Regulatory Compliance and Artifact

Introduction to Regulatory Compliance

For a Professional Cloud Security Engineer (PSE), compliance is not just a "paperwork" exercise. It is the process of ensuring that your cloud infrastructure meets the legal and regulatory requirements of the industries and regions in which you operate. Google Cloud provides the underlying secure infrastructure, but the PSE is responsible for configuring and auditing the environment to maintain compliance.

Google Cloud Artifact is the central repository where you can download the audit reports and certifications that prove Google's compliance, which you then provide to your own auditors.

白話文解釋（Plain English Explanation）

1. The Apartment Rental (Shared Responsibility Model)

When you rent an apartment, the landlord is responsible for the building's foundation, the roof, and the plumbing (Google's Responsibility: Infrastructure). You are responsible for locking your front door, making sure the stove is turned off, and who you give a key to (Your Responsibility: Configuration and Data). If someone breaks in because you left the door open, that's on you, not the landlord.

2. The Building Inspector's Certificate (Google Cloud Artifact)

Imagine you are opening a restaurant. To prove the building is safe, you need a certificate from the city building inspector. You don't perform the inspection yourself; you just go to the city records office (Artifact) and download a copy of the inspector's report to show to your insurance company.

3. The Security Blueprint (Mapping Controls)

Think of a standard electrical code (Regulatory Framework). A PSE takes that code and maps it to their specific building plan (GCP Environment). "Requirement 1: All wires must be grounded" maps to "GCP Control: All traffic must be encrypted at rest using CMEK."

The Shared Responsibility Model

Compliance in the cloud is a partnership.

• Google's Responsibility (Security OF the Cloud): Physical security of data centers, hardware, the hypervisor, and the global network.
• Customer's Responsibility (Security IN the Cloud): IAM policies, network firewalls, data encryption, guest OS patching, and application-level security.

Google Cloud Artifact (Compliance Reports Manager)

Artifact is a self-service portal for on-demand access to compliance reports.

• Types of Documents in Artifact:
  • SOC 1, 2, and 3 Reports: Audit reports on Google's internal controls.
  • ISO/IEC Certificates: Certifications for 27001, 27017, and 27018.
  • PCI DSS Attestation of Compliance (AoC): Crucial for any business handling credit cards.
  • Bridges and Supplements: Specific documents for regional requirements (e.g., German BSI C5).

Key Regulatory Frameworks and GCP

1. HIPAA (Healthcare)

• Focus: Protecting Protected Health Information (PHI).
• PSE Task: Ensure a Business Associate Agreement (BAA) is signed with Google. Use Cloud DLP to find PHI and KMS to encrypt it.

2. GDPR (Privacy - EU)

• Focus: Data privacy and sovereignty for EU citizens.
• PSE Task: Use Regional Endpoints to ensure data stays within Europe. Implement "Right to be Forgotten" using automated data deletion policies in BigQuery or GCS.

3. FedRAMP (US Government)

• Focus: Standardized security for cloud products used by the US government.
• PSE Task: Use "FedRAMP High" authorized regions and services. Enable Assured Workloads to automatically enforce FedRAMP-specific controls.

4. PCI DSS (Payments)

• Focus: Protecting credit cardholder data.
• PSE Task: Isolate the "Cardholder Data Environment" (CDE) using VPC Service Controls. Use Tokenization (via DLP) so that actual card numbers are never stored in your database.

Mapping GCP Security Controls to Frameworks

A PSE must be able to translate "Auditor Speak" into "Cloud Engineer Speak."

• Auditor: "Do you have a record of who accessed this database?"
• PSE: "Yes, we have Data Access Audit Logs enabled for BigQuery, exported to a locked-down GCS bucket."
• Auditor: "How do you prevent data from being moved to an unapproved location?"
• PSE: "We use VPC Service Controls to create a service perimeter around our sensitive projects."

Auditing for Regulatory Compliance

• Continuous Auditing: Use SCC Premium to continuously monitor for violations of CIS, PCI DSS, or NIST 800-53 benchmarks.
• Log Retention: Most regulations require logs to be kept for 1 to 7 years. Use Log Buckets with long-term retention policies to meet these requirements cost-effectively.

Managing Third-Party Risk and Assessments

When you use a third-party tool on GCP (e.g., a marketplace image or a SaaS integration):

• You are responsible for assessing the security of that third party.
• Check if the third party has their own compliance certifications (SOC 2, ISO 27001).
• Use Binary Authorization to ensure that only approved third-party images are deployed to your GKE clusters.

Regional and Industry-Specific Compliance

• Financial Services (FSI): Specific requirements for "Exit Strategies" and "Operational Resilience."
• Australia (IRAP): Compliance for Australian government data.
• Germany (TISAX): Information security for the automotive industry.

Assured Workloads: Compliance Automation

Assured Workloads is a GCP service that automates compliance.

• It creates a "Compliant Environment" by automatically applying organization policies and resource location restrictions.
• It ensures that Google support personnel who access your environment meet specific citizenship or background check requirements (e.g., for FedRAMP or IL5).

Security Best Practices for PSE

1. Start with Artifact: Before a project begins, download the relevant compliance reports from Artifact to understand Google's controls.
2. Use the Compliance Dashboard: Regularly check the SCC Compliance dashboard to identify non-compliant resources.
3. Document Everything: Maintain a "Compliance Matrix" that maps every regulatory requirement to a specific GCP control and a specific monitoring alert.
4. Least Privilege is Compliance: Nearly every regulation (HIPAA, PCI, GDPR) requires strict access control. Implement Zero Trust via IAP and ACM to satisfy these requirements.

PSE Exam Scenarios

Scenario 1: Proving Compliance to an Auditor

"An auditor asks for proof that Google's data centers are physically secure and that Google employees cannot access your encryption keys. Where do you find this proof?" Answer: Log in to Google Cloud Artifact. Download the latest SOC 2 Type II report (for physical security) and the Cloud KMS whitepaper/audit (for key management).

Scenario 2: Deploying a HIPAA-Compliant App

"You are tasked with deploying a new healthcare application that will store patient records. What are the first three security steps you should take?" Answer:

1. Verify that the BAA (Business Associate Agreement) is in place for your Organization.
2. Use Assured Workloads to create a project with HIPAA-compliant guardrails.
3. Enable Data Access Audit Logs for all services that will touch the patient data.

Summary Checklist

• Define the Shared Responsibility Model for IaaS, PaaS, and SaaS.
• Explain how to use Google Cloud Artifact to find audit reports.
• List at least three common regulatory frameworks (HIPAA, GDPR, etc.).
• Describe the purpose of Assured Workloads.
• Understand the role of SCC in continuous compliance monitoring.