Trust and Security with Google Cloud
Security and trust are foundational to cloud adoption. This chapter explains the shared responsibility model, core concepts like identity and access management, encryption, and defense in depth, and the Google Cloud tools that help organizations manage security and compliance. Understanding who is responsible for what is the most important takeaway.
The shared responsibility model
Security in the cloud is a shared responsibility between Google and the customer. Google secures the underlying infrastructure, including physical data centers, hardware, and the global network. The customer is responsible for securing what they put in the cloud: their data, applications, and access configuration. Exactly where the line falls depends on the service model. With IaaS the customer manages more, such as the operating system and application security, while with SaaS Google manages far more. Knowing that configuring access and protecting your own data is always the customer's job is a core exam concept.
Identity and access management
Cloud Identity and Access Management (IAM) controls who can do what on which resources. Following the principle of least privilege, administrators grant only the permissions each user or service needs, reducing the risk of accidental or malicious misuse. Strong identity practices, such as multi-factor authentication and carefully scoped roles, are a customer responsibility and a first line of defense. Because most breaches involve compromised credentials or over-broad permissions, disciplined IAM is one of the highest-impact security controls an organization can apply.
Encryption and defense in depth
Google Cloud encrypts customer data at rest and in transit by default. Encryption at rest protects stored data, while encryption in transit protects data as it moves across networks, so intercepted data remains unreadable. Defense in depth means layering multiple, overlapping security controls, such as network controls, identity controls, and encryption, so that no single failure exposes the system. This layered approach, combined with Google's secure-by-design infrastructure, helps protect workloads even when one control is bypassed.
Security tools and compliance
Google Cloud provides tools to help customers meet their security responsibilities. Security Command Center offers centralized visibility into misconfigurations, vulnerabilities, and threats across an organization's resources, helping teams find and fix risks. Network security features such as firewalls and Virtual Private Cloud controls limit exposure. Compliance matters because many industries must meet regulations covering data privacy and protection. Google Cloud maintains a broad set of compliance certifications, but customers remain responsible for configuring their environment and data handling to meet their specific obligations.