1. Security and Risk Management Overview
Security and Risk Management is the practice of identifying, assessing, and reducing risks that can impact:
- Confidentiality of information
- Integrity of data
- Availability of systems
- Business operations
- Compliance requirements
The goal is to protect assets while enabling business objectives.
2. Core Security Principles (CIA Triad)
The foundation of information security is the CIA Triad:
5
A. Confidentiality
Ensures information is accessible only to authorized users.
Examples:
- Encryption
- Access control
- Authentication
- Data classification
Example:
Only HR employees can access employee salary information.
Threats:
- Data leaks
- Unauthorized access
- Eavesdropping
Controls:
- IAM policies
- Encryption at rest and in transit
- Least privilege
B. Integrity
Ensures data is accurate and not modified improperly.
Examples:
- Hashing
- Digital signatures
- Checksums
Threats:
- Data tampering
- Malware modification
- Unauthorized changes
Controls:
- File integrity monitoring
- Audit logs
- Version control
C. Availability
Ensures systems and data are available when required.
Examples:
- Load balancing
- Backup systems
- Disaster recovery
Threats:
- DDoS attacks
- Hardware failure
- Natural disasters
Controls:
- High availability architecture
- Replication
- Failover systems
3. AAA Security Model
AAA means:
Authentication
“Who are you?”
Methods:
- Password
- MFA
- Biometrics
- Certificates
Example:
Google account login with password + OTP.
Authorization
“What are you allowed to do?”
Example:
User:
- Read files
Admin:
- Read/write/delete files
Accounting / Auditing
“What did you do?”
Tracks:
- Login events
- Changes
- Access history
Example:
Cloud Audit Logs.
4. Security Principles
1. Least Privilege
Give users only the permissions they need.
Example:
A developer does not need production database admin access.
Google Cloud:
- IAM roles
- Service accounts
2. Defense in Depth
Use multiple security layers.
Example:
Internet
|
Firewall
|
Load Balancer
|
Application Security
|
Database EncryptionIf one layer fails, others protect the system.
3. Zero Trust Security
Never trust automatically.
Principle:
“Verify everything, trust nothing.”
Requires:
- Identity verification
- Device verification
- Continuous monitoring
Google uses BeyondCorp architecture based on Zero Trust.
4. Separation of Duties
Split critical responsibilities.
Example:
Developer creates code.
Security team approves deployment.
Prevents abuse.
5. Need to Know
Users only access information required for their job.
Example:
Marketing employee does not access financial records.
5. Risk Management Concepts
What is Risk?
Risk is:
Probability of a threat exploiting a vulnerability causing damage.
Formula:
Risk = Threat × Vulnerability × Impact6. Risk Components
Asset
Something valuable.
Examples:
- Database
- Application
- Customer data
Threat
Something that can cause harm.
Examples:
- Hacker
- Malware
- Insider
Vulnerability
Weakness.
Examples:
- Unpatched software
- Weak password
- Incorrect permissions
Impact
Damage caused.
Examples:
- Financial loss
- Reputation damage
- Data loss
7. Risk Assessment
Steps:
1. Identify Assets
Find what needs protection.
Example:
Customer database.
2. Identify Threats
Example:
- SQL injection
- Phishing
- DDoS
3. Identify Vulnerabilities
Example:
Old software version.
4. Calculate Risk
Example:
High probability + high impact = Critical risk.
5. Apply Controls
Reduce risk.
8. Risk Treatment Strategies
There are four main approaches:
1. Risk Avoidance
Remove the risky activity.
Example:
Stop using unsupported software.
2. Risk Mitigation
Reduce probability or impact.
Example:
Install firewall.
3. Risk Transfer
Move risk to another party.
Example:
Cyber insurance.
4. Risk Acceptance
Accept risk if cost is too high.
Example:
Accept low-impact risk.
9. Security Controls
Controls protect systems.
Preventive Controls
Stop incidents.
Examples:
- Firewall
- MFA
- Encryption
Detective Controls
Find incidents.
Examples:
- Logs
- SIEM
- Monitoring
Corrective Controls
Fix problems.
Examples:
- Patch systems
- Restore backups
Deterrent Controls
Discourage attacks.
Examples:
- Warning banners
- Security policies
10. Security Governance
Governance defines:
- Policies
- Standards
- Procedures
- Responsibilities
Example:
Company security policy:
“All employees must use MFA.”
11. Security Policies
Important policies:
Password Policy
Defines:
- Password length
- Complexity
- Expiration
Acceptable Use Policy
Defines allowed system usage.
Data Protection Policy
Defines:
- Storage
- Access
- Sharing
Incident Response Policy
Defines what happens after security events.
12. Compliance and Regulations
Security must follow laws and standards.
Examples:
- GDPR
- ISO 27001
- SOC 2
- PCI DSS
- HIPAA
13. Business Continuity and Disaster Recovery
Business Continuity
Keeps business running.
Example:
Alternative systems during outage.
Disaster Recovery
Restores systems after failure.
Includes:
- Backup
- Recovery plan
- Testing
RTO and RPO
Recovery Time Objective (RTO)
How quickly must service recover?
Example:
Application must recover within 1 hour.
Recovery Point Objective (RPO)
How much data loss is acceptable?
Example:
Maximum 15 minutes of lost data.
14. Incident Management
Security incident lifecycle:
Preparation
|
Detection
|
Containment
|
Eradication
|
Recovery
|
Lessons Learned15. Threat Modeling
Identify possible attacks before deployment.
Common model:
STRIDE
S – Spoofing
T – Tampering
R – Repudiation
I – Information Disclosure
D – Denial of Service
E – Elevation of Privilege
16. Cloud Security Concepts (Google Cloud Focus)
Shared Responsibility Model
Cloud provider protects:
- Physical infrastructure
- Hardware
- Data centers
Customer protects:
- Data
- IAM
- Applications
- Configurations
Identity and Access Management (IAM)
Controls:
Who can access what.
Components:
- Principal
- Role
- Permission
- Resource
Encryption
Two types:
Encryption at Rest
Protects stored data.
Examples:
- Disk
- Database
- Storage
Encryption in Transit
Protects moving data.
Example:
TLS/HTTPS
17. Security Monitoring
Tools and concepts:
- Logging
- Alerting
- SIEM
- Threat detection
Google Cloud examples:
- Cloud Logging
- Security Command Center
- Cloud Monitoring
18. Common Security Attacks
Phishing
Fake messages to steal credentials.
Protection:
- MFA
- User training
Malware
Malicious software.
Types:
- Virus
- Trojan
- Ransomware
DDoS
Overloads systems with traffic.
Protection:
- Load balancing
- DDoS protection
Insider Threat
Threat from authorized users.
Protection:
- Monitoring
- Least privilege
19. Exam Important Points
Remember these:
| Concept | Key Idea |
|---|---|
| CIA | Confidentiality, Integrity, Availability |
| AAA | Authentication, Authorization, Accounting |
| Least privilege | Minimum access |
| Zero Trust | Verify everything |
| Defense in depth | Multiple security layers |
| Risk | Threat + vulnerability + impact |
| RTO | Recovery time |
| RPO | Data loss tolerance |
| IAM | Access management |
| Encryption | Protect data |
Google Certification Focus Areas
For Google Cloud security exams, concentrate on:
- IAM and permissions
- Security architecture
- Risk assessment
- Data protection
- Compliance
- Incident response
- Monitoring and logging
- Network security
- Zero Trust
- Disaster recovery
This covers the Security and Risk Management + Security Concepts and Principles domain expected in Google security certification preparation.
1. Security and Risk Management Overview
Security and Risk Management is the practice of identifying, assessing, and reducing risks that can impact:
- Confidentiality of information
- Integrity of data
- Availability of systems
- Business operations
- Compliance requirements
The goal is to protect assets while enabling business objectives.
2. Core Security Principles (CIA Triad)
The foundation of information security is the CIA Triad:
5
A. Confidentiality
Ensures information is accessible only to authorized users.
Examples:
- Encryption
- Access control
- Authentication
- Data classification
Example:
Only HR employees can access employee salary information.
Threats:
- Data leaks
- Unauthorized access
- Eavesdropping
Controls:
- IAM policies
- Encryption at rest and in transit
- Least privilege
B. Integrity
Ensures data is accurate and not modified improperly.
Examples:
- Hashing
- Digital signatures
- Checksums
Threats:
- Data tampering
- Malware modification
- Unauthorized changes
Controls:
- File integrity monitoring
- Audit logs
- Version control
C. Availability
Ensures systems and data are available when required.
Examples:
- Load balancing
- Backup systems
- Disaster recovery
Threats:
- DDoS attacks
- Hardware failure
- Natural disasters
Controls:
- High availability architecture
- Replication
- Failover systems
3. AAA Security Model
AAA means:
Authentication
“Who are you?”
Methods:
- Password
- MFA
- Biometrics
- Certificates
Example:
Google account login with password + OTP.
Authorization
“What are you allowed to do?”
Example:
User:
- Read files
Admin:
- Read/write/delete files
Accounting / Auditing
“What did you do?”
Tracks:
- Login events
- Changes
- Access history
Example:
Cloud Audit Logs.
4. Security Principles
1. Least Privilege
Give users only the permissions they need.
Example:
A developer does not need production database admin access.
Google Cloud:
- IAM roles
- Service accounts
2. Defense in Depth
Use multiple security layers.
Example:
Internet
|
Firewall
|
Load Balancer
|
Application Security
|
Database EncryptionIf one layer fails, others protect the system.
3. Zero Trust Security
Never trust automatically.
Principle:
“Verify everything, trust nothing.”
Requires:
- Identity verification
- Device verification
- Continuous monitoring
Google uses BeyondCorp architecture based on Zero Trust.
4. Separation of Duties
Split critical responsibilities.
Example:
Developer creates code.
Security team approves deployment.
Prevents abuse.
5. Need to Know
Users only access information required for their job.
Example:
Marketing employee does not access financial records.
5. Risk Management Concepts
What is Risk?
Risk is:
Probability of a threat exploiting a vulnerability causing damage.
Formula:
Risk = Threat × Vulnerability × Impact6. Risk Components
Asset
Something valuable.
Examples:
- Database
- Application
- Customer data
Threat
Something that can cause harm.
Examples:
- Hacker
- Malware
- Insider
Vulnerability
Weakness.
Examples:
- Unpatched software
- Weak password
- Incorrect permissions
Impact
Damage caused.
Examples:
- Financial loss
- Reputation damage
- Data loss
7. Risk Assessment
Steps:
1. Identify Assets
Find what needs protection.
Example:
Customer database.
2. Identify Threats
Example:
- SQL injection
- Phishing
- DDoS
3. Identify Vulnerabilities
Example:
Old software version.
4. Calculate Risk
Example:
High probability + high impact = Critical risk.
5. Apply Controls
Reduce risk.
8. Risk Treatment Strategies
There are four main approaches:
1. Risk Avoidance
Remove the risky activity.
Example:
Stop using unsupported software.
2. Risk Mitigation
Reduce probability or impact.
Example:
Install firewall.
3. Risk Transfer
Move risk to another party.
Example:
Cyber insurance.
4. Risk Acceptance
Accept risk if cost is too high.
Example:
Accept low-impact risk.
9. Security Controls
Controls protect systems.
Preventive Controls
Stop incidents.
Examples:
- Firewall
- MFA
- Encryption
Detective Controls
Find incidents.
Examples:
- Logs
- SIEM
- Monitoring
Corrective Controls
Fix problems.
Examples:
- Patch systems
- Restore backups
Deterrent Controls
Discourage attacks.
Examples:
- Warning banners
- Security policies
10. Security Governance
Governance defines:
- Policies
- Standards
- Procedures
- Responsibilities
Example:
Company security policy:
“All employees must use MFA.”
11. Security Policies
Important policies:
Password Policy
Defines:
- Password length
- Complexity
- Expiration
Acceptable Use Policy
Defines allowed system usage.
Data Protection Policy
Defines:
- Storage
- Access
- Sharing
Incident Response Policy
Defines what happens after security events.
12. Compliance and Regulations
Security must follow laws and standards.
Examples:
- GDPR
- ISO 27001
- SOC 2
- PCI DSS
- HIPAA
13. Business Continuity and Disaster Recovery
Business Continuity
Keeps business running.
Example:
Alternative systems during outage.
Disaster Recovery
Restores systems after failure.
Includes:
- Backup
- Recovery plan
- Testing
RTO and RPO
Recovery Time Objective (RTO)
How quickly must service recover?
Example:
Application must recover within 1 hour.
Recovery Point Objective (RPO)
How much data loss is acceptable?
Example:
Maximum 15 minutes of lost data.
14. Incident Management
Security incident lifecycle:
Preparation
|
Detection
|
Containment
|
Eradication
|
Recovery
|
Lessons Learned15. Threat Modeling
Identify possible attacks before deployment.
Common model:
STRIDE
S – Spoofing
T – Tampering
R – Repudiation
I – Information Disclosure
D – Denial of Service
E – Elevation of Privilege
16. Cloud Security Concepts (Google Cloud Focus)
Shared Responsibility Model
Cloud provider protects:
- Physical infrastructure
- Hardware
- Data centers
Customer protects:
- Data
- IAM
- Applications
- Configurations
Identity and Access Management (IAM)
Controls:
Who can access what.
Components:
- Principal
- Role
- Permission
- Resource
Encryption
Two types:
Encryption at Rest
Protects stored data.
Examples:
- Disk
- Database
- Storage
Encryption in Transit
Protects moving data.
Example:
TLS/HTTPS
17. Security Monitoring
Tools and concepts:
- Logging
- Alerting
- SIEM
- Threat detection
Google Cloud examples:
- Cloud Logging
- Security Command Center
- Cloud Monitoring
18. Common Security Attacks
Phishing
Fake messages to steal credentials.
Protection:
- MFA
- User training
Malware
Malicious software.
Types:
- Virus
- Trojan
- Ransomware
DDoS
Overloads systems with traffic.
Protection:
- Load balancing
- DDoS protection
Insider Threat
Threat from authorized users.
Protection:
- Monitoring
- Least privilege
19. Exam Important Points
Remember these:
| Concept | Key Idea |
|---|---|
| CIA | Confidentiality, Integrity, Availability |
| AAA | Authentication, Authorization, Accounting |
| Least privilege | Minimum access |
| Zero Trust | Verify everything |
| Defense in depth | Multiple security layers |
| Risk | Threat + vulnerability + impact |
| RTO | Recovery time |
| RPO | Data loss tolerance |
| IAM | Access management |
| Encryption | Protect data |
Google Certification Focus Areas
For Google Cloud security exams, concentrate on:
- IAM and permissions
- Security architecture
- Risk assessment
- Data protection
- Compliance
- Incident response
- Monitoring and logging
- Network security
- Zero Trust
- Disaster recovery
This covers the Security and Risk Management + Security Concepts and Principles domain expected in Google security certification preparation.