What's changed: Created Professional Cloud Security Engineer Chapter 4 (Domain 4 "Operations": CVE scanning in CI/CD (Artifact Analysis)/Binary Authorization (GKE/Cloud Run)/image hardening-VM patch management/CSPM-custom org policies-Security Health Analytics custom modules; network logs (Cloud NGFW/VPC flow logs/Packet Mirroring/Cloud IDS/Log Analytics), logging strategy, incident response, secure log access, external SIEM export, Cloud Audit Logs/data access logs, log sinks/aggregated sinks, Security Command Center).
4.1Automating infrastructure and application security
Understand automating CVE scanning in CI/CD, Binary Authorization to secure GKE/Cloud Run, automating VM/container image creation (hardening, maintenance, VM patch management), and managing policy/drift detection at scale (cloud security posture management [CSPM], custom org policies, custom modules for Security Health Analytics).
Manual security cannot keep up. Build inspection into the pipeline, deploy only trusted artifacts, and auto-detect configuration drift.
4.1.1Supply chain and image security
In CI/CD, automate CVE scanning (known vulnerabilities) and continuously scan images/packages with Artifact Analysis. At deploy, use Binary Authorization to admit only "signed/verified images" to GKE/Cloud Run, blocking untrusted artifacts (Artifact Analysis detects, Binary Authorization enforces). Harden the base by auto-building hardened VM/container images (golden images) and maintaining them with VM patch management (fleet-wide OS patching). Map "deploy only signed = Binary Authorization" and "detect vulnerabilities = Artifact Analysis (CVE scanning)."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.