GCP WAF Security Review
Purpose
Evaluate GCP workload security posture against the Google Cloud Well-Architected Framework (WAF) security pillar. This skill supports confidentiality, integrity, compliance, and privacy requirements for workloads running on GCP.
When to use
Use this skill for:
- Assessing architecture security requirements against WAF recommendations
- Designing security controls and control gaps analysis
- Auditing a GCP workload against the seven WAF security principles
- Evaluating zero trust maturity, shift-left practices, and preemptive defense coverage
- Reviewing AI governance and regulatory compliance posture
WAF Security Pillar Overview
The GCP Well-Architected Framework security pillar provides guidance across seven core principles. Together they enforce confidentiality (data is accessible only to authorized principals), integrity (data and systems are not tampered with), compliance (workloads meet regulatory obligations), and privacy (personal data is protected throughout its lifecycle).
Core Principles
1. Implement Security by Design
Ground every architecture decision in a security-first posture. Embed security requirements from the earliest design phase rather than retrofitting controls after the fact.
- Reference: https://cloud.google.com/architecture/framework/security/implement-security-by-design
2. Implement Zero Trust
Treat every request as untrusted by default regardless of network origin. Verify identity, device health, and context before granting access, and enforce least-privilege access to all resources.
- Reference: https://cloud.google.com/architecture/framework/security/implement-zero-trust
3. Implement Shift-Left Security
Integrate security checks, policy enforcement, and vulnerability scanning into CI/CD pipelines and developer workflows so defects are caught before reaching production.
- Reference: https://cloud.google.com/architecture/framework/security/implement-shift-left-security
4. Implement Preemptive Cyber Defense
Actively detect, hunt, and respond to threats before they materialize into incidents. Use threat intelligence, behavioral analytics, and automated response to shorten mean time to detect and respond.
- Reference: https://cloud.google.com/architecture/framework/security/implement-preemptive-cyber-defense
5. Use AI Securely and Responsibly
Apply security controls specifically to AI model pipelines, training data, inference endpoints, and model outputs. Address AI-specific attack surfaces including prompt injection, model inversion, and supply chain risks.
- Reference: https://cloud.google.com/architecture/framework/security/use-ai-securely-and-responsibly
6. Use AI for Security
Leverage AI and machine learning capabilities to enhance security operations — anomaly detection, alert triage, threat hunting, and automated response at scale.
- Reference: https://cloud.google.com/architecture/framework/security/use-ai-for-security
7. Meet Regulatory, Compliance, and Privacy Needs
Identify applicable regulatory requirements (GDPR, HIPAA, PCI-DSS, FedRAMP, SOC 2, etc.), map controls to obligations, and maintain continuous evidence for audits.
- Reference: https://cloud.google.com/architecture/framework/security/meet-regulatory-compliance-and-privacy-needs
Relevant GCP Products
- Identity & Access: Cloud IAM, Identity-Aware Proxy (IAP), Chrome Enterprise Premium (BeyondCorp Enterprise)
- Network Security: Cloud Armor, VPC Service Controls, Cloud Next Generation Firewall (Cloud NGFW)
- Data Protection: Cloud Key Management Service (KMS), Sensitive Data Protection (formerly DLP), Confidential Computing
- Threat Detection & Response: Google SecOps (Chronicle), Security Command Center (SCC), Security Health Analytics
- Supply Chain & Build Security: Binary Authorization, Artifact Analysis, Artifact Registry
- Compliance & Sovereignty: Assured Workloads, Access Transparency, Access Approval
- Secrets Management: Secret Manager
Assessment Question Bank
Security by Design
- Are security requirements captured as first-class design requirements alongside functional requirements?
- Is threat modeling performed for each workload and updated when architecture changes significantly?
- Are secure defaults enforced at the infrastructure level (e.g., org policies blocking public IPs, requiring CMEK, disabling SA key creation)?
- Is a defense-in-depth strategy documented, covering network, identity, data, and application layers?
- Are security architecture decisions captured as Architecture Decision Records (ADRs)?
- Is a security champion or review gate embedded in the system design process?
- Are third-party and open source dependencies evaluated for known vulnerabilities before adoption?
- Is sensitive data classification applied to all data assets at design time?
- Are blast-radius minimization patterns (separate projects per tier, VPC segmentation) applied?
- Are security requirements tested as part of functional acceptance criteria?
Zero Trust
- Is identity verification enforced for every user and service regardless of network origin?
- Are all service-to-service calls authenticated (e.g., using Workload Identity, mTLS, IAP)?
- Is device posture evaluated before granting access to sensitive resources (e.g., via BeyondCorp / Chrome Enterprise Premium)?
- Are VPC Service Controls perimeters defined to restrict sensitive API access to trusted contexts?
- Is lateral movement risk addressed through micro-segmentation or VPC firewall rules?
- Are IAM bindings reviewed and rightsized to least privilege on a regular cadence?
- Is privileged access managed and time-bound (e.g., JIT access, PAM tooling)?
- Is all data encrypted in transit with enforced TLS policies?
- Are audit logs (Admin Activity, Data Access) enabled and retained for all sensitive projects?
- Is continuous authorization evaluated for long-running sessions and API tokens?
- Are externally exposed endpoints protected by Cloud Armor WAF policies?
Shift-Left Security
- Are SAST and SCA tools integrated into pull request checks?
- Is container image scanning (Artifact Analysis) enforced before images are pushed to Artifact Registry?
- Is Binary Authorization policy enabled on all GKE clusters and Cloud Run services?
- Are IaC templates (Terraform, Config Connector) scanned for security misconfigurations before apply?
- Is secrets detection (e.g., truffleHog, git-secrets) integrated into the developer commit workflow?
- Are security unit tests written for authentication, authorization, and input validation logic?
- Are dependency vulnerability alerts surfaced to developers in their IDE or PR review?
- Is a software bill of materials (SBOM) generated for each release artifact?
- Are security findings from pipeline gates tracked to resolution with SLA enforcement?
- Are developers trained on secure coding practices with GCP-specific guidance?
Preemptive Cyber Defense
- Is Security Command Center (SCC) enabled at the org level with all built-in detectors active?
- Are Google SecOps (Chronicle) SIEM and SOAR capabilities used for centralized log analysis and automated response?
- Is threat intelligence integrated into detection rules (e.g., YARA-L rules in Chronicle)?
- Are anomalous IAM activity and privilege escalation patterns detected automatically?
- Are network intrusion detection capabilities active (e.g., Cloud IDS)?
- Is a documented incident response runbook maintained and tested via tabletop exercises?
- Are SCC findings triaged, assigned owners, and tracked to remediation within defined SLAs?
- Is vulnerability management performed on a recurring schedule across all compute assets?
- Are red team or penetration testing exercises conducted at least annually?
- Are honeytokens or canary resources deployed to detect unauthorized access attempts?
AI Security
- Are AI model endpoints protect