DDoS mitigation and prevention on Google Cloud

1. DDoS mitigation and prevention on Google Cloud

Now let's review some DDoS mitigation techniques that are provided by Google Cloud. When you build an application on your on-premises infrastructure, you’re responsible for the entire stack’s security: from the physical security of the hardware and the premises in which they are housed, through the encryption of the data on the disk, the integrity of your network, and all the way up to securing the content stored in those applications. When you move an application to Google Cloud, Google handles many of the lower layers of security. Because of its scale, Google can deliver a higher level of security at these layers than most of our customers could afford to do on their own. Creating secure applications requires a multi-faceted approach which has been customized to fit your business needs, vulnerabilities, and resources. Properly understanding the different options available when facing a DDoS attack can help your organization create a plan to minimize the impact. Let’s look at these generalized strategies in more detail and discuss how Google Cloud helps you implement them. In this lesson, you will learn more about: Leveraging Google’s load balancer, reducing the network attack surface, isolating internal traffic, using Cloud CDN, using API management and monitoring, and leveraging the Google Cloud Armor defense service. Google Cloud’s load balancer provides built-in defense against infrastructure DDoS attacks - and no additional configuration is needed. Placing a load balancer in front of your services will filter known-bad traffic streams before they reach your resources. Google Cloud offers load balancing at layer 4 (the transport layer, such as TCP or UDP) and layer 7 (the application layer, generally HTTP or HTTPS.) The layer 4 load balancers automatically protect against things like UDP floods and TCP SYN floods. The layer 7 load balancers provide layer 4 protections plus protection from connection- based attacks like Slowloris. Google Cloud load balancers leverage Google’s global DoS mitigation service. If the system detects an attack, it will automatically configure the load balancers to drop or throttle traffic. An attack surface of a software environment is the sum of the different points where an unauthorized user can try to enter data to or extract data from an environment. Keeping the attack surface as small as possible is a basic security measure. Reduce attack surface means reducing how much exposure your VMs have to the Internet. You should host Compute Engine resources that require network communication on the same VPC network. If the resources aren’t related and don’t require network communication among themselves, consider hosting them on different VPC networks. For most applications implemented in Google Cloud, Google also recommends creating separate subnets within a network for each tier of an application, for example, web frontend, services layer, and database backend. That is because subnetting is a convenient way to implement inter-network firewall restrictions. You can control individual ingress and egress traffic for compute resources using firewall rules. Be sure you are blocking both unused ports as well as unwanted sources. Remember, you can use firewall tags and service accounts to help control which targets to use for firewall rules. It is also important to ensure you restrict external traffic within your VPCs. Virtual machines should not be given public IP addresses unnecessarily. Even if you need to connect to the VM from the internet, leveraging solutions like bastion hosts can help restrict the internal traffic. These solutions are covered in the Securing Compute Engine module of the Security Best Practices in Google Cloud course. You can also connect your on-premise network with your VPC network using VPN IPsec Tunnels or Dedicated Interconnect. Google’s Cloud Content Delivery Network (or CDN) is used to cache web content at over 90 edge locations, or points of presence (POPs), around the globe. Cloud CDN provides very similar protection as Google’s load balancers. In addition, requests for your content are routed to Google’s POPs rather than directly to your resources. Thus, Google Cloud’s resilient network infrastructure absorbs the brunt of attacks. This also naturally reduces the load on your resources even when there are no attacks. For IT, network and DevOps teams, allowing access to backend services is often required to facilitate interactions between applications, services, customers, and business partners. This access can also introduce vulnerabilities and challenges. Putting an API gateway, or API management, in front of your backend services can help prevent denial of service attacks by: Throttling requests to limit the number of requests per client, controlling access to API from a single centralized location, and adding the ability to monitor and track all API usage. In Google Cloud, there are two options for implementing API management: Cloud Endpoints or Apigee.

2. Let's practice!

Create Your Free Account

By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.