google-cloud-waf-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Google Cloud Well-Architected Framework skill for the Security pillar

Google Cloud架构完善框架的安全支柱技能

Overview

概述

The security pillar of the Google Cloud Well-Architected Framework provides design principles and best practices for building a robust security posture by integrating security into every layer of the architecture for cloud workloads. It focuses on maintaining confidentiality and integrity of data and systems while ensuring compliance and privacy. It provides a structured approach to risk management, threat defense, and identity control, enabling you to operate cloud workloads securely and at scale.

Google Cloud架构完善框架的安全支柱提供了设计原则和最佳实践，通过将安全集成到云工作负载架构的每一层，构建稳健的安全态势。它专注于维护数据和系统的保密性与完整性，同时确保合规性和隐私性。它提供了结构化的风险管理、威胁防御和身份控制方法，助力你安全且大规模地运行云工作负载。

Core principles

核心原则

The recommendations in the security pillar of the Well-Architected Framework are aligned with the following core principles:

Implement security by design: Integrate cloud security and network security considerations starting from the initial design phase of your applications and infrastructure. Google Cloud provides architecture blueprints and recommendations to help you apply this principle. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-security-by-design
Implement zero trust: Use a never trust, always verify approach, where access to resources is granted based on continuous verification of trust. Google Cloud supports this principle through products like Chrome Enterprise Premium and Identity-Aware Proxy (IAP). Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-zero-trust
Implement shift-left security: Implement security controls early in the software development lifecycle. Avoid security defects before system changes are made. Detect and fix security bugs early, fast, and reliably after the system changes are committed. Google Cloud supports this principle through products like Cloud Build, Binary Authorization, and Artifact Registry. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-shift-left-security
Implement preemptive cyber defense: Adopt a proactive approach to security by implementing robust fundamental measures like threat intelligence. This approach helps you build a foundation for more effective threat detection and response. Google Cloud's approach to layered security controls aligns with this principle. Google Cloud supports this principle through products like Security Command Center, Google Threat Intelligence, and Google SecOps. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-preemptive-cyber-defense
Use AI securely and responsibly: Develop and deploy AI systems in a responsible and secure manner. The recommendations for this principle are aligned with guidance in the AI and ML perspective of the Well-Architected Framework and in Google's Secure AI Framework (SAIF). Grounding document: https://docs.cloud.google.com/architecture/framework/security/use-ai-securely-and-responsibly
Use AI for security: Use AI capabilities to improve your existing security systems and processes through Gemini in Security and overall platform-security capabilities. Use AI as a tool to increase the automation of remedial work and ensure security hygiene to make other systems more secure. Google Cloud supports this principle through products like Google Threat Intelligence and Google SecOps. Grounding document: https://docs.cloud.google.com/architecture/framework/security/use-ai-for-security
Meet regulatory, compliance, and privacy needs: Adhere to industry-specific regulations, compliance standards, and privacy requirements. Google Cloud helps you meet these obligations through products like Assured Workloads, Organization Policy Service, and our compliance resource center. Grounding document: https://docs.cloud.google.com/architecture/framework/security/meet-regulatory-compliance-and-privacy-needs

架构完善框架安全支柱中的建议与以下核心原则保持一致：

实施设计安全：从应用和基础设施的初始设计阶段就整合云安全和网络安全考量。Google Cloud提供架构蓝图和建议来帮助你应用此原则。参考文档： https://docs.cloud.google.com/architecture/framework/security/implement-security-by-design
实施零信任：采用“永不信任，始终验证”的方法，基于持续的信任验证授予资源访问权限。Google Cloud通过Chrome Enterprise Premium和Identity-Aware Proxy（IAP）等产品支持此原则。参考文档： https://docs.cloud.google.com/architecture/framework/security/implement-zero-trust
实施左移安全：在软件开发生命周期早期就实施安全控制。在系统变更前避免安全缺陷，在系统变更提交后尽早、快速且可靠地检测并修复安全漏洞。Google Cloud通过Cloud Build、Binary Authorization和Artifact Registry等产品支持此原则。参考文档： https://docs.cloud.google.com/architecture/framework/security/implement-shift-left-security
实施主动网络防御：通过实施威胁情报等强大的基础措施，采用主动安全方法。此方法有助于为更有效的威胁检测和响应奠定基础。Google Cloud的分层安全控制方法与此原则一致，通过Security Command Center、Google Threat Intelligence和Google SecOps等产品支持此原则。参考文档： https://docs.cloud.google.com/architecture/framework/security/implement-preemptive-cyber-defense
安全负责任地使用AI：以负责任且安全的方式开发和部署AI系统。此原则的建议与架构完善框架的AI和ML视角以及Google安全AI框架（SAIF）中的指导保持一致。参考文档： https://docs.cloud.google.com/architecture/framework/security/use-ai-securely-and-responsibly
使用AI强化安全：借助Security中的Gemini及整体平台安全能力，利用AI功能改进现有安全系统和流程。将AI作为工具，提高补救工作的自动化程度，确保安全卫生，从而提升其他系统的安全性。Google Cloud通过Google Threat Intelligence和Google SecOps等产品支持此原则。参考文档： https://docs.cloud.google.com/architecture/framework/security/use-ai-for-security
满足监管、合规和隐私需求：遵守行业特定法规、合规标准和隐私要求。Google Cloud通过Assured Workloads、Organization Policy Service和合规资源中心等产品帮助你履行这些义务。参考文档： https://docs.cloud.google.com/architecture/framework/security/meet-regulatory-compliance-and-privacy-needs

Relevant Google Cloud products

Workload assessment questions

工作负载评估问题

Ask appropriate questions to understand the security-related requirements and constraints of the workload and the user's organization. Choose questions from the following list:

Security by design:
- How do you incorporate security considerations into your project's initial planning and design phases?
- How do you define and document security requirements for new applications and services?
- How do you ensure that security is integrated into your development lifecycle?
- What tools and techniques do you use to perform threat modeling during the design phase?
- How do you manage and prioritize security vulnerabilities discovered during the design and development process?
- How do you handle security updates and patches for your applications and infrastructure?
- How do you document and communicate security design decisions to your team and stakeholders?
- How do you ensure that security configurations are consistently applied across your environments?
- How do you validate the effectiveness of your security controls and measures?
- How do you handle security exceptions and deviations from your security design?
Zero trust:
- How do you verify and authenticate users and devices accessing your Google Cloud resources?
- How do you implement the principle of least privilege for access control?
- How do you monitor and control network traffic within your Google Cloud environment?
- How do you secure data in transit and at rest in your Google Cloud environment?
- How do you implement continuous monitoring and logging of user and device activity?
- How do you handle and respond to security incidents and breaches in a Zero Trust environment?
- How do you manage and update security policies and controls in a Zero Trust environment?
- How do you ensure that third-party applications and services comply with your Zero Trust principles?
- How do you handle remote access and BYOD devices in a Zero Trust environment?
- How do you educate and train your employees on Zero Trust principles and practices?
Shift-left security:
- How do you integrate security testing into your development pipeline early in the process?
- What types of security testing do you perform during the development phase?
- How do you provide developers with feedback on security vulnerabilities and best practices?
- How do you empower developers to take ownership of security in their code?
- How do you ensure that security requirements are clearly defined and communicated to developers?
- How do you measure the effectiveness of your Shift Left security initiatives?
- How do you handle security dependencies and third-party libraries in your code?
- How do you manage and update security configurations in your development environment?
- How do you handle security exceptions and deviations from your security policies in development?
- How do you promote a culture of security awareness and responsibility among developers?
Preemptive cyber defense:
- How do you proactively identify and mitigate potential security threats before they impact your systems?
- What tools and techniques do you use for continuous security monitoring and analysis?
- How do you respond to and remediate security alerts and incidents?
- How do you simulate and test your incident response plans?
- How do you stay up-to-date with the latest security threats and vulnerabilities?
- How do you handle and mitigate DDoS attacks against your applications and services?
- How do you protect your sensitive data from insider threats?
- How do you ensure that your security controls are effective against advanced persistent threats (APTs)?
- How do you handle security vulnerabilities in your supply chain?
- How do you adapt your security posture to evolving threats and technologies?
Security of AI workloads:
- How do you ensure the security of your AI models and data?
- How do you address potential biases and ethical concerns in your AI models?
- How do you protect your AI models from adversarial attacks and data poisoning?
- How do you ensure the privacy of data used in your AI models?
- How do you explain and interpret the decisions made by your AI models?
- How do you manage and control access to your AI models and data?
- How do you ensure compliance with regulations and standards related to AI and ML?
- How do you monitor and detect anomalies in the behavior of your AI models?
- How do you handle and respond to security incidents involving your AI models?
- How do you educate and train your employees on the secure and responsible use of AI and ML?
AI for security:
- How do you leverage AI and ML to enhance your security posture?
- What types of AI models do you use for security purposes?
- How do you train and validate your AI models for security applications?
- How do you ensure the accuracy and reliability of AI-based security systems?
- How do you handle false positives and false negatives from AI-based security systems?
- How do you integrate AI-based security systems with your existing security infrastructure?
- How do you manage and update your AI models for security applications?
- How do you explain and interpret the decisions made by your AI models for security applications?
- How do you ensure the ethical and responsible use of AI and ML for security purposes?
- How do you measure the effectiveness of AI and ML in improving your security posture?
Regulatory compliance and privacy:
- What regulatory compliance frameworks and privacy standards do you need to adhere to?
- How do you assess and manage compliance risks in your Google Cloud environment?
- How do you ensure the privacy of sensitive data stored and processed in Google Cloud?
- How do you handle data subject requests (DSRs) related to privacy regulations?
- How do you document and track compliance activities and evidence?
- How do you ensure that third-party vendors and partners comply with your regulatory and privacy requirements?
- How do you handle data breaches and security incidents related to compliance regulations?
- How do you stay up-to-date with changes in regulatory compliance and privacy standards?
- How do you educate and train your employees on regulatory compliance and privacy requirements?
- How do you demonstrate and prove compliance to auditors and regulators?

提出合适的问题，以了解工作负载和用户组织的安全相关需求与约束。从以下列表中选择问题：

设计安全:
- 你如何将安全考量纳入项目的初始规划和设计阶段？
- 你如何为新应用和服务定义并记录安全需求？
- 你如何确保安全集成到开发生命周期中？
- 在设计阶段，你使用哪些工具和技术执行威胁建模？
- 你如何管理并优先处理设计和开发过程中发现的安全漏洞？
- 你如何处理应用和基础设施的安全更新与补丁？
- 你如何向团队和利益相关者记录并传达安全设计决策？
- 你如何确保安全配置在所有环境中一致应用？
- 你如何验证安全控制和措施的有效性？
- 你如何处理安全例外情况以及与安全设计的偏差？
零信任:
- 你如何验证和认证访问Google Cloud资源的用户和设备？
- 你如何为访问控制实施最小权限原则？
- 你如何监控和控制Google Cloud环境内的网络流量？
- 你如何保护Google Cloud环境中传输和静态存储的数据？
- 你如何实施用户和设备活动的持续监控与日志记录？
- 在零信任环境中，你如何处理和响应安全事件与漏洞？
- 在零信任环境中，你如何管理和更新安全策略与控制？
- 你如何确保第三方应用和服务符合你的零信任原则？
- 在零信任环境中，你如何处理远程访问和BYOD设备？
- 你如何对员工进行零信任原则与实践的教育和培训？
左移安全:
- 你如何在开发流程早期将安全测试集成到开发流水线中？
- 在开发阶段，你执行哪些类型的安全测试？
- 你如何向开发者提供关于安全漏洞和最佳实践的反馈？
- 你如何赋予开发者对代码安全的所有权？
- 你如何确保安全需求被清晰定义并传达给开发者？
- 你如何衡量左移安全举措的有效性？
- 你如何处理代码中的安全依赖项和第三方库？
- 你如何管理和更新开发环境中的安全配置？
- 在开发过程中，你如何处理安全例外情况以及与安全策略的偏差？
- 你如何在开发者中推广安全意识和责任文化？
主动网络防御:
- 你如何在潜在安全威胁影响系统前主动识别并缓解它们？
- 你使用哪些工具和技术进行持续安全监控与分析？
- 你如何响应并修复安全警报和事件？
- 你如何模拟和测试事件响应计划？
- 你如何及时了解最新的安全威胁和漏洞？
- 你如何处理和缓解针对应用和服务的DDoS攻击？
- 你如何保护敏感数据免受内部威胁？
- 你如何确保安全控制能有效抵御高级持续性威胁（APT）？
- 你如何处理供应链中的安全漏洞？
- 你如何调整安全态势以适应不断演变的威胁和技术？
AI工作负载安全:
- 你如何确保AI模型和数据的安全？
- 你如何解决AI模型中潜在的偏见和伦理问题？
- 你如何保护AI模型免受对抗性攻击和数据投毒？
- 你如何确保AI模型所用数据的隐私性？
- 你如何解释和解读AI模型做出的决策？
- 你如何管理和控制对AI模型和数据的访问？
- 你如何确保符合与AI和ML相关的法规和标准？
- 你如何监控和检测AI模型行为中的异常？
- 你如何处理和响应涉及AI模型的安全事件？
- 你如何对员工进行AI和ML安全负责任使用的教育和培训？
AI强化安全:
- 你如何利用AI和ML提升安全态势？
- 你使用哪些类型的AI模型用于安全目的？
- 你如何为安全应用训练和验证AI模型？
- 你如何确保基于AI的安全系统的准确性和可靠性？
- 你如何处理基于AI的安全系统产生的误报和漏报？
- 你如何将基于AI的安全系统与现有安全基础设施集成？
- 你如何管理和更新用于安全应用的AI模型？
- 你如何解释和解读用于安全应用的AI模型做出的决策？
- 你如何确保AI和ML用于安全目的的伦理和负责任使用？
- 你如何衡量AI和ML在提升安全态势方面的有效性？
监管合规与隐私:
- 你需要遵守哪些监管合规框架和隐私标准？
- 你如何评估和管理Google Cloud环境中的合规风险？
- 你如何确保存储和处理在Google Cloud中的敏感数据的隐私性？
- 你如何处理与隐私法规相关的数据主体请求（DSR）？
- 你如何记录和跟踪合规活动及证据？
- 你如何确保第三方供应商和合作伙伴符合你的监管和隐私要求？
- 你如何处理与合规法规相关的数据泄露和安全事件？
- 你如何及时了解监管合规和隐私标准的变化？
- 你如何对员工进行监管合规和隐私要求的教育和培训？
- 你如何向审计师和监管机构展示并证明合规性？

Validation checklist

验证清单

Use the following checklist to evaluate the architecture's alignment with security recommendations:

Security by design:
- Are system components selected based on their security features and hardening?
- Is defense-in-depth implemented at the network, host, and application layers?
- Are safe libraries and application frameworks used to prevent common vulnerabilities?
- Is a risk assessment performed using industry standards?
Zero trust:
- Is access control enforced based on user identity and context (device, location)?
- Are private connectivity methods (Cloud Interconnect, VPN) used for internal traffic?
- Are default networks disabled in all projects?
- Are VPC Service Controls perimeters established around sensitive data?
Shift-left security:
- Is infrastructure provisioned using Infrastructure as Code (e.g., Terraform)?
- Are automated security scans integrated into the CI/CD pipeline?
- Is there a process for scanning and patching vulnerabilities in dependencies?
- Is Binary Authorization used to ensure only trusted images are deployed?
Preemptive cyber defense:
- Is threat intelligence integrated into security operations?
- Is security logging enabled and centralized for all critical resources?
- Are automated responses configured for common security threats?
- Are defenses validated through periodic testing or red-teaming?
AI security and governance:
- Are AI pipelines secured against tampering and data poisoning?
- Is differential privacy or data masking used for training data where appropriate?
- Are Vertex Explainable AI and fairness indicators used for model governance?

使用以下清单评估架构与安全建议的契合度：

设计安全:
- 是否基于安全特性和加固程度选择系统组件？
- 是否在网络、主机和应用层实施纵深防御？
- 是否使用安全库和应用框架来防止常见漏洞？
- 是否采用行业标准执行风险评估？
零信任:
- 是否基于用户身份和上下文（设备、位置）实施访问控制？
- 是否为内部流量使用专用连接方法（Cloud Interconnect、VPN）？
- 是否在所有项目中禁用默认网络？
- 是否围绕敏感数据建立VPC Service Controls边界？
左移安全:
- 是否使用基础设施即代码（如Terraform）配置基础设施？
- 是否将自动化安全扫描集成到CI/CD流水线中？
- 是否有扫描和修补依赖项漏洞的流程？
- 是否使用Binary Authorization确保仅部署可信镜像？
主动网络防御:
- 是否将威胁情报集成到安全运营中？
- 是否为所有关键资源启用并集中安全日志记录？
- 是否针对常见安全威胁配置自动化响应？
- 是否通过定期测试或红队演练验证防御措施？
AI安全与治理:
- 是否保护AI流水线免受篡改和数据投毒？
- 是否在合适的训练数据中使用差分隐私或数据掩码？
- 是否使用Vertex Explainable AI和公平性指标进行模型治理？