Professional Cloud ArchitectDesign for security and complianceMedium
A global pharmaceutical company is building a research data platform on Google Cloud that will store highly sensitive patient genomic data. They need to ensure that the data is protected from unauthorized access and exfiltration, even by privileged Google Cloud administrators. The company also requires that data access is restricted to specific applications running within a tightly controlled perimeter, preventing data movement to unauthorized networks. Which Google Cloud security service is purpose-built to address these requirements?
- AVPC Service Controls
- BCloud Data Loss Prevention (DLP)
- CIdentity and Access Management (IAM)
- DCloud Armor
Show answer & explanationAnswer & explanation
Correct answer: A. VPC Service Controls
VPC Service Controls creates a security perimeter around Google Cloud resources, preventing data exfiltration and restricting access to authorized resources within the perimeter. This directly addresses the need to protect data from privileged administrators and prevent movement to unauthorized networks.
Why the other options are wrong
- B. DLP primarily focuses on identifying, classifying, and redacting sensitive data, not on creating network perimeters to prevent exfiltration.
- C. IAM manages who can do what on which resources but does not prevent data exfiltration across network boundaries or protect against privileged access within Google's control plane.
- D. Cloud Armor is a WAF/DDoS protection service, primarily for public-facing internet applications, not for internal data exfiltration prevention.
VPC Service Controls
VPC Service Controls helps mitigate data exfiltration risks by creating security perimeters around sensitive data and resources in Google Cloud.
- Creates security perimeters to isolate resources and data.
- Prevents data exfiltration to unauthorized networks.
- Offers enhanced protection against insider threats and compromised credentials.
Memory trick: VPC Service Controls acts like a digital moat, keeping data safe within its perimeter.