CIS vs. PCI DSS vs. NIST 800-53 vs. ISO 27001 – Frameworks compared
CIS vs PCI DSS vs NIST 800-53 vs ISO 27001 CIS vs. PCI DSS vs. NIST 800-53 vs. ISO 27001 CIS, PCI DSS, NIST 800-53, and ISO 27001…
Archive
Category: Google Cloud Platform
Certified GCP Architect, offering Advanced GCP Infrastructure, Google Cloud Identity and Access Management, Security Guardrails, Data Compliance and DevOps for GCP
Sample GKE constraints for common use cases
Sample GKE constraints for common use cases The following sections provide the syntax of some custom constraints that you might find useful: Description Constraint syntax Do not disable…
Editor Role in GCP – Beware of Service Account Privileges
While only an OWNER can create service accounts, an EDITOR too can manipulate existing service accounts. If a project contains service accounts , the Editor roles grant permission…
GKE Control Plane and Public IPs and Private Service Connect
By default, when you create a public cluster, GKE assigns an external IP address (external endpoint) to the control plane and provisions public nodes. This means that any…
Short lived access tokens in GCP – Service account impersonation
GCP Service Account Impersonation Explained | Secure Short-Term Access Service account keys provide long lived access. One often has to provide short term access to GCP resources. That’s…
Using only Trusted Images in GCP Projects
Step 1 – Create a separate project – and store all hardened images in it. Step 2 – Enforce the Org Policy – Define trusted image project. This…
OS patch management on GCP Compute Engine VMs
VM Manager API is the service to use. Enable a feature called OS Patch Management in there.
Service Account Key Rotation in GCP
Create a new service account key Switch applications to use the new key Destroy the old key
Account Level IAM versus Application Level IAM access
Use Case A – You need to implement a central authorization mechanism for users of your App (say hosted on App engine) Use Case B – You need…
Cloud Identity versus Google Workspace
User management in Workspace occurs through admin.google.com (not a cloud console) However, with cloud identity, you can now manage users directly from the GCP console. This means that…