-
Datacenter security
- Cloud providers secure the physical data center
- Hardware taken out of service is destroyed
- Data centers access is limited
- Providers performs background checks on employees
- Employees access is limited to areas needed to perform their job
-
Hierarchy
- Organizations can have one or more folders
- Folders can contain other folders and projects
- IAM restricts access to project resources
- Enables separation by service, but not by VPC
- Primary method of full isolation between environments
- Project-wide IAM roles grants access to all VPCs
- Projects can be further divide into VPCs
- Use projects, VPC and Firewalls to isolate resources
- Apply the principle of least privilege
-
Intrusion protection
-
Web Application Firewall
- Works with Global HTTPS(S) Load Balancer
- Provides built-in defence against infrastructure DDoS attacks
- Uses security policies made up of rules that allow or prohibit traffic
- Implemented in POP at edge of the network
- Paired with load balancers to block malicious traffic
- Supports HTTP, HTTPS, and HTTP/2
- Security policies deny list and allow list rules
- Can be specified for backend services
- Deny or allow list for IP/CIDR range IPv4/IPv6
- Designate the order of the rules
- Preview the effect of rules without going live
- Logs policy name, matched rule priority, associated action and related information
-
Features
- DDoS, SQL Injection, Cross Site Scripting
- IP whitelist/blacklist controls
- Geo-based Access Control
- Allow and deny rules
-
Implementation
- Create policy with rule
- Supply IP ranges to apply rule
- On rule/IP match, allow or deny traffic
- Overlap rules with different priorities
- Apply policies to target, e.g. load balancer
-
Access control
-
Linux
-
OS Login role
- Only able to connect to instances
- Per instance or project wide access
- Enable OS Login in metadata
- OS Login and Service Account user roles required to connect
- External GCP users require OS Login External User role
-
Compute Instance Admin role
- Connect via SDK
- No need to create and store own SSH keys
-
Own SSH public/private keys
- Independent of IAM and SDK
- User is responsible for key management
- Manually generated public/private keys
- Public key added to project or per-instance meta data
- Allows access from outside of cloud
- Connects with 3rd party tools outside of cloud
-
Windows
- RDP (tcp:3389)
- Username/password handled by instance
- Independent of IAM
- Compute instance admin role to reset password
-
Secure Connection
-
Protect internet-facing Compute instances
- Firewalls
- HTTPS/SSL
- Port forwarding over SSH
- SOCKS proxy over SSH
-
Connect to instances without external IPs
- Bastion host and SSH forwarding
- Cloud IAP for TCP forwarding
- VPN
- NAT gateway
- Interactive serial console access
- HTTPS and SSL proxy load balancers
-
IAM Policy
- Network Admin: Create, edit, delete network resources, except firewall rules, SSL certs
- Security Admin: Create, edit, delete network firewall rules, SSL certs, but not network resource
- Network User: Use network resources. Cannot create or delete
- Network Viewer: Readonly access to networking resources
- Compute Instance Admin: Create, modify and delete GCE resources
- Export policy YAML or JSON, edit and apply
-
IAP
-
Overview
- Establishes a central authorization layer for applications accessed by HTTPS
- Uses an application-level access control model
- Controls HTTPS access to applications and virtual machines
- Central anthorization layer for application-level access control
- Enforces access control policies for applications and resources
- Allows employees to work from untrusted networks without the use of a VPN
-
Operation
- User hits IAP proxy
- IAP-enabled app or backend service authenticated
- Credentials validated
- Authorization check to verify user access
-
Context-Aware Access
- Access web applications and infrastructure resources from virtually any device, anywhere
- VPN-less user access
- Integrated with Identity and WAF
- Supports cloud or on-premises
-
Signed Headers
- Uses JSON Web Token (JWT) to make sure that a request to the app is authorized
- Provides secondary security in case someone bypasses IAP
-
TCP Forwarding
- Controls who can access administrative services such as SSH and RDP over the public Internet
- Prevents these services from being openly exposed to the Internet
- Must pass authentication and authorization checks before they get to their target resource
-
Best Practices
- CDNs may cache content and serve cached pages to unauthenticated users
- To properly secure applications, use signed headers
- Make sure all requests to are routed via a Load balancer
- Configure a firewall rule to allow health checking
- Configure source traffic to be routed through Google Frontend
-
VPC
-
Overview
- Virtual version of a physical network
- Global software defined network
- Provides connectivity between resources
- Core resource for all network functions
- Segmented into subnets
- Works with firewall rules and routes
- Subnets are regional resources, span multiple zones
- Projects have one or more VPCs
- Connect with on-premises through Interconnect or VPN
- VPC include one or more Regions
- Regions can have one or more subnets
- VPC separates resources (e.g. instances)
- Can have multiple VPCs per project
- Resources in same VPC accessible via private IP (RFC 1918)
- Use VPNs or network peering for secure access between different networks
- Global access to the same private network
- Project users have access to all VPCs
- IAM roles control across by GCP service, not VPC
-
Routing
- Routes define paths for in/out bound packets
- Firewall rules control traffic in and out of the VPC
- Firewall rules apply to both ingress and egress traffic
- Private Google Access is an option for internal communication only
- Connect with on-premises through Interconnect or VPN
-
Roles
- Administration is secured via IAM
- VPC Networking baked into Compute Engine IAM Role
- Compute Admin is granted full access to instance and network admin roles
- Compute Network Admin has full network admin role
-
Limitations
- A network must have at least one subnet
- VPC networks support IPv4 unicast traffic
- No IPv6 traffic support within the network
- IPv6 address support for global load balancers
-
Address
- Disable external IP
- Place resource on Internal network
- Use IAP, NAT or bastion host
-
Firewall
-
Overview
- Separate access by network traffic and location
- Manages Ingress and Egress traffic
- Allow or deny traffic to and from VMs based on configuration
- Defined at the network level, but enforced at the instance level
- Firewall rules are always enforced
- Firewall rules are stateful
- By default, all ports are closed
- Firewall rules control access to ports
- GRE traffic is always blocked
- Protocols other than TCP, UDP, ICMP and IPIP is blocked
- Egress traffic on TCP port 25 (SMTP) is blocked
- DHCP, DNS, Instance metadata (169.254.169.254) and NTP is always allowed
- Implied 'deny all' ingress and 'allow all' egress
-
Limit access by
- Port
- IP address/range
- Between subnets
- Tags
- Service accounts
-
Components
- Direction: Ingress/egress
- Source: traffic location source rule is applied to
- Target: all instances, tagged instances, or service accounts
- Protocol/port: specified for TCP, UDP, ICMP, SSH
- Action: Allow/deny
- Priority is higher for lowest number
- Deny rule is applied over allow rule when priorities match
- Enforcement status can be Enabled or Disabled
-
Network Tags
- Tags can be used to determine which rules apply to particular machines
- Used to apply firewall rules and routes to specific instances
- Apply to VPC network with instance primary interface
- Can be used in different networks for different purposes
- Does not need to be unique
-
Logging
- Logs every firewall connection attempt
- Useful for auditing, verifying and analysing effect of rules
- Applied per firewall rule, across entire VPC
- Creates connection record when rule allows/denies traffic
- Larger machine types log more firewall connections per interval
- TCP/UDP protocols only
- Default "deny all" ingress and "allow all" egress rules are NOT logged
- Can be exported to BigQuery or PubSub for analysis
-
Load balancer/health check interactions
- Firewall controls access at an instance level, not LB
- Must allow LB traffic to connect to backend instances
- Must allow health check traffic to backend instances
- Network load balancer = 209.85.152.0/22,209.85.204.0/22 and 35.191.0.0/16
- HTTP(S)/SSL Proxy/TCP Proxy/Internal LB = 130.211.0.0/2 and 35.191.0.0/16
-
Shared VPC
- Adopt the principle of least priviledge for network administration, auditing and access control
- Organizational Administrator: Full control
- Shared VPC Admin: Administers shared VPC for the organization
- Service Project Admins: Maintains ownership and control over service project resources
- Network Admins: Full control over all network resources except firewall rules and SSL certificates
- Security Admins: Manage firewall rules and SSL certificates
-
Roles
- Grant service project service accounts the host project Network User Role
- Grant service project service account the Host Service Agent User role in the host project
- Grant service project Google API service account the Network User role in the host project
-
DNSSEC
- Authenticates responses to domain name lookups
- Protects domains from spoofing and cache poisoning attacks
- Provides strong authentication (but not encryption) of domain lookups
- Both registrar and registry must support DNSSEC for the TLD in use
- To enable DNSSEC, add DS record to TLD at registrar
- Enable DNSSEC on the domain
-
DDoS
-
Overview
- Attempts to render services unavailable to its end users
- Attackers use a large number of compromised hosts to orchestrate large-scale attacks against targets
-
Protecting shared infrastructure
- Mechanism in place to protect shared infrastructure
- Ensures no single service can overwhelm the infrasttucture
- Provides isolation among customers using the shared infrastructure
-
DDoS defense involves
- Deploying detection systems
- Implementing barriers
- Absorbing attacks by scaling to prevent attackes from disabling access to services
-
Shared responsibility model
- Google provided mechanism
- Best practices to implement
-
Reduce the attack surface
- Isolate and secure network using subnets, firewall rules, tags and IAM
- Use firewall rules and/or protocol forwarding
- Anti-spoofing protection provided for the private nerwork by default
- Automatic isolation between virtual networks
-
Isolate internal traffic from the external world
- Deploy instances without public IPs unless necessary
- Set up a NAT gateway or SSH bastion to limit the number of instances exposed to the Internet
- Deploy internal load balancing that access internal deployed services to avoid exposure
-
Enable Proxy-Based Load Balancing
- HTTP(S) or SSL proxy load balancing allows Google infrastructure to absorb layer 4 and below attacks
- SYN floods, IP fragment floods, port exhaustion, etc
- Disperse attacks, across the globe with HTTP(S) load balancing to instances in multiple regions
-
Scale to absorb the attack
- Protection by Google Frontend infrastructure, GLB
- Scales to absorb cetain types of attacks, e.g. SYN floods
- Anycast-based load balancing with HTTP(S) and SSL proxy load balancers
-
Protection with CDN Offloading
- Google Cloud CDN acts as a proxy
-
3rd Party DDoS Protection Solutions
- 3rd party solutions can protect against DDoS attacks
-
App Engine Deployment
- Fully multi-tenant system
- Safeguards in place
- Sits behind the Google frontend
- Specify a set of IPs/IP networks
-
Google Cloud Storage
- Use signed URL to access GCS
-
API Rate limiting
- Define number of allowed requests to Compute Engine API
- API rate limits apply on a per project basis
- Projects are limited to an API rate limit of 20 requests/second
-
Resource Quotas
- Quotas help prevent unforseen spikes in usage
-
Storage
- Securely interact with cloud storage
- Access Control methods: IAM, ACL, Signed URL
- Use IAM for Bucket level permissions
- Use ACL and Signed URL for Object level permission
- Signed URL does not require Google Cloud account
- Signed URL enables users to securely access their data
- Expires after a set period of time
-
Best Practices
-
Networking
- Use Internal IP and Private Google Access
- Start with single VPC network for resources with a common requirement
- Create a VPC for each team and connect to a shared service VPC
- Isolate sensitive data in own VPC
-
Optimise cost, performance and security
- VPC network peering
- External vs internal routing
- VPN vs Interconnect
-
Secure and protect applications
- Load Balancer
- Cloud Armor
- IAP
- Security Command Center
-
VPC Flow Logs
- Network monitoring
- Forensics
- Realtime security analysis
- Expense optimisation