I am hoping to start shared hosting service on Google Compute Engine. Does the Google infrastructure have any DDOS mitigation built-in?

This article here says it does.

"Compute Engine makes use of Google’s global network and load balancing architecture and provides access to Google’s expert security team, which ensures that the infrastructure is secure and able to defend itself against things like DDOS attacks." https://www.cloudsherpas.com.au/partner-google/inside-google-cloud-platform-hosting-computing-power/

Although no official confirmation anywhere else.

What is the additional protection I need if Google already provide provide DDOS mitigation?



Google has deployed an Andromeda - their own network stack. It solves many networking challenges introduced by virtualization like delivering the highest level of performance, availability, and security requires orchestrating across virtual machines, hypervisors, operating systems, network interface cards, top of rack switches, fabric switches, border routers, and even Google's network peering edges.

Andromeda's goal is to expose the raw performance of the underlying network while simultaneously exposing network function virtualization (NFV). This functionality includes distributed denial of service (DDoS) protection, transparent service load balancing, access control lists, and firewalls. This kind of protection is built-in to everything inside Google's network, your virtual machines running on Google Compute Engine included.

However, you still need to take care of the following:

  • O/S regular patching
  • Protection using O/S level firewall
  • Configure Google Firewall and leave only used ingress ports
  • Secure the SSH on your bastion machine
  • Apply application patches regulary



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.