Data Loss Prevention GCP – DLP API
Bucketing This technique is ideal for large datasets (e.g. containing potentially sensitive data). It reduces the risk of matching sensitive data to identifying information. Redacting This uses obfuscation.…
Archive
Author: anuj
I am passionate about getting cloud solutions right the first time. I help customers transition to the public cloud with the appropriate security controls and guardrails. GCP, AWS and Azure Security Specialist.
Initial Consultation
DDos Prevention on GCP Hosted Applications
Use an SSL based Load Balancer This restricts you to either the HTTPs Global Load Balancer or SSL Proxy Use a Cloud CDN Cloud CDNs send requests all…
Containers on GCP – Runtime attacks versus Image Vulnerabilities
Runtime Attacks – Security Command Center – Premium Version Image vulnerabilities – Vulnerability Scanning in the Image Registry
Cloud Logging Buckets as Sink Logs in GCP
Often , corporate compliance requirements require that logs be stored for a certain number of years. This is easily accomplished in GCP – by setting up a sink…
Cloud Storage – Retention Policies and Object Lifecycles
Retention Policies and Object Lifecycles Object lifecycles are well understood in terms of storage classes – standard, nearline, coldline, archive. You can change the storage class of an…
Database Credentials in Google Cloud?
How and where do you store db Credentials in Google Cloud? Secrets manager allows you to store and retrieve credentials in either binary form (blob) or as plain…
Firewall Rules in GCP – Service Accounts versus Tags
Both – network tags – and Service accounts – are viable options (for target instances) when defining firewall rules. However, if both these exist for a certain VM,…
Private Google access
Private Google access allows your instances to reach Google APIs and services using an internal IP address rather than a public IP address. … You can enable Private Google access on a subnet…
Account Level IAM versus Application Level IAM access
Use Case A – You need to implement a central authorization mechanism for users of your App (say hosted on App engine) Use Case B – You need…
Cloud Storage – Granting access to external users – e.g. Auditors
The simplest thing to do is to create signed URLs (same as what you would do on AWS S3 buckets). The URL can be for the entire bucket…