Compliance is a major driver for many of today's cybersecurity technologies, methods, and best practices. But how does it work in the serverless world? Join us to learn everything you need to know about how PCI Compliance applies to serverless architectures. This Webinar Covers: Top serverless security risks How the shared responsibility model applies to serverless PCI DSS applicability to FaaS/Serverless PCI requirements and their consequences for serverless apps How to prepare your serverless architecture for PCI compliance

1. PCICompliance& Serverless:
EverythingYouNeed To Know
Ory Segal (CTO), Ron Harnik (Head of Marketing)

2. Agenda
 Serverless in a nutshell
 The Shared Model of Responsibility
 Serverless AppSec: The Times They Are a-Changin’
 PCI DSS Applicability to Serverless
 PCI DSS / Serverless: Challenges

3. Why Serverless?

4. Compute as a Utility

5. Serverless Benefits
No servers to manage
Continuousscaling
Sub-second metering
Less security responsibilities

6. EVENT TRIGGER
DEPLOY
EVENT SOURCES
…
INTERACTIONS
REST API
CLOUD RESOURCES
CODE
CODE
REPOSITORY
EVENT SOURCES
CLOUD RESOURCES
OUTPUT
SERVERLESS (OVER) SIMPLIFIED
FUNCTION
{;}

7. Shared Model Of Responsibility
CLOUDPROVIDER
RESPONSIBLE FOR SECURITY “OF”
THE CLOUD
REGIONS AVAILABILITY ZONES EDGE LOCATIONS
COMPUTE STORAGE DATABASE NETWORK
OPERATING SYSTEM + VIRTUAL MACHINES+ CONTAINERS
APPLICATIONOWNER
RESPONSIBLE FOR SECURITY
“IN” THECLOUD
APPLICATIONS(FUNCTIONS)
IDENTITY & ACCESS MANAGEMENT CLOUD SERVICES CONFIGURATION
CLIENT-SIDE DATA INCLOUD DATA INTRANSIT

8. Security Responsibility: WhenYou Own The Infrastructure(IaaS)
 Physicalinfrastructure,access restrictionstophysicalperimeterandhardware
 Secureconfigurationofinfrastructuredevicesandsystems
 Regularlytestingthesecurityofallsystems/processes(OS, services)
 Identificationandauthenticationofaccess tosystems(OS,services)
 PatchingandfixingflawsinOS
 HardeningOS andservices
 Protectingallsystemsagainstmalwareandbackdoors
 Patchingandfixingflawsinruntimeenvironmentandrelatedsoftwarepackages
 Exploitpreventionandmemoryprotection
 Networksegmentation
 Trackingandmonitoringallnetworkresourcesandaccess
 Installationandmaintenanceofnetworkfirewalls
 Network-layerDoSprotection
 Authenticationofusers
 Authorizationcontrolswhenaccessing applicationanddata
 Log andmaintainaudittrailsofallaccess toapplicationanddata
 Deployanapplicationlayerfirewallforevent-datainspection
 Detectandfixvulnerabilitiesinthird-partydependencies
 Useleast-privilegedIAMrolesandpermissions
 Enforcelegitimateapplicationbehavior
 Data leakprevention
 Scan codeandconfigurationsstaticallyduringdevelopment
 Maintainserverless/cloudassetinventory
 Removeobsolete/unusedcloudservicesandfunctions
 Continuouslymonitorerrorsandsecurityincidents
8%
92%
APPLICATIONOWNER
CLOUD
PROVIDER
http://bit.ly/faas-vs-iaas

9. Security Responsibility: WhenYou Adopt Serverless
 Physicalinfrastructure,access restrictionstophysicalperimeterandhardware
 Secureconfigurationofinfrastructuredevicesandsystems
 Regularlytestingthesecurityofallsystems/processes(OS, services)
 Identificationandauthenticationofaccess tosystems(OS,services)
 PatchingandfixingflawsinOS
 HardeningOS andservices
 Protectingallsystemsagainstmalwareandbackdoors
 Patchingandfixingflawsinruntimeenvironmentandrelatedsoftwarepackages
 Exploitpreventionandmemoryprotection
 Networksegmentation
 Trackingandmonitoringallnetworkresourcesandaccess
 Installationandmaintenanceofnetworkfirewalls
 Network-layerDoSprotection
 Authenticationofusers
 Authorizationcontrolswhenaccessing applicationanddata
 Log andmaintainaudittrailsofallaccess toapplicationanddata
 Deployanapplicationlayerfirewallforevent-datainspection
 Detectandfixvulnerabilitiesinthird-partydependencies
 Useleast-privilegedIAMrolesandpermissions
 Enforcelegitimateapplicationbehavior
 Data leakprevention
 Scan codeandconfigurationsstaticallyduringdevelopment
 Maintainserverless/cloudassetinventory
 Removeobsolete/unusedcloudservicesandfunctions
 Continuouslymonitorerrorsandsecurityincidents
52%
48%
APPLICATIONOWNER
CLOUD
PROVIDER

10. TopRisks for Serverless Applications http://bit.ly/csa-top-12
SAS-1
Function event-data injection
Broken authentication
SAS-2
Insecure serverless deployment
SAS-3
Over-privileged function permissions
SAS-4
Inadequate function monitoring
SAS-5
Insecure 3rd partydependencies
SAS-6
Insecure app secrets storage
SAS-7
DoS&Financial exhaustion
SAS-8
Serverless business logic manipulation
SAS-9
Improper exceptions handling &errors
SAS-10
Legacy functions & cloud resources
SAS-11
Cross-execution data persistency
SAS-12

11. The Need For Serverless-Native Protection
Protects applications by being
deployed on networks and servers
TRADITIONALSECURITY
Theapplication owner doesn't have any
control over the infrastructure
SERVERLESS

12. INFRASTRUCTURE
SERVERLESS
FUNCTIONS WAF
LAYER 7
NG-FW
INBOUND
WSG
OUTBOUND
IPS
NETWORK
EPP
BEHAVIORAL
APPLICATION
TraditionalProtectionsCannotBe Deployed On Serverless

13. Wait… DoesPCIDSS Even
Applyto ServerlessApps?

14. PCI DSS Applicabilityto FaaS/ Serverless
 PCI DSS requirements & assessment procedures are stillvery much relevant to applications
built on public-cloud FaaS
 Public-cloud FaaS surfaces certain technicalchallenges related to the ability of organizations to
comply using existingapproaches
 “PCI SSC Cloud Computing Guidelines” sheds light on the challengesand technicallimitations
of existing solutions, however doesn’t explicitlydiscuss FaaS (Only IaaS, PaaS, SaaS)

15. Serverless & PCI: Where to Start?
https://www.pcisecuritystandards.org/pdfs/PCI_SSC_Cloud_Guidelines_v3.pdf
“Use of a PCIDSS compliant Provider does not automatically result in PCIDSS
compliance for theCustomers”
⚠️
“Even where a cloud service is validated for certain PCI DSSrequirements, this
validation does not automatically transfer to the Customer environments within that
cloud service”
⚠️
This guidance is intended for organizations using, or thinkingof using, providing or
assessing cloud technologies. It provides guidance on the useof cloud technologies and
considerations for maintainingsecurity controls incloud environments

16. Requirement 1

17. Challenge #1: Network Access vs. API Access
 In FaaS, the network is abstracted and is nolonger relevantto customers
 Network traffic is replaced byapplication layer APIs + cloudAPIs
 Access is controlled by IAM permissions
 Inbound traffic, is mostly replacedby cloud eventsource triggers
 Outbound traffic from theserverless runtime still possible
“AswebservicesandAPIsarebynaturepubliclyaccessible, theirsecurityiscriticalto thesecurityoftheresourcesto whichtheyprovideaccess. Ifnot
properlydeveloped, managedandsecured, theseinterfacescanbeexploited orcompromised, resultinginunexpectedbehavior andpotentially
unauthorizedaccess” (PCISSCCloudComputingGuidelines)
Since Firewalls/routers cannot bedeployed by customers of public-cloud FaaS, there aretechnical challenges for requirements: 1.2.1(Restrict
inboundandoutboundtraffic…) , 1.3.4(Donotallowunauthorizedoutboundtraffic)

18. Requirements 5 & 6

19. Challenge #2: User Access Goes Beyond HTTP/Web
 Serverless provides a rich set of cloud-native event inputs (dozens). Webtraffic is not the most common event
source
 Files are less relevant as a malware vector, otherinputs may still behave as malware
 WAFs provide incomplete security protection
 SAST solutions are ineffective (logic spans over functions, events and cloud services). Also doesn’t scan
Infrastructure-as-code and IAM permissions
 Already-deployed functions also require scanning for vulnerabilities (SCA)
 DAST is ineffective for non-web events
Technicalchallengesfor requirements: 5(Protect allsystems against malware), 5.1,6(Develop andmaintainsecuresystems &applications), 6.2
(Ensurethatallsystem componentsandsoftware areprotected fromknownvulnerabilities), 6.6(Manualorautomatedapplication vulnerability
securityassessment tools, automatedtechnicalsolution thatdetects andprevents web-based attacks -forexample,a WAF)

20. FUNCTION
{;}
Direct Invoke (24%)
Queues & Streams (21%)
API Gateway (14%)
File Storage (13%)
Notifications (13%)
Logs (12%)
Database (4%)
…
…
…
37 other sources
WAF
SERVERLESS APPLICATION
INPUTS (EVENTS)
Estimation based on https://www.slideshare.net/ChrisMunns/serverless-is-
dead-132954772

21. Back to the Drawing Board

22. FaaSapplicationsrequire a different securityapproach
 The approach must be Serverless-centric, and should include the following:
 Serverless oriented security testing:
 Abilitytoscan Infrastructure-as-code& IAM roles, permissions,cloudservice config.
 Abilitytodetect knownvulnerabilitiesin OSSpackagesofdeployedfunctions
 Serverless-native application firewall:
 Capableofdetecting & preventing attacksvia all cloud-nativeevent sourcetriggers
 Canscale andprovideappsecurityforconcurrentexecutionsacrossregions
 Serverless dedicated behavioral protection:
 Capableofpreventing unwantedbehaviorandmalicious processes
 Canenforcestrictaccesspermissions toprevent unauthorizedcloudAPI access
 Canblockoutboundtrafficanddataleakage tothe Internetorothercloud accounts

23. Puresec SSP:
SERVERLESS POSTURE MANAGEMENT
RUNTIME PROTECTION
SECURITY VISIBILITY
SERVERLESS ASSET INVENTORY
VULNERABILITY MANAGEMENT
DETECT IAM & CONFIGURATION ISSUES
CI / CD INTEGRATION
SERVERLESS APPLICATION FIREWALL
BEHAVIORAL PROTECTION W/ ML
BLAZING FAST
PAINLESS DEPLOYMENT REAL TIME APP SECURITY VISIBLITY
DEEP FORENSIC ANALYSIS
SIEM INTEGRATIONS
© 2019 PURESEC

24. How Can PureSec Fill YourPCI DSS Gaps?
Requirement Challenge Solution
REQUIREMENT 1 • Cannot deploy firewalls & routers
• Inbound traffic is now event triggers
• Cannot prevent outbound traffic
• Least privileged IAM permissions (who
can invoke?) – via automated static
scanning
• Block unauthorized outbound traffic
through Behavioral protection
REQUIREMENT 5 • Cannot deploy anti-malware and
endpoint prevention
• Enforce known good behavior and prevent
malicious actions through Behavioral
protection
• Block attempts to inject code through
Serverless App Firewall
REQUIREMENT 6 • SAST alone is ineffective
• SAST doesn’t cover deployed assets
• DAST is ineffective
• WAF provides extremely partial
coverage
• Automated scanning of Serverless code,
configuration, IAM, and OSS
• Full coverage over all event source types
with Serverless App Firewall