1. 1 - Cloud Governance
   1. Ideal State
      1. Automated, governed infrastructure pipeline using Infrastructure as Code (IaC)
   2. Components
      1. Best practices for accounts and organizations
      2. Landing zone design in Google Cloud
      3. Resource Manager
         1. IAM and Org policies are inherited from parent Org/folders.
      4. Policies
         1. Organizational policies
            1. Why these should be used
            2. Preventative Guardrails
            3. Set policies that restrict or enforce resource configurations
            4. eg: VM’s must not have public Ips
            5. eg: Buckets must be provisioned in US-West1
            6. Identity Agnostic
            7. Applies to all users
            8. Platform-level Enforcements
            9. Enforced regardless if entry point is Cloud Console, GCloud, or API
            10. Config-rime Enforcement
            11. Majority of enforcement done during config-time
            12. Config-time policies are non-retroactive
            13. Existing workloads won’t suddenly break
            14. Built-in Constraints
            15. Constraints are available in the platform and currently not extensible
            16. Foundational Set
            17. Prevent access to Google Cloud services except from managed identities in domains allow
            18. Enforce Public Access Prevention
            19. Domain restricted sharing
            20. Domain restricted contacts
            21. Enforce uniform bucket-level access
            22. Require OS Login
            23. Enforce additional security policies for service accounts
            24. Disable service account key creation
            25. Disable Automatic IAM Grants for Default Service Accounts
            26. Disable Service Account Key Upload
            27. Prevent the creation of less secure VPC network configurations
            28. Disable VM serial port access
            29. Restrict shared VPC project lien removal
            30. Define allowed external IPs for VM instances
            31. Skip default network creation
            32. Sets the internal DNS setting for new projects to Zonal DNS Only
            33. Restrict Public IP access on Cloud SQL instances
            34. Restrict Authorized Networks on Cloud SQL instances
            35. Restrict Protocol Forwarding Based on type of IP Address
            36. Disable VPC External IPv6 usage
            37. Disable VM nested virtualization
            38. New default org policies for new Organizations created after Feb 13 2024
            39. Disable Service Account key creation
            40. Prevent users from creating persistent keys for Service Accounts.
            41. Decreases the risk of exposed Service Account credentials.
            42. Disable Service Account key upload
            43. Prevent the upload of external public keys to Service Accounts.
            44. Decreases the risk of exposed Service Account credentials.
            45. Disable automatic IAM grants for default Service Accounts
            46. Prevent default Service Accounts from receiving the overly-permissive IAM role Editor at creation.
            47. The Editor role lets the Service Account create and delete resources for most Google Cloud services, which creates a vulnerability if the Service Account gets compromised.
            48. Enforce Domain Restricted Sharing
            49. Limit IAM policies to only allow managed user identities in selected domain(s) to access resources inside this Organization.
            50. Leaving the Organization open to access by actors with domains other than the customers’ own creates a vulnerability.
            51. Allow only domain restricted contacts
            52. Limit Essential Contacts to only allow managed user identities in selected domain(s) to receive platform notifications.
            53. A bad actor with a different domain might get added as an Essential Contact, leading to a compromised security posture.
            54. Enforce uniform bucket-level access
            55. Prevent GCS buckets from using per-object ACL (a separate system from IAM policies) to provide access.
            56. Enforces consistency for access management and auditing.
            57. Set the internal DNS setting for new projects to zonal DNS only.
            58. Set guardrails that application developers cannot choose legacy DNS settings for Compute instances.
            59. Legacy DNS settings (global) have lower service reliability than modern DNS settings (zonal).
            60. Crating & managing custom constraints
            61. Specific guidance
            62. compute.disableNestedVirtualization
            63. Nested virtualization on Compute Engine VMs can evade monitoring and other security tools for your VMs if poorly configured. This constraint prevents the creation of nested virtualization.
            64. compute.disableSerialPortAccess
            65. IAM roles like compute.instanceAdmin allow privileged access to an instance's serial port using SSH keys. If the SSH key is exposed, an attacker could access the serial port and bypass network and firewall controls. This constraint prevents serial port access.
            66. compute.disableVpcExternalIpv6
            67. External IPv6 subnets can be exposed to unauthorized internet access if they are poorly configured. This constraint prevents the creation of external IPv6 subnets.
            68. compute.requireOsLogin
            69. The default behavior of setting SSH keys in metadata can allow unauthorized remote access to VMs if keys are exposed. This constraint enforces the use of OS Login instead of metadata-based SSH keys.
            70. compute.restrictProtocolForwardingCreationForTypes
            71. VM protocol forwarding for external IP addresses can lead to unauthorized internet egress if forwarding is poorly configured. This constraint allows VM protocol forwarding for internal addresses only.
            72. compute.restrictXpnProjectLienRemoval
            73. Deleting a Shared VPC host project can be disruptive to all the service projects that use networking resources. This constraint prevents accidental or malicious deletion of the Shared VPC host projects by preventing the removal of the project lien on these projects.
            74. compute.setNewProjectDefaultToZonalDNSOnly
            75. A legacy setting for global (project-wide) internal DNS is not recommended because it reduces service availability. This constraint prevents the use of the legacy setting.
            76. compute.skipDefaultNetworkCreation
            77. A default VPC network and overly permissive default VPC firewall rules are created in every new project that enables the Compute Engine API. This constraint skips the creation of the default network and default VPC firewall rules.
            78. compute.vmExternalIpAccess
            79. By default, a VM is created with an external IPv4 address that can lead to unauthorized internet access. This constraint configures an empty allowlist of external IP addresses that the VM can use and denies all others.
            80. essentialcontacts.allowedContactDomains
            81. By default, Essential Contacts can be configured to send notifications about your domain to any other domain. This constraint enforces that only email addresses in approved domains can be set as recipients for Essential Contacts.
            82. iam.allowedPolicyMemberDomains
            83. By default, allow policies can be granted to any Google Account, including unmanaged accounts, and accounts belonging to external organizations. This constraint ensures that allow policies in your organization can only be granted to managed accounts from your own domain. Optionally, you can allow additional domains.
            84. iam.automaticIamGrantsForDefaultServiceAccounts
            85. By default, default service accounts are automatically granted overly permissive roles. This constraint prevents the automatic IAM role grants to default service accounts.
            86. iam.disableServiceAccountKeyCreation
            87. Service account keys are a high-risk persistent credential, and in most cases a more secure alternative to service account keys can be used. This constraint prevents the creation of service account keys.
            88. iam.disableServiceAccountKeyUpload
            89. Uploading service account key material can increase risk if key material is exposed. This constraint prevents the uploading of service account keys.
            90. sql.restrictAuthorizedNetworks
            91. Cloud SQL instances can be exposed to unauthenticated internet access if the instances are configured to use authorized networks without a Cloud SQL Auth Proxy. This policy prevents the configuration of authorized networks for database access and forces the use of the Cloud SQL Auth Proxy instead.
            92. sql.restrictPublicIp
            93. Cloud SQL instances can be exposed to unauthenticated internet access if the instances are created with public IP addresses. This constraint prevents public IP addresses on Cloud SQL instances.
            94. storage.uniformBucketLevelAccess
            95. By default, objects in Cloud Storage can be accessed through legacy Access Control Lists (ACLs) instead of IAM, which can lead to inconsistent access controls and accidental exposure if misconfigured. Legacy ACL access is not affected by the iam.allowedPolicyMemberDomains constraint. This constraint enforces that access can only be configured through IAM uniform bucket-level access, not legacy ACLs.
            96. storage.publicAccessPrevention
            97. Cloud Storage buckets can be exposed to unauthenticated internet access if misconfigured. This constraint prevents ACLs and IAM permissions that grant access to allUsers and allAuthenticatedUsers.
            98. Additional Policy Controls
            99. Limit session and gcloud timeouts
            100. Disable Cloud Shell
            101. Use phishingresistant security keys
            102. Enable access transparency
            103. Enable access approval
            104. Setup Trusted Images project
            105. Manage Compute Engine resources using custom constraints
         2. Policy Intelligence
            1. IAM Recommender (ML used to help achieve least privilege)
            2. Policy Troubleshooter (Why principal doesn't have access?)
            3. IAM Policy Analyzer (Who has access to what?)
            4. Org Policy Analyzer
            5. Policy Simulator (Simulate before breaking app/process)
         3. Not just IaC, but also Policy as Code
            1. Declarative
            2. Validate
            3. Automate
            4. Roll back
            5. Scale
      5. VPC Service Controls
         1. Benefits
            1. Mitigate data exfiltration risks
            2. Keep data private inside the VPC
            3. Deliver independent data access controls
         2. Features
            1. Coverage of services
            2. VPC SC offers broad coverage of internet to service, service to service, VPC to service access controls.
            3. Rich security logging
            4. Maintain an ongoing log of access denials to spot potential malicious activity on Google Cloud resources. Flow logs capture information about the IP traffic going to and from network interfaces on Compute Engine. The logs provide near real-time visibility.
            5. Support for hybrid environments
            6. Configure private communication to cloud resources from VPC networks that span cloud and on-premises hybrid deployments using Private Google Access.
            7. Secure communication
            8. Securely share data across service perimeters with full control over what resource can connect to others or to the outside.
            9. Context-aware access
            10. Control access to Google Cloud services from the internet based on context-aware access attributes like IP address and a user’s identity.
            11. Perimeter security for managed Google Cloud services
            12. Configure service perimeters to control communications between virtual machines and managed Google Cloud resources. Service perimeters allow free communication within the zone and block all service communication outside the perimeter.
         3. Use cases
            1. Mitigate threats such as data exfiltration
            2. VPC Service Controls allow customers to address threats such as data theft, accidental data loss, and excessive access to data stored in Google Cloud multi-tenant services. It enables clients to tightly control what entities can access what services in order to reduce both intentional and unintentional losses.
            3. Isolate parts of the environment by trust level
            4. VPC Service Controls delivers a method to segment the multi-tenant services environment and isolate services and data. It enables environment micro-segmentation based on service and identity. Service Controls enables clients to extend their networks to include multi-tenant Google Cloud services and control egress and ingress of data.
            5. Secure access to multi-tenant services
            6. VPC Service Controls delivers zero-trust style access to multi-tenant services. Clients can restrict access to authorized IPs, client context, and device parameters while connecting to multi-tenant services from the internet and other services. Examples include GKE, BigQuery, etc. It enables clients to keep their entire data processing pipeline private.
         4. Visual Example
            1. (Google Cloud official youtube video link)
      6. Notifications
         1. Contacts & Notifications
         2. Audit Logging
         3. Billing Alerts
      7. Assured Workloads
         1. Data residency
            1. To help comply with data residency requirements, Google Cloud gives you the ability to control the regions where data at rest is stored.
            2. During Assured Workloads setup, you create an environment and select your compliance program. When you create resources in the environment, Assured Workloads restricts the regions you can select for those resources based on the compliance program you chose using Organization Policy.
         2. Cryptographic control over data access
            1. Google Cloud applies encryption at rest and in transit by default. To gain more control over how data is encrypted, Google Cloud customers can use Cloud Key Management Service to generate, use, rotate, and destroy encryption keys according to their own policies.
            2. Cryptographic control over data access is achieved through the use of Key Access Justifications (KAJ) together with our Cloud External Key Manager (EKM).
            3. Assured Workloads configures the appropriate encryption services per workload depending on the compliance program you chose.
         3. Assured Support
            1. Regulated customers’ compliance obligations extend to support services. Assured Support is a value-added service to Premium or Enhanced Support to ensure only Google support personnel meeting specific geographical locations and personnel conditions support their workload when raising a support case or needing technical assistance.
            2. By delivering the same features and benefits of Premium or Enhanced Support (including response times) with an added layer of controls and transparency, Assured Support helps customers meet compliance requirements without compromising on the level and quality of support.
         4. Assured Workloads monitoring
            1. Assured Workloads monitoring scans your environment in real time and provides alerts whenever organization policy changes violate the defined compliance posture. The monitoring dashboard shows which policy is being violated and provides instructions on how to resolve the finding.
         5. Assured Workloads Quick Start Guide
      8. Specific Frameworks
         1. FedRamp implementation guide
         2. PCI DSS
            1. Limiting scope of compliance for PCI environments in Google Cloud
            2. PCI Data Security Standard compliance
            3. PCI DSS compliance on GKE
            4. Security blueprint: PCI on GKE
            5. Tokenizing sensitive cardholder data for PCI DSS
      9. Active Assist portfolio
         1. Cost
            1. VM machine type recommender
            2. Committed use discount recommender
            3. Idle VM recommender
            4. Cloud SQL overprovisioned instance recommender
         2. Security
            1. IAM recommender
            2. Firewall insights
            3. Cloud Run recommender
         3. Performance
            1. VM machine type recommender
            2. Managed instance group machine type recommender
         4. Reliability
            1. Compute Engine predictive autoscaling
            2. Cloud SQL out-of-disk recommender
            3. Policy Troubleshooter
            4. Policy Analyzer
         5. Manageability
            1. Network Intelligence Center
            2. Product suggestion recommender
            3. Policy Simulator
         6. Sustainability
            1. Unattended project recommender
      10. Access Transparency and Access Approval
          1. Customer data is not accessed for any reason other than to fulfill contractual obligations
          2. Valid business justification required for any access by support or engineering personnel
          3. Near real-time logs offer insight when Google Cloud administrators access your content
          4. Approve or dismiss requests for access by Google employees working to support your service
      11. Audit Manager (Private Preview)
      12. Consider a Zero Trust Architecture
      13. Google Cloud Architecture Center
          1. Deployment archetypes
          2. Infrastructure reliability guide
          3. Landing zone design
          4. Enterprise foundations blueprint
2. 2- Identity and Access Management
   1. Ideal State
      1. Unified, federated identity. Least privilege policies based on user/service, role, resource, condition.
      2. Only short-term credentials - for everything, everywhere.
   2. Components
      1. Identities in Google Cloud
         1. Google Cloud Identity
         2. Best practices for federating Google Cloud with an external identity provider
         3. Workforce Identity Federation
         4. Workload Identify Federation
         5. Manage just-in-time privileged access to projects
         6. * Propagate employee suspension events
            1. To fully revoke access to Google services, propagate suspension events to Cloud Identity or Google Workspace in the following ways:
            2. Ensure that whenever a user account is suspended in your external IdP, the corresponding user account in Cloud Identity or Google Workspace is suspended as well. Suspending a user in Cloud Identity or Google Workspace terminates active browser sessions, invalidates tokens, and revokes all other access.
            3. Similarly, when you reactivate a user account in your external IdP, make sure that you also reactivate the corresponding user account in Cloud Identity or Google Workspace.
      2. MFA/2FA/2SV for admin accounts
         1. Hardware Keys (prefered)
      3. Least-privilege roles & permissions
         1. IAM Policy Intelligence
            1. Troubleshooter
            2. Simulator
            3. Recommender
            4. Analyzer
      4. Service Accounts
         1. When to use service accounts
         2. 4-min video
         3. Best practices for managing Service Account Keys
            1. Provide alternatives to creating service account keys.
            2. Use organization policy constraints to limit which projects can create service account keys.
            3. Don't leave service account keys in temporary locations.
            4. Don't pass service account keys between users.
            5. Don't submit service account keys to source code repositories.
            6. Don't embed service account keys in program binaries.
            7. Use insights and metrics to identify unused service account keys.
            8. Rotate service account keys to reduce security risk caused by leaked keys.
            9. Use uploaded keys to let keys expire automatically.
         4. Best Practices for using service accounts
         5. Best practices for using service accounts in pipelines
         6. Migrate away from service account keys
            1. Assess: In this phase, you assess your existing environment to understand where service account keys exist and whether the keys are in use.
            2. Plan: In this phase, you decide which controls you will eventually deploy and communicate the migration plan to stakeholders.
            3. Deploy: In this phase, you begin refactoring workloads to authenticate with more secure alternatives to service account keys. You also build additional capabilities to continuously monitor your environment and mitigate future risk.
      5. Identity Aware Proxy (IAP) (leverage identity instead of network access)
         1. Common proxies
            1. App Engine
            2. Cloud Run
            3. Compute Engine
            4. GKE
            5. On-premises
         2. Overview of TCP forwarding
            1. IAP for TCP forwarding (enable admin access to VM's without external IP address or no direct Internet access)
            2. Secure IAP for TCP forwarding with VPC Service Controls
         3. Can be extended with access levels (Access Context Manager)
         4. IAP Best Practices
         5. Leveraging external identities
            1. Email/password
            2. OAuth (Google, Facebook, Twitter, GitHub, Microsoft, etc.)
            3. SAML
            4. OIDC
            5. Phone number
            6. Custom
            7. Anonymous
      6. Access Context Manager
         1. Create access levels for projects and resources
            1. Permit access based on contextual information about the request
         2. Methods
            1. Basic
            2. Collection of conditions
            3. Custom (Google Workspace Premium)
            4. Created using Common Expression Language
         3. Conditions
            1. IP subnetworks (excludes private IP ranges)
            2. Geographic locations
            3. Device policy/ endpoint verification (Google Workspace Premium)
            4. Supported computers
            5. Apple Mac OS X El Capitan (10.11) and later
            6. Devices running ChromeOS 110 and later
            7. Linux Debian and Ubuntu
            8. Note: CPU must support AES instructions.
            9. Microsoft Windows 10 and 11
            10. Criteria
            11. Screen lock
            12. Require admin approval
            13. Require corp owned device
            14. Storage encryption
            15. Operating system policy
            16. Access level dependencies
         4. Leveraged with the following GCP services
            1. VPC Service Controls
            2. Identity-Aware Proxy
            3. Context-Aware Access for Google Workspace
            4. Identity and Access Management (IAM) conditions
      7. Context Aware Access (Google Workspace)
         1. Allow access to apps only from company-issued devices
         2. Allow access to Drive only if a user storage device is encrypted
         3. Restrict access to apps from outside the corporate network
      8. Best practices for securing SSH access to VM instances
      9. Leverage OS Login to manage instances
         1. short video
         2. Setup OS Login
         3. Enforce OS Login at org level
      10. Troubleshooting access problems on Google Cloud
      11. Identity Platform (authenticate users to apps and services)
      12. Secure the Google Cloud console and Google Cloud API's by leveraging BeyondCorp Enterprise
      13. Leverage temporary access as much as possible
          1. Privileged Access Manager (PAM)
          2. JIT (just-in-time privileged access to projects
3. 3 - Logging & Monitoring
   1. Ideal State
      1. Aggregated platform, system, and audit logs.
   2. Components
      1. Log types
         1. Admin Activity Audit Logs
         2. Data Access Audit Logs
         3. Access Transparency Logs & Access Aproval
            1. Enabling Access Transparency
      2. Architecture
      3. Cloud Logging
      4. Log Analytics
      5. Cloud Monitoring
      6. FinOps
      7. Logging best practices
      8. Four steps to managing your Cloud Logging costs on a budget
4. 4 - Security Operations
   1. Ideal State
      1. Continuosly detect and act on vulnerabilities, threats, & misconfigurations.
   2. Components
      1. Supercharge security with AI
         1. Gemini for Google Cloud
         2. Security Command Center Enterprise
         3. Google Security Operations
            1. Why SecOps?
            2. Integration into Enterprise SOC Ecosustems
            3. Case Management
            4. Playbooks
            5. Investigation
            6. Threat Intel Platform
            7. Collaboration
            8. Crisis Management
            9. Business Intelligence
            10. All your data - fast!
            11. Hunt for threats 90% faster than traditional SOC tools
            12. Detect by correlating petabytes of your telemetry and identity malicious activity/patters
            13. DNS
            14. Vulnerability data
            15. Cloud data
            16. Threat Intel
            17. EDR/XDR
            18. Authentication
            19. Identity
            20. Firewalls
            21. VPN
            22. Network
            23. Intelligent Data Fusion
            24. Unified data model
            25. Rich, extensible data model spanning Asset, User and IoC dimensions and attributes
            26. IP to host correlation
            27. Automated IP to host correlation enables instant asset and IoC analytics
            28. Canonical event deduplication
            29. Logical event layer (user logins, network connections etc.) and visualization simplifies and expedites analysis
            30. At a disruptive cost
            31. Eliminate the tradeoffs between cost and security with fixed and predictable pricing that is decoupled from capacity, compute and log source count.
            32. SecOps Services
            33. Solutions
            34. SecOps Transformation
            35. SIEM Augmentation
            36. Cloud Detection & Response
            37. Service Providers
            38. Knowledge base
            39. Data Sheets
            40. Chronicle SIEM
            41. Chronicle SOAR
            42. Blogs
            43. Case Studies
            44. Third-party Reports
         4. Google Threat Intelligence
            1. Know who’s targeting you with unmatched visibility
            2. Turn insights into action
            3. Make Google part of your security team
            4. Supercharge your team with Gemini
            5. Simplify workflows and collaboration with a workbench
            6. Trust a unified verdict
         5. AI-powered security whitepaper
      2. Mandiant
         1. Mandiant Advantage Platform
            1. Threat Intelligence (know who's targeting you)
            2. What are the threats and how I detect them?
            3. How do threats affect me?
            4. How do I use threat intelligence effectively?
            5. Attack Surface Management (know what is exposed on the Internet)
            6. Identify and remove sprawl
            7. Reduce software and cloud risk
            8. Monitor and Enforce security policies
            9. Security Validation (know if you're prepared)
            10. Are we prepared?
            11. Proactive Security Validation
            12. Validation as a service
            13. Managed or co-managed validation
            14. Prioritize, Measure, Optimize, Rationalize, Monitor
            15. Alert Investigation and Prioritization (formerly Automated Defense)
            16. Alert Investigation and Prioritization
            17. Managed Defense
            18. 24/7 monitoring
            19. Attacker behavior investigation & analysis
            20. Advanced Detection & Hunting
            21. Response & Remediation
            22. Breach Analytics for Chronicle (are we compromised?)
         2. Consulting Services
            1. Incident Response
            2. Incident Response Service
            3. Incident Response Retainer
            4. Compromise Assessment
            5. Cyber Defense Assessment
            6. Ransomware
            7. Ransomware Defense Assessment
            8. Red Team for Ransomware
            9. Purple Team for Ransomware
            10. Tabletop Exercise
            11. Threatspace Cyber Range Simulation Exercise
            12. Risk Management
            13. Cyber Security Due Diligence
            14. Cyber Security Program Assessment
            15. Cyber Risk Management Operations
            16. Crown Jewels Assessment
            17. Threat and Vulnerability Assessment
            18. Threat Modeling Security Service
            19. Targeted Attack Testing
            20. Red Team Assessment
            21. Purple Team Assessment
            22. Continuous Purple Team Assessment
            23. Tabletop Exercise
            24. Embedded Device Assessment
            25. Penetration Testing
            26. Red Team – TIBER-EU
            27. ThreatSpace Cyber Range Simulation Exercise
            28. Cyber Security Transformation
            29. Cyber Defense Center Development
            30. Cyber Defense Operations
            31. Threat Intelligence, Threat Hunting and Incident Response Training
            32. Identity-First Security
            33. Insider Threat Assessment
            34. Insider Threat as a Service
            35. Remote Security Assessment
            36. Active Directory Assessment
            37. Penetration Testing for Internal Attacks
            38. Penetration Testing for Social Engineering
            39. Industrial Control Systems (ICS) & Operational Technology (OT)
            40. Explore all OT/ICS Solutions
            41. Industrial Control Systems (ICS) Healthcheck
            42. Penetration Testing for ICS
            43. Penetration Testing for Embedded/IoT
            44. Cloud Security
            45. Cloud Security Assessments
            46. Microsoft Office 365 Assessment
            47. Cloud Architecture Assessment: Azure, AWS, GCP
            48. Cloud Penetration Testing
            49. Cyber Security Due Diligence
            50. Cyber Security Due Diligence
            51. Penetration Testing for Web Applications
            52. Penetration Testing for Mobile
            53. Penetration Testing for Wireless
            54. Penetration Testing for Physical Security
            55. Threat Intelligence Services
            56. Applied Intelligence
            57. Cyber Threat Profile
            58. Intelligence Capability Development
            59. Executive Intelligence Briefings
         3. Mandiant Resources
            1. Blog
            2. Customer Stories
            3. Webinars
            4. Events
            5. Datasheets
            6. White Papers
            7. Podcasts
            8. Reports
            9. Cyber Security forecast 2023
            10. Global Perspectives on Threat Intelligence Report
            11. Insights
            12. Infographics
            13. eBooks
            14. Mandiant Academy
            15. Course Catalog
            16. Introductory Courses
            17. Introduction to Cyber Crime for Executives
            18. Cyber Security Awareness
            19. Fundamentals of Industrial Control Systems (ICS) Security
            20. Fundamentals of Cyber Security
            21. Cyber Security Policy and Implementation
            22. Audits and Compliance in the Cyber Domain
            23. Introduction to the Mandiant Security Instrumentation Platform
            24. Intelligence and Attribution Courses
            25. Introduction to Threat Intelligence and Attribution
            26. Cyber Intelligence Foundations
            27. Intelligence Research I—Scoping
            28. Intelligence Research II—Open Source Intelligence (OSINT)
            29. Cyber Intelligence Production
            30. Incident Response Courses
            31. Incident Response for Everyone
            32. Windows Enterprise Incident Response
            33. Linux Enterprise Incident Response
            34. Combined Windows-Linux Enterprise Incident Response
            35. Network Traffic Analysis
            36. Practical Threat Hunting
            37. Digital Forensics and Incident Response for PLCs
            38. Malware Analysis Courses
            39. Malware Analysis Fundamentals
            40. Malware Analysis Crash Course
            41. Malicious Documents Analysis
            42. Advanced Red Teaming Techniques: Malware Authoring and Repurposing
            43. Malware Analysis Master Course
            44. Advanced Acquisition and Testing Techniques Courses
            45. Creative Red Teaming
            46. Practical Mobile Application Security
            47. Workshops
            48. Business Email Compromise
            49. Exercises and Preparedness
            50. ThreatSpace: Real-World Attack Scenarios
            51. Senior Executive Mentorship Program
            52. Upcoming Public Courses
            53. On-Demand Courses
            54. Mandiant Certifications
            55. ThreatSpace Cyber Range
      3. BeyondCorp & Zero Trust
         1. BeyondCorp Access in one minute
         2. Operate with Zero Trust using BeyondCorp Enterprise
         3. Context-aware access
         4. BeyondCorp Alliance
         5. Additional references
            1. An overview: "A New Approach to Enterprise Security"
            2. How Google did it: "Design to Deployment at Google"
            3. Google's frontend infrastructure: "The Access Proxy"
            4. Migrating to BeyondCorp: "Maintaining Productivity while Improving Security"
            5. The human element: "The User Experience"
            6. Secure your endpoints: "Building a Healthy Fleet"
      4. Security Partners
         1. Ecosystem
         2. Infrastructure Protection
            1. Next-gen firewalls
            2. Web application firewalls (WAFs)
            3. Web proxies and cloud gateways
            4. Server endpoint protection
            5. DDoS protection
            6. Container security
         3. Data Protection
            1. Encryption and key management
            2. Data/information loss protection
         4. Logging and monitoring
            1. Logging and monitoring
            2. Configuration, vulnerability, risk, and compliance
         5. Configuration, vulnerability, risk, and compliance
            1. Vulnerability scanners
            2. Governance, risk management, and compliance
5. 5 - Data Protection
   1. Ideal
      1. Identify and protect your most important data.
   2. Components
      1. Data Security Guidance
      2. Encryption of data at rest
         1. Default Encryption
            1. Enabled by default - Google manages encryption keys
         2. Cloud KMS
            1. Customer can manage their own keys, hosted by Google
         3. Cloud HSM
            1. Customer can manage their own keys, hosted by Google on a dedicated hardware module
         4. Cloud EKM
            1. Customer manages & hosts their own keys externally from Google
         5. Sensitive Data Protection (includes Data Loss Prevention)
            1. Features
            2. API Driven & GCP Console
            3. Cover use cases anywhere, on or off cloud with the DLP API
            4. De-identification, masking, tokenization, and bucketing
            5. Powerful and flexible masking of your AI/ML workloads
            6. Streaming content API
            7. Automated sensitive data discovery and classification (for BigQuery)
            8. Sensitive data intelligence for security assessments
            9. Results can be imported into BigQuery for analysis or imported into other systems
            10. With direct feeds into Chronicle and Security Command Center, you can leverage sensitive data intelligence to reduce noise and prioritize threats, vulnerabilities, and security investigations.
            11. Inspection/Analysis
            12. Learn about your data
            13. Discovery/data profiling (for BigQuery)
            14. Get continuous visibility into all your sensitive data.
            15. Deep inspection
            16. Inspect your data in storage systems exhaustively and investigate individual findings.
            17. Risk Analysis (for BigQuery)
            18. Process of analyzing sensitive data to find properties that might increase the risk of subjects being identified
            19. Sensitive information about individuals being revealed
            20. Help determine effective de-identification strategy
            21. Help monitor for any changes or outliers, after de-identification
            22. Methods
            23. Content (streaming data)
            24. Leveraging the DLP API
            25. InspectContent
            26. DeidentifyContent
            27. ReidentifyContent
            28. RedactImage
            29. OUTPUT:
            30. Inspection Findings
            31. De-Id transformed content
            32. Storage (Native GCP sources)
            33. Shards data and works in parallel
            34. Cloud Storage
            35. BigQuery
            36. Datastore
            37. Hybrid (streaming data)
            38. Hybrid jobs and job triggers (requires custom application)
            39. Other cloud providers
            40. On-premises servers or other data repositories
            41. Non-native storage systems, such as systems running inside a virtual machine
            42. Web and mobile apps
            43. Google Cloud-based solutions
            44. Workflow
            45. You write a script or create a workflow that sends data to Sensitive Data Protection for inspection along with some metadata.
            46. You configure and create a hybrid job resource or trigger and enable it to activate when it receives data.
            47. Your script or workflow runs on the client side and sends data to Sensitive Data Protection in the form of a hybridInspect request. The data includes an activation message and the job or job trigger's identifier, which triggers the inspection.
            48. Sensitive Data Protection inspects the data according to the criteria you set in the hybrid job or trigger.
            49. Sensitive Data Protection saves the results of the scan to the hybrid job resource, along with metadata that you provide. You can examine the results using the Sensitive Data Protection UI in Google Cloud console.
            50. Optionally, Sensitive Data Protection can run post-scan actions, such as saving inspection results data to a BigQuery table or notifying you by email or Pub/Sub.
            51. Supported actions
            52. Save findings to Sensitive Data Protection and Save findings to BigQuery
            53. Send Pub/Sub
            54. Send Email
            55. Publish to Cloud Monitoring
            56. Actions from inspection results
            57. On-demand vs continuous profiling
            58. Discovery (continuous profiling)
            59. BigQuery
            60. BigLake
            61. On-demand inspection
            62. BigQuery
            63. Cloud Storage
            64. Datastore
            65. Hybrid
            66. How (Inspection template)
            67. InfoTypes
            68. Built-in (150+)
            69. Country, region-specific sensitive data types
            70. Globally applicable data types
            71. Custom
            72. Regular dictionary detectors
            73. Stored dictionary detectors
            74. Regular expression (regex)
            75. Inspection Rules
            76. Fine-tune
            77. Exclusion rules
            78. Hotword rules
            79. Likelihood Value
            80. Likelihood Unspecified
            81. Very Unlikely
            82. Unlikely
            83. Possible
            84. Likely
            85. Very Likely
            86. Protection/De-Identification
            87. De-identification techniques
            88. Redaction: Deletes all or part of a detected sensitive value.
            89. Replacement: Replaces a detected sensitive value with a specified surrogate value.
            90. Masking: Replaces a number of characters of a sensitive value with a specified surrogate character, such as a hash (#) or asterisk (*).
            91. Crypto-based tokenization: Encrypts the original sensitive data value using a cryptographic key. Sensitive Data Protection supports several types of tokenization, including transformations that can be reversed, or "re-identified."
            92. Bucketing: "Generalizes" a sensitive value by replacing it with a range of values. (For example, replacing a specific age with an age range, or temperatures with ranges corresponding to "Hot," "Medium," and "Cold.")
            93. Date shifting: Shifts sensitive date values by a random amount of time.
            94. Time extraction: Extracts or preserves specified portions of date and time values.
            95. De-identify examples
            96. De-identify data stored in Cloud Storage
            97. De-identify data from any source
            98. De-identify BigQuery data at query time
            99. De-identification and re-identification of PII in large-scale datasets in Cloud Storage
            100. Redact sensitive data from PDF files
            101. Use Sensitive Data Protection with AWS S3
            102. How (De-identification template)
            103. Resources
            104. Documentation
            105. How-to guides
            106. "Traditional" DLP via BeyondCorp Enterprise
            107. Implement DLP with Chrome
            108. Uploads
            109. Downloads
            110. Content copied and pasted
            111. Content dragged and dropped
            112. 90+ content detectors
            113. Visual
      3. Sensitive Data Protection (includes Data Loss Prevention)
         1. 1) Understand/Inspection/Analysis
            1. Learn about your data
            2. Discovery/data profiling
            3. Get continuous visibility into all your sensitive data.
            4. BigQuery - GA
            5. BigLake - GA
            6. Cloud SQL - Preview
            7. Deep inspection
            8. Inspect your data in storage systems exhaustively and investigate individual findings.
            9. Risk Analysis (for BigQuery)
            10. Process of analyzing sensitive data to find properties that might increase the risk of subjects being identified
            11. Sensitive information about individuals being revealed
            12. Help determine effective de-identification strategy
            13. Help monitor for any changes or outliers, after de-identification
            14. Report Credentials & Secrets to SCC
            15. detailed list
            16. Methods
            17. Content (streaming data)
            18. Leveraging the DLP API
            19. InspectContent
            20. DeidentifyContent
            21. ReidentifyContent
            22. RedactImage
            23. OUTPUT:
            24. Inspection Findings
            25. De-Id transformed content
            26. Storage (Native GCP sources)
            27. Shards data and works in parallel
            28. Cloud Storage
            29. BigQuery
            30. Datastore
            31. Hybrid (streaming data)
            32. Hybrid jobs and job triggers (requires custom application)
            33. Other cloud providers
            34. On-premises servers or other data repositories
            35. Non-native storage systems, such as systems running inside a virtual machine
            36. Web and mobile apps
            37. Google Cloud-based solutions
            38. Workflow
            39. You write a script or create a workflow that sends data to Sensitive Data Protection for inspection along with some metadata.
            40. You configure and create a hybrid job resource or trigger and enable it to activate when it receives data.
            41. Your script or workflow runs on the client side and sends data to Sensitive Data Protection in the form of a hybridInspect request. The data includes an activation message and the job or job trigger's identifier, which triggers the inspection.
            42. Sensitive Data Protection inspects the data according to the criteria you set in the hybrid job or trigger.
            43. Sensitive Data Protection saves the results of the scan to the hybrid job resource, along with metadata that you provide. You can examine the results using the Sensitive Data Protection UI in Google Cloud console.
            44. Optionally, Sensitive Data Protection can run post-scan actions, such as saving inspection results data to a BigQuery table or notifying you by email or Pub/Sub.
            45. Supported actions
            46. Save findings to Sensitive Data Protection and Save findings to BigQuery
            47. Send Pub/Sub
            48. Send Email
            49. Publish to Cloud Monitoring
            50. Actions from inspection results
            51. On-demand vs continuous profiling
            52. Discovery (continuous profiling)
            53. BigQuery
            54. BigLake
            55. On-demand inspection
            56. BigQuery
            57. Cloud Storage
            58. Datastore
            59. Hybrid
            60. How (Inspection template)
            61. InfoTypes
            62. Built-in (150+)
            63. Country, region-specific sensitive data types
            64. Globally applicable data types
            65. Custom
            66. Regular dictionary detectors
            67. Stored dictionary detectors
            68. Regular expression (regex)
            69. Inspection Rules
            70. Fine-tune
            71. Exclusion rules
            72. Hotword rules
            73. Likelihood Value
            74. Likelihood Unspecified
            75. Very Unlikely
            76. Unlikely
            77. Possible
            78. Likely
            79. Very Likely
         2. 2) Protect/De-Identification
            1. De-identification techniques
            2. Redaction: Deletes all or part of a detected sensitive value.
            3. Replacement: Replaces a detected sensitive value with a specified surrogate value.
            4. Masking: Replaces a number of characters of a sensitive value with a specified surrogate character, such as a hash (#) or asterisk (*).
            5. Crypto-based tokenization: Encrypts the original sensitive data value using a cryptographic key. Sensitive Data Protection supports several types of tokenization, including transformations that can be reversed, or "re-identified."
            6. Bucketing: "Generalizes" a sensitive value by replacing it with a range of values. (For example, replacing a specific age with an age range, or temperatures with ranges corresponding to "Hot," "Medium," and "Cold.")
            7. Date shifting: Shifts sensitive date values by a random amount of time.
            8. Time extraction: Extracts or preserves specified portions of date and time values.
            9. De-identify examples
            10. De-identify data stored in Cloud Storage
            11. De-identify data from any source
            12. De-identify BigQuery data at query time
            13. De-identification and re-identification of PII in large-scale datasets in Cloud Storage
            14. Redact sensitive data from PDF files
            15. Use Sensitive Data Protection with AWS S3
            16. How (De-identification template)
         3. 3) Resources
            1. Documentation
            2. How-to guides
            3. IAM roles required
         4. 4) "Traditional" DLP via BeyondCorp Enterprise
            1. Implement DLP with Chrome
            2. Uploads
            3. Downloads
            4. Content copied and pasted
            5. Content dragged and dropped
            6. 90+ content detectors
            7. Visual
      4. Google Secrets Manager
         1. Common use cases
            1. API Keys
            2. Certificates
            3. Private Keys
            4. Passwords
         2. Highlights
            1. Replication policies
            2. Secret names are project-global resources, but secret data is stored in regions. You can choose specific regions in which to store your secrets, or you can let us decide. Either way, we automatically handle the replication of secret data.
            3. First-class versioning
            4. Secret data is immutable and most operations take place on secret versions. With Secret Manager, you can pin a secret to specific versions like "42" or floating aliases like "latest."
            5. Cloud IAM integration
            6. Control access to secrets the same way you control access to other Google Cloud resources. Only project owners have permission to access Secret Manager secrets; other roles must explicitly be granted permissions through Cloud IAM.
            7. Audit logging
            8. With Cloud Audit Logs enabled, every interaction with Secret Manager generates an audit entry. You can ingest these logs into anomaly detection systems to spot abnormal access patterns and alert on possible security breaches.
            9. Encrypted by default
            10. Data is encrypted in transit with TLS and at rest with AES-256-bit encryption keys.
            11. VPC Service Controls support
            12. Enable context-aware access to Secret Manager from hybrid environments with VPC Service Controls.
            13. Powerful and extensible
            14. Secret Manager's API-first design makes it easy to extend and integrate into existing systems. It is also integrated into popular third-party technologies like HashiCorp Terraform and GitHub Actions.
         3. Best Practices
      5. BigQuery data security and governance
      6. Spanner Security
         1. Access Control
         2. Fine-grained access control
         3. Encryption
      7. Bigtable Security
         1. Authentication
         2. Access Control
         3. Create and manage tags
         4. Audit logging
         5. Encryption
6. Bonus: GenAI Security & Governance Considerations
   1. Google Guidance & Resources
      1. Generative AI Introduction
         1. Terminology and data classification
            1. Foundation Models (Trained on data not owned by GCP customers)
            2. Owned by Google
            3. Prompt datasets (Datasets provided by GCP customers)
            4. Owned by Customer
            5. Fully-tuned or fine-tuned models (Trained on prompt dataset data provided by GCP customers)
            6. Owned by Customer
            7. Adapter models (Trained on prompt dataset provided by GCP customers, but simpler and less costly to train & serve)
            8. Owned by Customer
      2. Google's Secure AI Framework (SAIF)
      3. Cloud Architecture Center
         1. Generative AI
            1. Jump Start Solution: Generative AI document summarization
            2. Jump Start Solution: Generative AI RAG with Cloud SQL
            3. Build and deploy generative AI and machine learning models in an enterprise
            4. Jump Start Solution: Generative AI Knowledge Base
            5. Infrastructure for a RAG-capable generative AI application using GKE
            6. Infrastructure for a RAG-capable generative AI application using Vertex AI
            7. Use generative AI for utilization management
         2. Model Training
            1. Best practices for implementing machine learning on Google Cloud
            2. Cross-silo and cross-device federated learning on Google Cloud
            3. Model development and data labeling with Google Cloud and Labelbox
         3. ML Ops
            1. Build and deploy generative AI and machine learning models in an enterprise
            2. Architecture for MLOps using TensorFlow Extended, Vertex AI Pipelines, and Cloud Build
            3. Guidelines for developing high-quality, predictive ML solutions
         4. AI and ML applications
            1. Jump Start Solution: AI/ML image processing on Cloud Functions
            2. Build an ML vision analytics solution with Dataflow and Cloud Vision API
            3. Design storage for AI and ML workloads in Google Cloud
            4. Scalable TensorFlow inference system
            5. Serve Spark ML models using Vertex AI
            6. Use Vertex AI Pipelines for propensity modeling on Google Cloud
         5. Third-party product integrations
            1. C3 AI architecture on Google Cloud
   2. Data Governance and Generative AI
   3. Google Cloud Security Controls
      1. VPC-SC (VPC Service Controls)
      2. AXT (Access Transparency Logs)
      3. DRZ (Data Residence Controls)
      4. CMEK (Customer Managed Encryption Keys)
      5. Ephemerality: In-use customer core content destroyed upon expiry without undue delay.
   4. Consulting Services
      1. Mandiant AI Security Consulting
         1. Securing the use of AI
         2. Red teaming for AI
         3. Applying AI for defenders
      2. Google Cloud Consulting
         1. Automate with GenAI
         2. Automate with GenAI
         3. Back Office of the Future: Phase 1: MVP and Architecture
         4. Back Office of the Future: Phase 2: MVP to Production Technical Guidance
         5. CCAI Advisory Services Subscription
         6. CX Transformation with CCAIP
         7. Contact Center Modernization
         8. Converse with GenAI
         9. Create with GenAI
         10. Customer Service Modernization
         11. Customer Service Modernization: Customer Service Platform Modernization
         12. Customer Service Modernization: Customer Service Search & Discover
         13. Customer Service Modernization: Frontline Agent Experience Evolution
         14. Customer Service Modernization: RealTime Insights
         15. Customer Service Modernization: Virtual Assistant & Digital Concierge
         16. Developer Productivity with GenAI: Develop like Google
         17. Developer Productivity with GenAI: Manage like Google
         18. Developer Productivity with GenAI: Run like Google
         19. Discover with GenAI
         20. GenAI Ops: GenAI Continuous Tuning and Feedback
         21. GenAI Ops: GenAI Model Optimization
         22. GenAI for Digital Commerce: Catalog & Content Enrichment
         23. GenAI for Digital Commerce: Conversational Commerce
         24. GenAI for Marketing: Creative & Content Generation
         25. GenAI for Marketing: Insights & Measurement
         26. GenAI for Marketing: Personalization & Media Performance
         27. Improve Agent Productivity using LLMs
         28. ML Model Management & Ops
         29. MLOps Foundations on Vertex AI
         30. Productionize GenAI
         31. Summarize with GenAI
         32. Vertex AI Search and Conversation
         33. Website Modernization: Enhance Web Navigation
         34. Website Modernization: Improve SelfService and Deflection Rates
         35. Website Modernization: Streamline Content Generation
   5. Training
      1. Generative AI Learning Path - no cost training
         1. Introduction to Generative AI
         2. Introduction to Large Language Models
         3. Introduction to Responsible AI
         4. Generative AI Fundamentals
         5. Introduction to Image Generation
         6. Encoder-Decoder Architecture
         7. Attention Mechanism
         8. Transformer Models and BERT Model
         9. Create Image Captioning Models
         10. Introduction to Generative AI Studio
      2. Additional AI/ML training - varying learning credits required to complete on Google Cloud Skills Boost
         1. Introductory level
            1. [Course with completion badge] How Google Does Machine Learning (1 day)
            2. [Course with completion badge] MLOps: Getting Started (1 day)
            3. [Skill badge] Get started with TensorFlow on Google Cloud (8 hours)
            4. [Skill badge] Perform foundational ML, AI and data tasks in Google Cloud (7 hours)
            5. [Course with completion badge] Language, Speech, Text, and Translation with Google Cloud APIs (5 hours)
         2. Intermediate/Multi-level
            1. [Learning Path] Machine Learning Engineer (Collection of 15 video courses and labs)
            2. [Skill badge] Build and Deploy Machine Learning Solutions on Vertex AI (1 day)
         3. Advanced
            1. [Training + certification exam] Google Cloud Professional ML Engineer Certification (varied time)
            2. [Skill badge] Machine Learning with TensorFlow in Vertex AI (90 minutes)
            3. [Course with completion badge] Natural Language Processing in Google Cloud (1 day)
   6. Additional Resources
      1. Supercharge security with generative AI
      2. Advancing the art of AI-driven security with Google Cloud
      3. Securing the AI Pipeline (Mandiant)
      4. Threat Actors are Interested in Generative AI, but Use Remains Limited (Mandiant)
      5. AI and Cybersecurity: How Mandiant Consultants and Analysts are Leveraging AI Today (Mandiant)
      6. Google Cloud Whitepaper: Adaptations of Large Foundation Models
      7. Red Teams and AI Systems
   7. Industry resources
      1. MITRE | ATLAS™ - Adversarial Threat Landscape for Artificial-Intelligence System
      2. OWASP Top 10 List for Large Language Models version 1.0
      3. AI Vulnerability Database
7. GCP Security, Compliance, Governance, and Architecture resources
   1. Google Cloud Solutions Center
      1. Discoveries
         1. Cloud Capability Assessment
            1. The Cloud Capability Assessment helps determine where you are in your cloud journey and how you can develop new competencies across your business, financial and technology plans.
         2. AI Readiness Quick Check
            1. A quick assessment to understand an organization's AI capabilities across 6 pillars. Provide best practices and recommended learnings to advance the organization's AI practice.
         3. Security and Resilience Framework
            1. This discovery helps you evaluate your overall security maturity against five NIST functions: Identify, Protect, Detect, Respond and Recover. Use this discovery for recommendations on how to improve your security posture.
         4. Data Foundations for AI Benchmarking
            1. Help customers understand the robustness of their data analytics foundations and its readiness for AI adoption. The output of the assessment is a gap analysis of current data foundation capabilities with set of Google recommendations and PoV to create a transformational data platform.
         5. Cloud FinOps Assessment
            1. A cloud FinOps capability maturity assessment to help organizations better understand their cloud financial processes, culture, skillset, tooling, and technical competency. There are 13 questions which span the 5 pillars of cloud FinOps: 1. Accountability & Enablement, 2. Measurement & Realization, 3. Cost Optimization, 4. Planning & Forecasting, and 5. Tools & Accelerators. For each of the questions, the responses range between 1-5 with increasing maturity. If you have any issues taking the survey contact the Cloud FinOps team at pso-finops@google.com
         6. Partner Excellence Framework (PEF) - PreDelivery
            1. Partners can use the PreDelivery assessment before the delivery of the project has started. This assessment evaluates the technical readiness of the partner team for any project/workload on Google Cloud. The assessment report helps to identify and capture any potential gaps in architecture and provide prescriptive guidance aligned with Google Cloud architectural best practices to remediate those gaps. Additionally, the assessment also provides questions and assets that partners can use during the project discovery.
         7. Data & AI Cloud for Marketing - Benchmarking
            1. Understand your current marketing analytics capabilities to address the convergence of forces between shifting customer expectations and economic pressures putting more focus on growth and ROI of marketing activities.
         8. Data & AI Cloud for Supply Chain - Benchmarking
            1. A benchmarking survey to understand the critical capabilities required across Supply Chains to reduce risks & disruptions, and solving for resiliency and sustainability amidst global disruptions.
         9. Autonomic Security Operations
            1. Autonomic Security Operations is a stack of products, integrations, blueprints, technical content, and an accelerator program to enable customers to take advantage of our best-in-class technology stack built on Chronicle and Google’s deep security operations expertise.
         10. The Defender’s Advantage: Mandiant Cyber Defense
             1. Self-assessment of capabilities tied to the six critical functions of cyber defense as detailed in The Defender's Advantage by Mandiant including Intel, Command and Control, Hunt, Detect, Respond and Validate.
      2. Solutions
         1. (links in the solutions center)
   2. Google Cloud Architecture Center (Best Practices for Google Cloud)
      1. Google Cloud Architecture Framework
         1. Review shared responsibility and shared fate on Google Cloud
         2. Understand security principles
         3. Manage risks with controls
         4. Manage your assets
         5. Manage identity and access
         6. Implement compute and container security
         7. Secure your network
         8. Implement data security
         9. Deploy applications security
         10. Manage compliance obligations
         11. Implement data residency and sovereignty requirements
         12. Implement privacy requirements
         13. Implement logging and detective controls
      2. Enterprise foundations blueprint
      3. Google Cloud deployment archetypes
      4. Migrate to Google Cloud
         1. Assess and discover your workloads
         2. Build your foundation
         3. Transfer your large datasets
         4. Deploy your workloads
         5. Migrate from manual deployments to automated, containerized deployments
         6. Optimize your environment
         7. Best practices for validating a migration plan
         8. Minimize costs
      5. Hybrid and multicloud architecture guidance
      6. Migrate across Google Cloud regions
      7. GCP Architecture Guides
         1. GenAI-Vertex-workbench-security
         2. Network Firewall Microsegmentation
         3. Google Cloud Certificate Authority Service deployment
         4. Securing User Managed Vertex-AI Workbench
         5. Deploying IL4 Assured Workload
         6. Deploying Australia Regions with Assured Support Workload
         7. SCC Cryptomining Program
         8. Secure Web Proxy
   3. Security and resilience framework
   4. Landing zone design in Google Cloud
   5. Google Cloud Infrastructure Reliability Guide
   6. Google Cloud security foundations blueprint guide
   7. Best practices for cloud security products
      1. Anthos security blueprints
      2. Secured Data Warehouse security blueprint
      3. AI Platform Notebooks security blueprint
      4. Container security best practices
      5. Security best practice checklists (Google Workspace)
   8. Deployable security blueprints and landing zones
      1. Security foundations deployable assets
      2. Secured Data Warehouse blueprint GitHub repository
      3. AI Platform Notebooks blueprint GitHub repository
      4. Cloud Foundation Toolkit deployable assets
      5. Anthos security blueprints GitHub repository
   9. Security whitepapers and references
      1. Security transformation resources
         1. CISO’s guide to cloud security transformation
         2. Strengthening operational resilience for FinServ
         3. Building secure and reliable systems
         4. NEW! Risk governance of digital transformation
      2. Google Cloud security whitepapers
         1. Google security
         2. Google Workspace security
         3. Google infrastructure security design overview
         4. Encryption at rest
         5. Encryption in transit
         6. Google Workspace encryption
         7. Cloud Key Management (KMS) deep dive
         8. BeyondProd: New approach to cloud-native security
         9. Binary Authorization for Borg
         10. BeyondCorp: A new approach to enterprise security
         11. Privileged access management in GCP
   10. GCP Compliance resource center
       1. Data governance
          1. Data regions
       2. Data residency
          1. For European customers on Google Cloud
       3. Privacy Resource Center
          1. Cloud DPIA Resource Center
   11. Find a Google Partner
   12. Shared Fate Responsibility Model
   13. Security & Governance topics from our CISO (Phil Venables)
       1. Questions from CEO's and Boards
          1. Current Risk and Threat Outlook
             1. There's a lot going on in the world, can you give us a quick grand tour of the cyber threat landscape?
          2. How are Companies Positioned
             1. Are companies always playing defense and catch-up, is there an end to this?
          3. Is Cloud More Secure than prior IT?
             1. Is cloud more secure than traditional on-premise IT, what's the future here and how should companies select vendors in all this uncertainty?
          4. Enterprise Risk Management
             1. How should organizations think about managing cyber risk with all their other risks - what's the efficient frontier here? Is this a technology problem or a business problem or both?
          5. Board Conversations
             1. What is the right security conversation a Board should have?
             2. What should they be asking the CEO, the CIO, the CISO?
          6. Personal Wishful Thinking
             1. You've had experience on both sides of the Board room, what do you wish you'd have done better either as a Board Director or a Chief Risk Officer / Chief Information Security Officer?
             2. We talk a lot about using security to deliver business enablement, is that viable?
          7. Wishful Thinking for Others
             1. If you could make a wish and ask all our Boards or executives to do one thing that would benefit their security and make the lives of their CISOs easier, what would it be?
       2. Crucial Questions from CIOs and CTOs
          1. Moving to Cloud Quicker
             1. How do I get security, risk, compliance and audit more comfortable with an acceleration to the cloud - so I can deliver on objectives and in fact mitigate technology, security and resiliency risk more quickly?
          2. Security vs. All Technology Risks
             1. Is cybersecurity the most significant risk and how should I prioritize security vs. all my other technology risks?
          3. CISO Function Alignment
             1. How do I ensure the CISO function is integrated into IT / business processes / activities?
          4. Forward Planning for Security
             1. I’d like to plan ahead but things coming from the security team seem so unpredictable
          5. How Much Security is Enough?
             1. No amount of effort ever seems enough for the security team, what should I do?
          6. Developer Agility and Security
             1. How do I ensure developer agility and productivity in the face of security?
          7. Legacy Systems
             1. How should I deal with legacy systems and architectures that are hard to secure?
       3. Crucial Questions from CISOs and Security Teams
          1. Hybrid Multi-Cloud
             1. How do we manage security across our hybrid on-premise and multi-cloud / multi-SaaS environments?
          2. Threat Intelligence
             1. How can we obtain, curate and act on threat intelligence in more effective ways?
          3. Security Monitoring
             1. How can I scale security monitoring to deal with increased attack surface and increased sensory coverage?
          4. Workforce Challenges
             1. How do I fill the positions I have with the right skills and people? How do I nurture my leaders and build a succession plan?
          5. Board and Executive Relationships
             1. How do we keep the Board and executive leadership informed and on-side with our efforts?
          6. IT Modernization
             1. How do I ensure IT prioritizes necessary security upgrades and IT systems modernization?
          7. Benchmarking
             1. How do I know if I’m doing enough and if my risk profile is about right?
       4. Crucial Questions from Governments and Regulators
          1. Risk Tradeoffs
             1. How do we think about the trade-offs between security, resilience, privacy and other risks?
          2. Principle vs. Objective Standards
             1. How stringent should we be in setting prescriptive standards for security?
          3. Information Sharing
             1. What is the right amount and type of information to share between the public and private sector to what effect?
          4. Supply Chain Risk
             1. How should we think about 3rd party, 4th party or even deeper supply chain risks?
          5. Cybersecurity Workforce
             1. How we do ensure we are growing skills and jobs in our local market?
          6. Nation State vs. Criminal Threats
             1. How should we prioritize dealing with nation state threats vs. organized criminal threats against businesses?
          7. Reporting and Transparency
             1. How do we become aware of incidents affecting our domestic enterprises or those under our regulatory charge?
       5. Risk Governance of Digital Transformation in the Cloud
       6. CISO's Guide to Cloud Security Transformation
          1. Google Cybersecurity Action Team
   14. Security Terminology, Technologies, Solutions & Vendors
       1. Cybersecurity Ecosystem mindmap
          1. by Strategy of Security
       2. Cybersecurity Landscape (solutions and vendors)
          1. CyberScape mapping (2021)
       3. Terminology
          1. EDR - End Point Detection and response
          2. XDR - Extended or enhanced approach to endpoint detection and response (EDR) in which the “X” serves as a wildcard operator to connote extending threat detection and response measures across endpoints, networks, SaaS applications, and cloud infrastructure.
          3. MDR - Managed Detection and Response (more analysis and threat intelligence compared to traditional MSSP's
          4. MXDR - Managed extended detection and response - extends MRD services across the enterprise. Security analytics, operations, advanced threat hunting, detection and rapid response across endpoint, network, and cloud environments.
          5. SIEM - Security Information and Event Management
          6. SOAR - Security Orchestration, Automation, and Response - more automation compared to a traditional SIEM
          7. CSPM - Cloud security posture management
          8. CASB - Cloud access security broker - proxy between users and cloud/Internet
             1. Visibility
             2. Threat Detection
             3. Compliance
             4. Data Security
          9. DLP - Data Loss Prevention
          10. Additional resources
              1. Security Scorecard
              2. NICCS
              3. Global Knowledge
   15. Learning resources
       1. Google Cloud security showcase
       2. Cloud Security Podcast
       3. GCP CIS Benchmarks™
       4. GCP MITRE ATT&CK®
       5. Professional Cloud Security Certification
       6. Coursera: Google Cloud Security
       7. Pluralsight: Security Best Practices in Google Cloud
       8. Security Summit 2022 recordings
       9. Next OnAir Security session recordings 2020
       10. Next Security session recordings 2019
   16. Google Cloud Springboard (github)
       1. GenAI-Vertex-workbench-security
       2. CSA-DevSecOps
       3. Network Firewall Microsegmentation
       4. Google Cloud Certificate Authority Service deployment
       5. Securing User Managed Vertex-AI Workbench
       6. Deploying IL4 Assured Workload
       7. Deploying Australia Regions with Assured Support Workload
       8. SCC Cryptomining Program
       9. Secure Web Proxy
8. 8 - Secure Software Supply Chain
   1. Ideal
      1. Shift security left in the software CI/CD pipeline.
   2. High-level Model
   3. Detailed Model
   4. Design secure deployment pipelines
   5. Software Delivery Shield
      1. Cloud Workstations (managed development environments)
      2. Cloud Code source protect
      3. Artifact Registry & Container Analysys
      4. Assured Open Source Software
      5. Code Build
      6. GKE security posture
      7. Cloud Run security insights
      8. Binary Authorization
   6. Leveraging the SLSA ("salsa") framework
   7. Deploy an enterprise developer platform on Google Cloud
9. 7- Secure App Delivery
   1. Ideal
      1. Protect external facing applications with DDoS defense, web application firewalling.
   2. Components
      1. Compute
         1. GKE Security
         2. GCE Security
            1. Shielded VMs
            2. Confidential VMs
            3. Leveraging VPC Service Controls
            4. Disk Encryption
         3. Deploy a secured serverless architecture using Cloud Functions
         4. Deploy a secured serverless architecture using Cloud Run
         5. Compute and container security
      2. Access
         1. Network & Application Security in Google Cloud
         2. Traffic Director (Advanced Traffic Management)
         3. Cloud Armor
            1. DDoS protection
            2. WAF protection
            3. Adaptive Protection
         4. Managed SSL Certs
         5. Best practices for securing applications and API's using Apigee
10. 6 - Network Security
    1. Ideal
       1. Centrally manage network resources, establish scalable segmentation and detect network threats.
    2. Components
       1. Virtual Private Cloud
          1. Shared VPC
       2. Serverless VPC Connectivity (Ingress and Egress)
       3. Cloud Firewall
          1. Firewall Policies
          2. Firewall Insights
       4. Google Cloud Load Balancing
       5. Google Cloud IDS
       6. Best practices for VPC design
       7. Best practices for GKE networking
       8. Networking for hybrid and multi-cloud workloads: Reference architectures
       9. Networking for secure intra-cloud access: Reference architectures
       10. Networking for internet-facing application delivery: Reference architectures