Google Cloud Platform for Architects

Some security best practices

Here is a list of design choices that you could exercise to cope with security threats such as DDoS attacks:

• Use hardened bastion hosts such as load balancers (particularly HTTP(S) and SSL proxy load balancers).
• Make good use of the firewall rules in your VPC network. Ensure that incoming traffic from unknown sources, or on unknown ports, or protocols is not allowed through.
• Use managed services such as Dataflow and Cloud Functions wherever possible; these are serverless and so have smaller attack vectors.
• If your application lends itself to App Engine it has several security benefits over GCE or GKE, and it can also be used to autoscale up quickly, damping the impact of a DDOS attack.
• If you are using GCE VMs, ...