The legacy approach of security controlling deployment is incompatible with serverless. Learn why serverless needs close partnership between Dev+AppSec. How to redesign security controls, so devs have their control, while being prevented from creating risk Tools & processes to support collaboration See the full talk on Youtube: https://youtu.be/lq4qWw6c-Kg

1. MANCHESTER

2. Serverless DevSecOps:
Why We Must Make it Everyone's Problem
HILLEL SOLOW
CTO @ Protego Labs

3. Serverless DevSecOps:
Why We Must Make it Everyone's Problem
HILLEL SOLOW
CTO @ Protego Labs

4. $ agenda
housekeeping
whatis serverless?
whatis serverless security?
how do we do that?
wrap up and questions

5. $ whoami
CTO@Protego_Labs
$ history
Cisco
NDS

6. $ agenda
housekeeping
whatis serverless?
whatis serverless security?
how do we do that?
wrap up and questions

7. 7
The Cloud is
the new OS

8. 8
What is Serverless

9. What is Serverless
Three revolutions wrapped up in one buzzword
Serverless Infrastructure
Scales to zero
Don’t pay for idle
Serverless Architecture
Single purpose microservices
Stateless / ephemeral
Serverless Operations
Minimal DevOps
Rapid feature velocity

10. $ agenda
housekeeping
whatis serverless?
whatis serverless security?
how do we do that?
wrap up and questions

11. Serverless Affects Security
Visibility06
Granularity05
Velocity04
Attacks03
Event Triggers02
Topology01

12. Serverless Affects Security
Visibility06
Granularity05
Velocity04
Attacks03
Event Triggers02
Topology01
Risks Opportunities

13. Serverless Affects Security
Visibility06
Granularity05
Velocity04
Attacks03
Event Triggers02
Topology01

14. $ agenda
housekeeping
whatis serverless?
whatis serverless security?
how do we do that?
wrap up and questions

15. $ why me
--sec “Because you still care,
and it’s still your problem”
--dev “Becuase you control permissions
and configuration”
--devops “Because you are the bridge”

16. Recipe

17. Why?
Good hygiene == less attack
surface
Why Serverless?
1. Fine grained
architecture
2. More visibility
How?
Automated code-driven
analysis of the application
deployment and behavior
1 Optimize your
security posture
2 Discover what you
need to care about
3 Defend workloads
from within
17

18. Challenge
18

19. 19
var s3 = new AWS.S3({apiVersion: '2006-03-01'});
var params = {Bucket: 'myBucket', Key: imageFileName};
var file = require('fs').createWriteStream('/tmp/file.jpg');
s3.getObject(params).createReadStream().pipe(file);
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [ "s3:*"],
"Resource":
["arn:aws:s3:::*"]
}]
}
Security???
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [ "s3:*"],
"Resource":
["arn:aws:s3:::myBucket/*"]
}]
}
Of course I care about security
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action":
["s3:GetObject"],
"Resource":
["arn:aws:s3:::myBucket/*"]
}]
}
Least privilege*

20. Opportunity
20

21. 21

22. Why?
Knowing the good from the
bad can be challenging at the
best of times
Why Serverless?
1. Easy to Baseline
2. Hard to Observe
How?
Data, data, data
1 Optimize your
security posture
2 Discover what you
need to care about
3 Defend workloads
from within

23. 1 Optimize your
security posture
2 Discover what you
need to care about
3 Defend workloads
from within
Why?
‘Cause Hackers!
Why Serverless?
1. No Perimeter or OS
2. Security needs to be as
ephemeral & lightweight
How?
Visibility, Granularity,
Managed

24. 24
Before After

25. $ agenda
housekeeping
whatis serverless?
whatis serverless security?
how do we do that?
wrap up and questions

26. 1. protego.io/resources
2. OWASP Serverless Top-10
3. OWASP DVSA
Learn More & Get Involved

27. Questions?