cloud Storage
            11. De-identify data from any source
            12. De-identify BigQuery data at query time
            13. De-identification and re-identification of PII in large-scale datasets in Cloud Storage
            14. Redact sensitive data from PDF files
            15. Use Sensitive Data Protection with AWS S3
            16. How (De-identification template)
         3. 3) Resources
            1. Documentation
            2. How-to guides
            3. IAM roles required
         4. 4) "Traditional" DLP via BeyondCorp Enterprise
            1. Implement DLP with Chrome
            2. Uploads
            3. Downloads
            4. Content copied and pasted
            5. Content dragged and dropped
            6. 90+ content detectors
            7. Visual
      4. Google Secrets Manager
         1. Common use cases
            1. API Keys
            2. Certificates
            3. Private Keys
            4. Passwords
         2. Highlights
            1. Replication policies
            2. Secret names are project-global resources, but secret data is stored in regions. You can choose specific regions in which to store your secrets, or you can let us decide. Either way, we automatically handle the replication of secret data.
            3. First-class versioning
            4. Secret data is immutable and most operations take place on secret versions. With Secret Manager, you can pin a secret to specific versions like "42" or floating aliases like "latest."
            5. Cloud IAM integration
            6. Control access to secrets the same way you control access to other Google Cloud resources. Only project owners have permission to access Secret Manager secrets; other roles must explicitly be granted permissions through Cloud IAM.
            7. Audit logging
            8. With Cloud Audit Logs enabled, every interaction with Secret Manager generates an audit entry. You can ingest these logs into anomaly detection systems to spot abnormal access patterns and alert on possible security breaches.
            9. Encrypted by default
            10. Data is encrypted in transit with TLS and at rest with AES-256-bit encryption keys.
            11. VPC Service Controls support
            12. Enable context-aware access to Secret Manager from hybrid environments with VPC Service Controls.
            13. Powerful and extensible
            14. Secret Manager's API-first design makes it easy to extend and integrate into existing systems. It is also integrated into popular third-party technologies like HashiCorp Terraform and GitHub Actions.
         3. Best Practices
      5. BigQuery data security and governance
      6. Spanner Security
         1. Access Control
         2. Fine-grained access control
         3. Encryption
      7. Bigtable Security
         1. Authentication
         2. Access Control
         3. Create and manage tags
         4. Audit logging
         5. Encryption
6. GCP Security, Compliance, Governance, and Architecture resources
   1. Google Cloud Solutions Center
      1. Discoveries
         1. Cloud Capability Assessment
            1. The Cloud Capability Assessment helps determine where you are in your cloud journey and how you can develop new competencies across your business, financial and technology plans.
         2. AI Readiness Quick Check
            1. A quick assessment to understand an organization's AI capabilities across 6 pillars. Provide best practices and recommended learnings to advance the organization's AI practice.
         3. Security and Resilience Framework
            1. This discovery helps you evaluate your overall security maturity against five NIST functions: Identify, Protect, Detect, Respond and Recover. Use this discovery for recommendations on how to improve your security posture.
         4. Data Foundations for AI Benchmarking
            1. Help customers understand the robustness of their data analytics foundations and its readiness for AI adoption. The output of the assessment is a gap analysis of current data foundation capabilities with set of Google recommendations and PoV to create a transformational data platform.
         5. Cloud FinOps Assessment
            1. A cloud FinOps capability maturity assessment to help organizations better understand their cloud financial processes, culture, skillset, tooling, and technical competency. There are 13 questions which span the 5 pillars of cloud FinOps: 1. Accountability & Enablement, 2. Measurement & Realization, 3. Cost Optimization, 4. Planning & Forecasting, and 5. Tools & Accelerators. For each of the questions, the responses range between 1-5 with increasing maturity. If you have any issues taking the survey contact the Cloud FinOps team at pso-finops@google.com
         6. Partner Excellence Framework (PEF) - PreDelivery
            1. Partners can use the PreDelivery assessment before the delivery of the project has started. This assessment evaluates the technical readiness of the partner team for any project/workload on Google Cloud. The assessment report helps to identify and capture any potential gaps in architecture and provide prescriptive guidance aligned with Google Cloud architectural best practices to remediate those gaps. Additionally, the assessment also provides questions and assets that partners can use during the project discovery.
         7. Data & AI Cloud for Marketing - Benchmarking
            1. Understand your current marketing analytics capabilities to address the convergence of forces between shifting customer expectations and economic pressures putting more focus on growth and ROI of marketing activities.
         8. Data & AI Cloud for Supply Chain - Benchmarking
            1. A benchmarking survey to understand the critical capabilities required across Supply Chains to reduce risks & disruptions, and solving for resiliency and sustainability amidst global disruptions.
         9. Autonomic Security Operations
            1. Autonomic Security Operations is a stack of products, integrations, blueprints, technical content, and an accelerator program to enable customers to take advantage of our best-in-class technology stack built on Chronicle and Google’s deep security operations expertise.
         10. The Defender’s Advantage: Mandiant Cyber Defense
             1. Self-assessment of capabilities tied to the six critical functions of cyber defense as detailed in The Defender's Advantage by Mandiant including Intel, Command and Control, Hunt, Detect, Respond and Validate.
      2. Solutions
         1. (links in the solutions center)
   2. Google Cloud Architecture Center (Best Practices for Google Cloud)
      1. Google Cloud Architecture Framework
         1. Review shared responsibility and shared fate on Google Cloud
         2. Understand security principles
         3. Manage risks with controls
         4. Manage your assets
         5. Manage identity and access
         6. Implement compute and container security
         7. Secure your network
         8. Implement data security
         9. Deploy applications security
         10. Manage compliance obligations
         11. Implement data residency and sovereignty requirements
         12. Implement privacy requirements
         13. Implement logging and detective controls
      2. Enterprise foundations blueprint
      3. Google Cloud deployment archetypes
      4. Migrate to Google Cloud
         1. Assess and discover your workloads
         2. Build your foundation
         3. Transfer your large datasets
         4. Deploy your workloads
         5. Migrate from manual deployments to automated, containerized deployments
         6. Optimize your environment
         7. Best practices for validating a migration plan
         8. Minimize costs
      5. Hybrid and multicloud architecture guidance
      6. Migrate across Google Cloud regions
      7. GCP Architecture Guides
         1. GenAI-Vertex-workbench-security
         2. Network Firewall Microsegmentation
         3. Google Cloud Certificate Authority Service deployment
         4. Securing User Managed Vertex-AI Workbench
         5. Deploying IL4 Assured Workload
         6. Deploying Australia Regions with Assured Support Workload
         7. SCC Cryptomining Program
         8. Secure Web Proxy
   3. Security and resilience framework
   4. Landing zone design in Google Cloud
   5. Google Cloud Infrastructure Reliability Guide
   6. Google Cloud security foundations blueprint guide
   7. Best practices for cloud security products
      1. Anthos security blueprints
      2. Secured Data Warehouse security blueprint
      3. AI Platform Notebooks security blueprint
      4. Container security best practices
      5. Security best practice checklists (Google Workspace)
   8. Deployable security blueprints and landing zones
      1. Security foundations deployable assets
      2. Secured Data Warehouse blueprint GitHub repository
      3. AI Platform Notebooks blueprint GitHub repository
      4. Cloud Foundation Toolkit deployable assets
      5. Anthos security blueprints GitHub repository
   9. Security whitepapers and references
      1. Security transformation resources
         1. CISO’s guide to cloud security transformation
         2. Strengthening operational resilience for FinServ
         3. Building secure and reliable systems
         4. NEW! Risk governance of digital transformation
      2. Google Cloud security whitepapers
         1. Google security
         2. Google Workspace security
         3. Google infrastructure security design overview
         4. Encryption at rest
         5. Encryption in transit
         6. Google Workspace encryption
         7. Cloud Key Management (KMS) deep dive
         8. BeyondProd: New approach to cloud-native security
         9. Binary Authorization for Borg
         10. BeyondCorp: A new approach to enterprise security
         11. Privileged access management in GCP
   10. GCP Compliance resource center
       1. Data governance
          1. Data regions
       2. Data residency
          1. For European customers on Google Cloud
       3. Privacy Resource Center
          1. Cloud DPIA Resource Center
   11. Find a Google Partner
   12. Shared Fate Responsibility Model
   13. Security & Governance topics from our CISO (Phil Venables)
       1. Questions from CEO's and Boards
          1. Current Risk and Threat Outlook
             1. There's a lot going on in the world, can you give us a quick grand tour of the cyber threat landscape?
          2. How are Companies Positioned
             1. Are companies always playing defense and catch-up, is there an end to this?
          3. Is Cloud More Secure than prior IT?
             1. Is cloud more secure than traditional on-premise IT, what's the future here and how should companies select vendors in all this uncertainty?
          4. Enterprise Risk Management
             1. How should organizations think about managing cyber risk with all their other risks - what's the efficient frontier here? Is this a technology problem or a business problem or both?
          5. Board Conversations
             1. What is the right security conversation a Board should have?
             2. What should they be asking the CEO, the CIO, the CISO?
          6. Personal Wishful Thinking
             1. You've had experience on both sides of the Board room, what do you wish you'd have done better either as a Board Director or a Chief Risk Officer / Chief Information Security Officer?
             2. We talk a lot about using security to deliver business enablement, is that viable?
          7. Wishful Thinking for Others
             1. If you could make a wish and ask all our Boards or executives to do one thing that would benefit their security and make the lives of their CISOs easier, what would it be?
       2. Crucial Questions from CIOs and CTOs
          1. Moving to Cloud Quicker
             1. How do I get security, risk, compliance and audit more comfortable with an acceleration to the cloud - so I can deliver on objectives and in fact mitigate technology, security and resiliency risk more quickly?
          2. Security vs. All Technology Risks
             1. Is cybersecurity the most significant risk and how should I prioritize security vs. all my other technology risks?
          3. CISO Function Alignment
             1. How do I ensure the CISO function is integrated into IT / business processes / activities?
          4. Forward Planning for Security
             1. I’d like to plan ahead but things coming from the security team seem so unpredictable
          5. How Much Security is Enough?
             1. No amount of effort ever seems enough for the security team, what should I do?
          6. Developer Agility and Security
             1. How do I ensure developer agility and productivity in the face of security?
          7. Legacy Systems
             1. How should I deal with legacy systems and architectures that are hard to secure?
       3. Crucial Questions from CISOs and Security Teams
          1. Hybrid Multi-Cloud
             1. How do we manage security across our hybrid on-premise and multi-cloud / multi-SaaS environments?
          2. Threat Intelligence
             1. How can we obtain, curate and act on threat intelligence in more effective ways?
          3. Security Monitoring
             1. How can I scale security monitoring to deal with increased attack surface and increased sensory coverage?
          4. Workforce Challenges
             1. How do I fill the positions I have with the right skills and people? How do I nurture my leaders and build a succession plan?
          5. Board and Executive Relationships
             1. How do we keep the Board and executive leadership informed and on-side with our efforts?
          6. IT Modernization
             1. How do I ensure IT prioritizes necessary security upgrades and IT systems modernization?
          7. Benchmarking
             1. How do I know if I’m doing enough and if my risk profile is about right?
       4. Crucial Questions from Governments and Regulators
          1. Risk Tradeoffs
             1. How do we think about the trade-offs between security, resilience, privacy and other risks?
          2. Principle vs. Objective Standards
             1. How stringent should we be in setting prescriptive standards for security?
          3. Information Sharing
             1. What is the right amount and type of information to share between the public and private sector to what effect?
          4. Supply Chain Risk
             1. How should we think about 3rd party, 4th party or even deeper supply chain risks?
          5. Cybersecurity Workforce
             1. How we do ensure we are growing skills and jobs in our local market?
          6. Nation State vs. Criminal Threats
             1. How should we prioritize dealing with nation state threats vs. organized criminal threats against businesses?
          7. Reporting and Transparency
             1. How do we become aware of incidents affecting our domestic enterprises or those under our regulatory charge?
       5. Risk Governance of Digital Transformation in the Cloud
       6. CISO's Guide to Cloud Security Transformation
          1. Google Cybersecurity Action Team
   14. Security Terminology, Technologies, Solutions & Vendors
       1. Cybersecurity Ecosystem mindmap
          1. by Strategy of Security
       2. Cybersecurity Landscape (solutions and vendors)
          1. CyberScape mapping (2021)
       3. Terminology
          1. EDR - End Point Detection and response
          2. XDR - Extended or enhanced approach to endpoint detection and response (EDR) in which the “X” serves as a wildcard operator to connote extending threat detection and response measures across endpoints, networks, SaaS applications, and cloud infrastructure.
          3. MDR - Managed Detection and Response (more analysis and threat intelligence compared to traditional MSSP's
          4. MXDR - Managed extended detection and response - extends MRD services across the enterprise. Security analytics, operations, advanced threat hunting, detection and rapid response across endpoint, network, and cloud environments.
          5. SIEM - Security Information and Event Management
          6. SOAR - Security Orchestration, Automation, and Response - more automation compared to a traditional SIEM
          7. CSPM - Cloud security posture management
          8. CASB - Cloud access security broker - proxy between users and cloud/Internet
             1. Visibility
             2. Threat Detection
             3. Compliance
             4. Data Security
          9. DLP - Data Loss Prevention
          10. Additional resources
              1. Security Scorecard
              2. NICCS
              3. Global Knowledge
   15. Learning resources
       1. Google Cloud security showcase
       2. Cloud Security Podcast
       3. GCP CIS Benchmarks™
       4. GCP MITRE ATT&CK®
       5. Professional Cloud Security Certification
       6. Coursera: Google Cloud Security
       7. Pluralsight: Security Best Practices in Google Cloud
       8. Security Summit 2022 recordings
       9. Next OnAir Security session recordings 2020
       10. Next Security session recordings 2019
7. 8 - Secure Software Supply Chain
   1. Ideal
      1. Shift security left in the software CI/CD pipeline.
   2. High-level Model
   3. Detailed Model
   4. Design secure deployment pipelines
   5. Software Delivery Shield
      1. Cloud Workstations (managed development environments)
      2. Cloud Code source protect
      3. Artifact Registry & Container Analysys
      4. Assured Open Source Software
      5. Code Build
      6. GKE security posture
      7. Cloud Run security insights
      8. Binary Authorization
   6. Leveraging the SLSA ("salsa") framework
   7. Deploy an enterprise developer platform on Google Cloud
8. 7- Secure App Delivery
   1. Ideal
      1. Protect external facing applications with DDoS defense, web application firewalling.
   2. Components
      1. Compute
         1. GKE Security
         2. GCE Security
            1. Shielded VMs
            2. Confidential VMs
            3. Leveraging VPC Service Controls
            4. Disk Encryption
         3. Deploy a secured serverless architecture using Cloud Functions
         4. Deploy a secured serverless architecture using Cloud Run
         5. Compute and container security
      2. Access
         1. Network & Application Security in Google Cloud
         2. Traffic Director (Advanced Traffic Management)
         3. Cloud Armor
            1. DDoS protection
            2. WAF protection
            3. Adaptive Protection
         4. Managed SSL Certs
         5. Best practices for securing applications and API's using Apigee
9. 6 - Network Security
   1. Ideal
      1. Centrally manage network resources, establish scalable segmentation and detect network threats.
   2. Components
      1. Virtual Private Cloud
         1. Shared VPC
      2. Serverless VPC Connectivity (Ingress and Egress)
      3. Cloud Firewall
         1. Firewall Policies
         2. Firewall Insights
      4. Google Cloud Load Balancing
      5. Google Cloud IDS
      6. Best practices for VPC design
      7. Best practices for GKE networking
      8. Networking for hybrid and multi-cloud workloads: Reference architectures
      9. Networking for secure intra-cloud access: Reference architectures
      10. Networking for internet-facing application delivery: Reference architectures