New developments in Access Risk, Cloud Governance And IAM
Google Cloud's mission is to assist you meet shifting policy, regulatory, and commercial goals. It routinely releases new cloud platform security features and controls to strengthen your cloud environment.
Google Cloud Next introduced IAM, Cloud Governance, and Access Risk capabilities. Google Cloud launched numerous new features and security upgrades, including:
Access and Identity Management
Identity Threat Detection and Response, and VPC Service Controls mitigate access risk.
Using Organisation Policy Service for Cloud Governance and Resource Management
It also introduced new AI technologies to enable cloud operators and developers throughout the application lifecycle. New Gemini Code Assist and Gemini Cloud Assist functionalities provide application-centered AI help throughout the application development lifecycle.
Identity and Access Management updates
Workforce Identity Federation
Workforce Identity Federation extends Google Cloud's identity capabilities with syncless, attribute-based single sign-on. Over 95% of Google Cloud products support Workforce Identity Federation. FedRAMP High government standards were supported to help manage compliance.
Increased non-human identity security
Due to microservices and multicloud deployments, workload and non-human identities are growing faster than human identities. Many large organisations contain 10 to 45 times more non-human identities than human identities, which often have wide rights and privileges.
Google Cloud is announcing two new features to strengthen access control and authorisation to secure non-human identities:
X.509 certificates provide keyless Google Cloud API access, enhancing workload authentication.
Managed Workload Identities allow workload-to-workload communication using SPIFFE-based mutual TLS (mTLS) encryption, secure identification, and authentication.
CIEM for multicloud infrastructure
Google Cloud is fighting excessive and unjustified security permissions. Google Cloud offers comprehensive protection across all tiers and tools to manage permissions to proactively address the permission issue.
Cloud Infrastructure Entitlement Management (CIEM), its main authorisation solution, is currently available for Azure and broadly available for Google Cloud and AWS.
It also included IAM Admin Centre, a role-specific single pane of glass for tasks, recommendations, and notifications. Additional services are accessible from the console.
IAM Admin Centre lets organisation and project administrators discover, learn, test, and use IAM functionalities from one place. It provides contextual feature discovery, daily work focus, continuing learning tools, and well designed beginning instructions.
IAM functionality enhancements
Other IAM features expanded and became more robust.
Google Cloud previously unveiled the Principal Access Boundary (PAB) and IAM Deny policies, which are effective resource access limitations. As these important controls gain service coverage and acceptance, planning and visualisation tools are needed.
It previewed Deny, PAB, and troubleshooters to fix this.
Privileged Access Manager (PAM) now has two authorisation levels with several principals. Scope entitlement grants may now be customised to apply just to the relevant resources, roles, projects, and folders.
Comprehensive security requires ongoing monitoring and control, even with authenticated users and workloads with the necessary privileges and active session participation. Google Cloud's access risk portfolio protects people, workloads, and data with dynamic features.
Improved session and access security
CAA protects Google Cloud access based on user identification, network, location, and corporate-managed devices, among other things.
CAA will soon include Identity Threat Detection and Response (ITDR) capabilities using activity signals like questionable source activity or new geolocations. These features automatically detect problematic conduct and initiate security validations like MFA, re-authentication, or rejections.
Automatic re-authentication sends a request when users change billing accounts or perform other sensitive tasks. Although you may disable it, Google Cloud recommends leaving it on by default.
Increased VPC Service Control coverage
You can protect your data, resources, and designated services using VPC Service Controls. It introduced Violation Analyser and Violation Dashboard to help diagnose and debug access denial events using VPC Service Controls.
Changes to Cloud Governance with Organisation Policy Service
Increased Custom Organisation Policy coverage
Google Cloud's Organisation Policy Service allows programmatic, centralised resource management. Organisation policy provides constraints, but you may create custom policies for additional control. With 62 services, custom organisation policy covers more.
Increased Custom Organisation Policy coverage
Google Cloud promises to simplify high-security outcomes. Google Cloud launched its Google Cloud Security Baseline, a stronger set of security settings, as part of this effort. Due to positive response, it is now advertising them to all current consumers. Last year, all new customers received them by default.
Users' consoles have seen Google Cloud Security Baseline implementation recommendations since this year. You may also use a simulator to mimic how these restrictions affect your environment.
Updates on resource management
Resource Manager app capability
The Google Cloud Resource Manager was likewise application-centric. App-enabled folders, presently in preview, simplify administration, organise services and workloads into a single manageable unit, centralise monitoring and management, and show an application-centric perspective.
