External workloads often need to call Google Cloud APIs, but the way they obtain credentials changes the security model dramatically. A downloaded service-account key is […]
PCSE
Google Cloud PCSE: VPC Service Controls and Access Context Manager
Identity and Access Management answers whether a principal is allowed to perform an action. VPC Service Controls adds a different question: even if the principal […]
Google Cloud PCSE: CMEK, Cloud HSM, or Cloud EKM?
Google Cloud encryption discussions often mix together three terms that describe different layers of the design. Customer-managed encryption keys, or CMEK, describe an integration in […]
Google Cloud PCSE: Binary Authorization and Artifact Analysis
Container security is not solved by scanning an image once, and it is not solved by blocking unsigned images without knowing what the signature means. […]
Google Cloud PCSE: Security Command Center, Threat Detection & Cloud IDS
Security Command Center, Event Threat Detection, and Cloud IDS all surface security findings, but they occupy different positions in the detection architecture. Security Command Center […]