Core Compute & Networking
Custom KVM Isolation
Google abandoned the standard QEMU emulator entirely. GCP utilizes a mathematically hardened, proprietary user-space virtual machine monitor to severely reduce the hypervisor attack surface.
Andromeda SDN
Provides unrivaled native visibility. Unlike competitors requiring complex routing architectures for deep packet inspection, GCP offers native Packet Mirroring built directly into the Andromeda SDN layer.
Under the Hood Architecture
Cryptographic Boot
Rigorous code provenance. Google's binary verification system tracks the exact source code running in KVM, verifying integrity from the boot-loader up to the customers' guest VMs.
IAM Friction & Security Tax
Separates identity provisioning from access management. Automated SCIM is supported, but organizations must purchase Cloud Identity Premium ($7.20/user/mo), inducing a steep security tax.
Real-World Attack Surface
Cloud Shell Escapes (CVE-2026-35428)
The "Wreaking Havoc" vulnerability involved a critical flaw within Cloud Shell, allowing unauthorized attackers to perform command injection and escape the containerized environment.
Google Groups Privilege Creep
Administrators frequently assign powerful IAM roles to Google Groups. If these groups are publicly joinable or globally open, it inadvertently grants widespread, untracked privilege escalation.
Mandatory Hardening Baseline
- Audit Google Groups: Immediately audit all Groups granted GCP IAM roles, explicitly disallowing assignments to publicly joinable open groups.
- Limit Cloud Shell Access: Access to the Cloud Shell environment must be strictly monitored, restricting full access policies to absolute necessity.
- Enforce VPC Service Controls: Wrap sensitive projects in a service perimeter so data exfiltration to attacker-controlled buckets is blocked even when valid credentials have been stolen.
Architecture Comparison
| Component | GCP | AWS |
|---|---|---|
| Isolation Architecture | KVM (Custom/Non-QEMU) | Nitro System (Hardware) |
| Network Visibility | Native Packet Mirroring | VPC Flow Logs |
| Identity Security Tax | Severe ($7.20/user/mo SCIM) | Moderate (AD costs) |
| Key Management | KMS / Cloud HSM (L3) | KMS / CloudHSM (L3) |
