Google Infrastructure Security Design Overview

← Back to document page

Google Infrastructure SecurityDesign OverviewMarch 2022Table of contentsIntroduction3Secure low-level infrastructure4Security of physical premises4Hardware Design and provenance4Secure boot stack and machine identity4Secure service deployment5Service identity, integrity, and isolation6Inter-service access management6Encryption of inter-service communication7Access management of end-user data in Google Workspace7Secure data storage9Encryption at rest9Deletion of data10Secure internet communication10Google Front End service10DoS protection11User authentication11Operational security12Safe software development12Source code protections12Keeping employee devices and credentials safe13Reducing insider risk13Threat monitoring13Intrusion detection14What s next14This content was last updated in March 2022, and represents the status quo as of the time it waswritten. Google 's Security policies and systems may change going forward, as we continually improveprotection for our document provides an Overview of how Security is designed into Google 's technicalinfrastructure.

We have a variety of isolation and sandboxing techniques for protecting a service from other services running on the same machine. These techniques include normal Linux user separation, language and kernel-based sandboxes, and hardware virtualization. In general, we use more layers of isolation for riskier

  Infrastructures, Sandboxing