Migrating to a public cloud is one of the most important challenges facing modern organizations. The choice of cloud provider affects not only performance and costs, but above all the level of data and IT infrastructure security. Google Cloud Platform (GCP) is one of the three dominant cloud platforms on the market, offering over 200 managed services — from computing and data storage, through Big Data analytics, to advanced artificial intelligence models. This article presents a comprehensive picture of GCP from a cybersecurity perspective: service architecture, security model, regulatory compliance, and practical aspects of secure deployment in an organization.
Definition and History of Google Cloud Platform
Google Cloud Platform is a set of cloud services provided by Google that enable organizations to build, test, and deploy applications on Google’s global infrastructure. GCP uses the same infrastructure that powers Google’s internal products — Search, YouTube, Gmail, and Google Maps — serving billions of users daily.
The history of GCP dates back to 2008, when Google launched App Engine — the first PaaS (Platform as a Service) offering that allowed developers to build web applications on Google’s infrastructure. In 2010, Cloud Storage appeared, followed by Compute Engine (IaaS) in 2012. The real breakthrough came in 2014, when Google began aggressively expanding its service portfolio, introducing BigQuery, Kubernetes Engine, and Cloud Dataflow, among others. Since 2018, under the leadership of Thomas Kurian (former Oracle president), GCP has focused on enterprise customers, expanding its security, compliance, and enterprise support offerings.
Currently, GCP operates in over 40 regions and 120+ availability zones across six continents. The physical infrastructure consists of data centers connected by a private fiber optic network with throughput exceeding 1 petabit per second. Each data center meets rigorous physical security standards, including multi-layered access control, 24/7 monitoring, and automatic fire suppression systems.
Key Google Cloud Platform Services
Understanding GCP’s service architecture is fundamental to informed security management. Each service category generates specific challenges in the context of cybersecurity and requires dedicated protection mechanisms.
Compute — Computing Services
Compute Engine is the foundation of IaaS in GCP — it allows running virtual machines (VMs) on Google’s infrastructure. It offers over 50 machine types, including instances with GPUs (NVIDIA T4, A100, H100) and TPUs for AI/ML computing. From a security perspective, it is crucial that Compute Engine supports Shielded VMs — virtual machines with secure booting (Secure Boot, vTPM, Integrity Monitoring) that protect against rootkits and bootkits at the hypervisor level.
Google Kubernetes Engine (GKE) is a managed container orchestration service based on Kubernetes. GKE Autopilot automatically manages node infrastructure, applying default security hardening policies, including pod isolation, automatic updates, and integration with Binary Authorization (verification of signed container images before deployment).
Cloud Functions and Cloud Run are serverless services that enable running code without managing infrastructure. Their security relies on short-lived, isolated execution environments — each function invocation runs in a separate sandbox based on gVisor, which minimizes the attack surface.
Storage — Data Storage
Cloud Storage is an object storage with high data durability (99.999999999% — the so-called “eleven nines”). It offers four storage classes (Standard, Nearline, Coldline, Archive), differentiated in terms of cost and access time. Every object is encrypted by default using AES-256. Users can apply Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK), maintaining full control over encryption keys.
Persistent Disk and Local SSD provide block storage for virtual machines, while Filestore offers managed NFS. All storage services support at-rest encryption and granular access control via IAM.
Databases
GCP offers managed databases covering nearly every data model:
- Cloud SQL — managed MySQL, PostgreSQL, and SQL Server with automatic backups, replication, and encryption.
- Cloud Spanner — a globally distributed relational database providing strong transactional consistency with unlimited scalability.
- BigQuery — a serverless data warehouse for analyzing petabytes of data in real time. BigQuery uses columnar encryption, automatic key management, and detailed data access logging.
- Firestore — a NoSQL document database with built-in offline synchronization and granular security rules at the document level.
- Bigtable — a low-latency key-value database used internally by Google Search and Gmail.
- Memorystore — managed Redis and Memcached for in-memory data caching.
AI and Machine Learning
In the AI/ML category, Google Cloud stands out from the competition. Vertex AI is a unified platform for building, training, and deploying ML models, integrating AutoML (no-code models) with Custom Training (custom models on GPU/TPU). Gemini — Google’s multimodal foundation model — is available directly through the Vertex AI API.
From a security standpoint, AI/ML services generate specific risks: training data leaks, adversarial attacks on models, and uncontrolled content generation. GCP addresses these challenges through Vertex AI Workbench with isolated notebooks, Model Monitoring (data drift detection), and VPC Service Controls to limit data exfiltration.
Networking — Network Services
Virtual Private Cloud (VPC) is the foundation of networking in GCP — a logically isolated private network with full control over IP addressing, subnets, routes, and firewall rules. Unlike AWS, VPC in GCP is global by default (spanning all regions), which simplifies multi-region architecture.
Cloud Load Balancing offers global load balancing with auto-scaling and DDoS protection built into the infrastructure layer. Cloud CDN accelerates content delivery, and Cloud DNS provides managed DNS with DNSSEC. Cloud Interconnect and Cloud VPN enable secure connection of on-premise infrastructure to GCP.
GCP Security Model
Security in Google Cloud Platform is based on the shared responsibility model, multi-layered infrastructure protection, and default encryption. This is one of the most important aspects that organizations must understand before migrating to the cloud.
Shared Responsibility — Who Is Responsible for What
The shared responsibility model precisely divides security responsibility between Google and the customer:
Google is responsible for:
- Physical security of data centers (access control, monitoring, media destruction).
- Hardware infrastructure (servers, disks, network switches with the dedicated Titan security chip).
- The hypervisor layer and isolation between tenants.
- Encryption of data at-rest and in-transit within Google’s network.
- Security of managed services (patching, updates).
The customer is responsible for:
- Configuration of access permissions (IAM policies, service accounts).
- Securing applications and data (business logic, input validation).
- Managing encryption keys (when using CMEK/CSEK).
- Network configuration (firewall rules, VPC, public vs. private access).
- Patching operating systems on Compute Engine (IaaS).
- Compliance with industry regulations.
The boundary of responsibility shifts depending on the service model: in IaaS (Compute Engine) the customer has the most responsibilities, in PaaS (App Engine, Cloud Run) Google takes over OS and middleware management, and in SaaS (Workspace, BigQuery) the customer is primarily responsible for data and access.
IAM — Identity and Access Management
Google Cloud IAM implements the principle of least privilege with granularity at the level of individual resources. The system includes:
- Roles — predefined (over 900 roles) and custom roles with precise permissions.
- Service Accounts — machine identities for applications and services, with automatic key rotation.
- Workload Identity Federation — identity federation enabling access from AWS, Azure, Active Directory, and OIDC without Service Account keys.
- Organization Policies — centralized organization-level policies restricting, for example, allowed regions, machine types, or public access to Cloud Storage.
- IAM Conditions — conditional access policies based on attributes (IP address, time of day, resource tag).
A critical element of IAM security is avoiding excessive permissions. Google provides IAM Recommender — an ML-based tool that analyzes actual permission usage and recommends reductions.
VPC and Network Segmentation
Network security in GCP is built on several layers:
- VPC Firewall Rules — stateful firewall rules defined at the VPC level, with prioritization and resource tagging. By default, all incoming traffic is blocked and all outgoing traffic is allowed.
- VPC Service Controls — define security perimeters around GCP resources, preventing data exfiltration even by authorized users. This is one of GCP’s strongest security features, with no direct equivalent in AWS or Azure.
- Private Google Access — allows machines without a public IP to communicate with Google services without traversing the public internet.
- Shared VPC — centralizes network management in a single host project, limiting the ability of individual teams to create uncontrolled network rules.
Cloud Armor — DDoS Protection and WAF
Cloud Armor is a managed web application protection service that includes:
- Protection against layer 3/4 DDoS attacks (built into Google’s infrastructure) and layer 7 attacks (WAF rules).
- Predefined WAF rules covering the OWASP Top 10 (SQL injection, XSS, RCE).
- Adaptive Protection — an ML-based mechanism that automatically detects traffic anomalies and suggests defensive rules.
- Rate limiting and geoblocking — traffic throttling per IP/region.
- Integration with Google’s global load balancer, providing protection at the network edge.
Cloud Armor is particularly significant because it uses the same infrastructure that protects Google Search, YouTube, and Gmail from DDoS attacks with volumes of hundreds of terabits per second.
Encryption
GCP applies encryption by default at three levels:
- At-rest — all data stored in GCP services is encrypted using AES-256. Google manages keys automatically (Google-managed keys), but the customer can use CMEK (Cloud KMS) or CSEK (customer-supplied keys).
- In-transit — traffic between the client and GCP is encrypted with TLS. Traffic within Google’s network (between data centers) is encrypted using ALTS (Application Layer Transport Security) — Google’s proprietary protocol.
- In-use — Confidential Computing (Confidential VMs, Confidential GKE Nodes) encrypts data in RAM using AMD SEV/SEV-SNP hardware encryption, protecting against access even by Google administrators.
Cloud KMS (Key Management Service) and Cloud HSM (a hardware security module compliant with FIPS 140-2 Level 3) provide centralized management of cryptographic keys with full operation logging.
Security Command Center
Security Command Center (SCC) is GCP’s native security management center, encompassing:
- Security Health Analytics — automatic detection of configuration errors (open Cloud Storage, public VMs, missing MFA).
- Event Threat Detection — real-time threat detection based on logs (malware, cryptomining, data exfiltration).
- Container Threat Detection — threat detection in GKE containers (suspicious processes, reverse shell).
- Web Security Scanner — automatic web application vulnerability scanner.
- Vulnerability Assessment — VM scanning for known CVEs.
SCC Premium integrates with Chronicle (Google’s SIEM/SOAR built on their search infrastructure), enabling correlation of security events across petabytes of logs with 12-month retention included in the subscription price.
GCP vs AWS vs Azure — Security Comparison
Choosing a cloud platform should consider not only functionality, but above all the maturity of security mechanisms and alignment with the team’s competencies.
| Criterion | GCP | AWS | Azure |
|---|---|---|---|
| Market share | ~12% | ~31% | ~25% |
| Strengths | AI/ML, Big Data, Kubernetes | Largest service ecosystem | Microsoft 365 integration |
| IAM | Granular roles, Workload Identity | Very extensive but complex | Entra ID (formerly Azure AD) |
| Network | Global VPC, VPC Service Controls | Regional VPCs, PrivateLink | Regional VNets, Private Link |
| WAF/DDoS | Cloud Armor + Adaptive Protection | AWS Shield + WAF | Azure DDoS + WAF |
| SIEM | Chronicle (built-in) | Security Lake + GuardDuty | Microsoft Sentinel |
| Encryption in-use | Confidential VMs (AMD SEV) | Nitro Enclaves | Confidential VMs (AMD SEV) |
| Zero Trust | BeyondCorp Enterprise | Verified Access | Entra + Conditional Access |
GCP stands out with default encryption at-rest and in-transit (in AWS, S3 at-rest encryption only became default in 2023), VPC Service Controls (a unique mechanism for preventing data exfiltration), BeyondCorp Enterprise (the first commercial Zero Trust implementation, based on Google’s internal model), and Chronicle — a SIEM built on Google’s search infrastructure, offering analysis of petabytes of logs at no additional cost for volume.
AWS has the advantage in number of services (200+), the largest partner ecosystem, and the longest market history, which translates into the greatest availability of experts and documentation.
Azure dominates in Microsoft-centric environments, offering native integration with Active Directory, Microsoft 365, and Microsoft Defender.
From a cybersecurity perspective, the choice of provider should be driven by team competencies, regulatory requirements, and the existing technology stack — not marketing comparisons. Each of the three platforms provides a sufficient level of security, provided it is properly configured.
Compliance and Regulatory Conformity
Google Cloud Platform holds some of the broadest security and regulatory compliance certifications in the cloud industry:
- ISO 27001, 27017, 27018 — international standards for information security management, cloud security, and personal data protection.
- SOC 1, SOC 2, SOC 3 — audit reports confirming the effectiveness of security, availability, and confidentiality controls.
- HIPAA — compliance with medical data protection regulations (requires signing a BAA — Business Associate Agreement with Google).
- PCI DSS — payment card data security standard (GCP is certified as a Level 1 Service Provider).
- FedRAMP High — certification for U.S. government institutions.
- C5 — the German BSI cloud security standard.
GDPR in the Context of GCP
For organizations operating in the European Union, ensuring compliance with GDPR is crucial. GCP addresses GDPR requirements through:
- Data residency — the ability to enforce data storage exclusively in EU regions (europe-west1 Belgium, europe-west3 Frankfurt, europe-west4 Netherlands, europe-central2 Warsaw, and others).
- Data Processing Addendum (DPA) — a data processing agreement compliant with Article 28 of GDPR, automatically available to GCP customers.
- Assured Workloads — a managed environment enforcing compliance controls (e.g., EU Sovereign Controls ensuring that encryption keys and data access remain under European control).
- Access Transparency — logs showing when and why Google employees accessed customer data.
- Access Approval — a requirement for explicit customer consent before Google employees can access data.
The europe-central2 (Warsaw) region is particularly important for Polish organizations, providing low latency and compliance with local data residency requirements.
Secure GCP Deployment in an Organization
Migrating to a public cloud requires a methodical approach in which security is considered from day one, rather than added as an afterthought. The following steps constitute a framework for secure GCP deployment.
Planning and Architecture
Before migration, the organization should conduct a risk assessment covering data classification (public, internal, confidential, top secret), identification of regulatory requirements, and definition of acceptable risk levels. Based on this, a Landing Zone is built — a baseline GCP architecture comprising:
- Organization node — a central management point with Organization Policies.
- Folder hierarchy — a folder structure reflecting the organization (e.g., production/development/sandbox).
- Project structure — separation of environments and workloads in dedicated projects.
- Shared VPC — a centralized network managed by the platform team.
- Centralized logging — aggregation of logs from Cloud Audit Logs to a central project.
Google provides the Cloud Foundation Toolkit — a set of Terraform modules for automatically deploying a secure Landing Zone aligned with best practices.
Identity Management
IAM configuration should implement the principle of least privilege:
- Identity federation with an existing provider (Active Directory, Okta, Google Workspace) via Cloud Identity or Workload Identity Federation.
- Enforcing MFA (multi-factor authentication) for all users.
- Using Service Accounts with short-lived tokens instead of long-term keys.
- Implementing Organization Policy constraints restricting the creation of Service Account keys.
- Regular permission reviews with IAM Recommender.
Network Protection
Network architecture should minimize the attack surface:
- Using Private Google Access and VPC Service Controls to limit internet communication.
- Deploying Cloud NAT for outbound traffic — without assigning public IPs to machines.
- Configuring hierarchical firewall rules with default traffic blocking.
- Leveraging Cloud Armor for web applications with public access.
- Connecting to on-premise infrastructure via Cloud Interconnect (dedicated link) or Cloud VPN (encrypted IPsec tunnel).
Monitoring, Auditing, and Incident Response
Secure operation of a GCP environment requires continuous monitoring, configuration auditing, and readiness to respond to security incidents.
Cloud Logging and Cloud Monitoring
Cloud Logging centrally aggregates logs from all GCP services, including:
- Admin Activity logs — administrative operations (creating/deleting resources, changing permissions). Enabled by default and cannot be disabled.
- Data Access logs — data reads/writes (BigQuery API logging, Cloud Storage). Require manual activation.
- System Event logs — infrastructure events (VM live migration, auto-scaling).
- Policy Denied logs — denied access attempts.
Cloud Monitoring (formerly Stackdriver) provides real-time metrics, alerts, and dashboards. It integrates with PagerDuty, Slack, and webhooks, enabling immediate notifications about anomalies.
Configuration Auditing
Regular configuration audits help detect deviations from the security baseline:
- Security Command Center — continuous configuration scanning against CIS Benchmarks and Google best practices.
- Forseti Security (open source) and Config Connector — infrastructure as code (IaC) with automatic policy enforcement.
- Policy Intelligence — IAM permissions analysis and restriction recommendations.
Incident Response
In the context of security incident response in a GCP environment, organizations should:
- Deploy Security Command Center Premium with Event Threat Detection for automatic threat detection.
- Configure Cloud Functions for automatic remediation (e.g., automatically closing a public Cloud Storage bucket).
- Integrate GCP logs with an external SOC for event correlation from other sources.
- Conduct regular tabletop exercises simulating incidents in a cloud environment.
Outsourcing monitoring to an external SOC is particularly valuable when an organization does not have a dedicated cloud security team. nFlo, with experience in over 500 projects and serving over 200 clients, supports organizations in building secure cloud environments — from configuration auditing, through monitoring implementation, to 24/7 SOC oversight.
Google Cloud Platform Costs
GCP’s pricing model is based on pay-as-you-go with several cost optimization mechanisms:
Basic Costs
- Compute Engine — from approximately $6/month for an e2-micro machine (2 vCPU, 1 GB RAM) to thousands of dollars for GPU instances. Per-second billing (minimum 1 minute).
- Cloud Storage — Standard: $0.020/GB/month, Nearline: $0.010/GB/month, Coldline: $0.004/GB/month, Archive: $0.0012/GB/month. Additional costs for operations and data transfer.
- BigQuery — on-demand: $6.25/TB of scanned data. Flat-rate: fixed pricing for reserved slots.
- GKE — cluster management fee $0.10/hour (Autopilot: $0.01/vCPU/hour + $0.0011/GB RAM/hour).
Cost Saving Mechanisms
- Sustained Use Discounts (SUD) — automatic discounts of up to 30% for continuous VM usage within a given month (no commitments required).
- Committed Use Discounts (CUD) — discounts of up to 57% for 1-3 year commitments on compute resources.
- Preemptible/Spot VMs — preemptible machines, up to 91% cheaper than regular VMs (ideal for batch processing, CI/CD).
- Free Tier — $300 credit for 90 days for new accounts plus always-free services (1 e2-micro VM, 5 GB Cloud Storage, 1 GB Firestore, 2 million Cloud Functions invocations/month).
Security Costs
It is worth accounting for security service costs:
- Security Command Center Premium — per-asset pricing, integrated with Chronicle SIEM.
- Cloud Armor — $5/month per policy + $0.75/million requests.
- Cloud KMS — $0.06/10,000 cryptographic operations + $0.06/month per key.
- Confidential VMs — approximately 20-25% price premium over standard VMs.
It is recommended to use budgets and alerts in the Billing Console and conduct regular cost reviews with the Recommender Hub tool, which identifies unused resources and suggests optimizations.
Summary
Google Cloud Platform is a mature cloud platform that stands out for its default encryption, advanced isolation mechanisms (VPC Service Controls, Confidential Computing), and native integration with security tools (Security Command Center, Chronicle). Its strengths in AI/ML and Big Data make it a natural choice for organizations investing in data analytics and artificial intelligence.
However, no cloud platform is secure “out of the box.” The shared responsibility model means that configuration, access management, and monitoring remain the customer’s responsibility. Misconfigured IAM, an open Cloud Storage bucket, or lack of network segmentation are the most common causes of security breaches in cloud environments — regardless of the provider.
Secure GCP deployment requires a comprehensive approach encompassing Landing Zone architecture, identity management, network segmentation, continuous monitoring, and incident response readiness. Organizations that do not have an internal cloud security team should consider partnering with a specialized provider — configuration auditing, cloud environment penetration testing, and SOC outsourcing can significantly reduce risk at controlled costs.
