When adopting a serverless application paradigm, organizations need to embrace a new view on serverless security and the risks. Some key shifts that occur, including:
- Vectors and Protocols: Unlike traditional cloud applications, where code is predominantly triggered by client requests coming over HTTP/S, serverless diversifies the ways applications can be triggered.
- Attacks: Serverless applications, such as AWS Lambda applications, breed serverless attacks. As serverless functions are for the most part stateless and ephemeral, the notion of persistence in an attack becomes less relevant.
- Velocity: Velocity is an important factor when it comes to serverless security, since serverless applications tend to be significantly more dynamic than their non-serverless counterparts, which presents several new challenges when it comes to security.
- Application Technology: Another major factor in serverless security risks is serverless applications have essentially only two key perimeters: the application perimeter and the resource perimeter. The lack of useful abstractions such as virtual machines and containers for security boundaries means that we’re going to have to apply deeper application security technologies in or around individual resources such as functions and tables.
Beyond these new challenges, there is an opportunity for deeper security in serverless applications, thanks to having greater visibility into the inner workings of the application, and a chance for more fine-grained security with each serverless function being a “small microservice” designed to do very specific tasks.
Top 6 Critical Security Risks for Serverless Applications:
- Function Event Data Injection: The execution of native cloud applications can be triggered by a multitude of event sources, which increases the potential attack surface and introduces new security complexities. Since it is hard to identify which message parts should not be trusted in serverless architecture, event-data injections are harder to identify and block.
- Broken Authentication: Serverless applications often contain hundreds of distinct functions, each serving its own purpose. Therefore, it is one of the top serverless security risks and it is imperative to apply authentication schemes which provide the right access control and protection to every relevant function, trigger or event.
- Insecure Deployment Configurations: Serverless architectures provide high customization in configuration settings for any task, need or environment. This causes higher chances of misconfiguration that can lead to catastrophic data losses. This is why making functions stateless during the design stages is crucial to ensure no sensitive data is exposed to any unauthorized personnel. It is also important to use the right ACL configurations and cloud hardening methods.
- Over Permissive Roles: Serverless functions usually have a very specific role, and as such, they should be given the necessary least privileged role. Over privileged serverless functions can be abused to perform unintended operations which could result in fatal security breaches, and therefore it is a huge serverless security risk.
- Poor Function Monitoring & Logging: Logging and monitoring security events in real-time is essential to detecting, preventing and containing attacks more effectively. In serverless architectures, the monitoring and logging information is stored outside the organizational data center, in a cloud environment. Although many serverless architecture vendors provide capable logging facilities, they are not always optimal for a proper security event audit trail. Organizations must apply logging logic by collecting real-time logs from their serverless functions and cloud services and pushing them to a remote SIEM system.
- 3rd Party Dependencies: Serverless functions often rely on 3rd party web services (through API calls), software packages and open source libraries to perform their intended task. This is a prominent serverless security risk as these 3rd party dependencies can be a source of vulnerability to the application security, and should be thoroughly inspected before the importing of their code.
Protego provides total security from development through deployment and runtime, assuring maximal automated process with minimal human errors.