Download as PDF, PPTX
![LONDON 18-19 OCT
2018
[ Thank You!
@theburningmonk
theburningmonk.com ]](https://image.slidesharecdn.com/securityinserverlessworld-181018101436/85/Security-in-serverless-world-172-320.jpg)
Uploaded byYan Cui
Security in serverless world
The document outlines key security concerns in serverless environments, emphasizing the shared responsibility model and highlighting the importance of protecting code and dependencies from vulnerabilities. It discusses various attack vectors, such as compromised packages and the need for strict access controls, while advocating for practices like input sanitization and the 'least privilege' principle. Additionally, it underscores the necessity of monitoring and managing AWS resources effectively to mitigate risks related to data breaches and denial of service attacks.
More Related Content
Similar to Security in serverless world
![Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/apachesparkgettingstarted-260203175547-8361bcc3-thumbnail.jpg?width=640&height=640&fit=bounds)
Security in serverless world
- 1. LONDON 18-19 OCT 2018 Securityin the Serverless World YAN CUI
- 2.
- 4. We’re hiring! Visit engineering.dazn.com tolearn more. follow @dazneng for updates about the engineering team
- 5. follow @dazneng for updatesabout the engineering team We’re hiring! Visit engineering.dazn.com to learn more. WE’RE HIRING!
- 6. AWS user since2009
- 7.
- 8.
- 9.
- 10. protection from OSattacks Amazon automatically apply latest patches to host VMs
- 13. still have topatch your code vulnerable code, 3rd party dependencies, etc.
- 15.
- 16. https://snyk.io/blog/owasp-top-10-breaches Known Vulnerable Componentscause 24% of the top 50 data breaches
- 17.
- 22.
- 23. sanitise inputs &outputs (standardise and encapsulate into shared lib)
- 25. http://bit.ly/2gSHtay Broken Access Control InsecureDirect Object Reference Information Leakage GraphQL Injection
- 26.
- 27.
- 29. app dependencies is a attacksurface BIGGER than you think
- 30.
- 31.
- 32.
- 34.
- 35. security updates areoften bundled with unrelated feature and API changes
- 36. your security isas strong as its weakest link
- 37. OS Application Dependencies physical infrastructure NPM Authors Container runs in runsin runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Networking runs on needs Source Code has maintains
- 38. OS Application Dependencies physical infrastructure NPM Authors Container runs in runsin runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Networking needs runs on this is where an attacker will target in a movie Source Code has maintains
- 41. OS Dependencies physical infrastructure NPM Authors Container runs in runsin runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application A9 Networking runs on needs Source Code has maintains A1, A3, …
- 42. people are oftenthe WEAKEST link in the security chain
- 44. OS Dependencies physical infrastructure NPM Authors Container runs in runsin runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application phishing… Networking runs on needs Source Code has maintains
- 45. OS Dependencies physical infrastructure NPM Authors Container runs in runsin runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application brute force, known account leaks, … Networking runs on needs Source Code has maintains
- 46. OS Dependencies physical infrastructure NPM Authors Container runs in runsin runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application brute force, known account leaks, … Networking runs on needs Source Code has maintains
- 47. http://bit.ly/2sFDwYX …obtained publish accessto 14% of npm packages…
- 48. http://bit.ly/2sFDwYX debug, request, react,co, express, moment, gulp, mongoose, mysql, bower, browserify, electron, jasmine, cheerio, modernizr, redux, …
- 49. http://bit.ly/2sFDwYX total downloads/month ofthe unique packages which I got myself publish access to was 1 972 421 945, that’s 20% of the total number of d/m directly.
- 50. 20% of allmonthly NPM downloads…
- 51. brute force known accountleaks from other sources leaked NPM credentials (github, etc.)
- 52.
- 53. http://bit.ly/2sFDwYX 662 users hadpassword “123456” 172 — “123” 124 — “password”
- 56.
- 61. oh god, thatwas too easy…
- 64. compromised package isa transient dependency sigh…
- 65.
- 68.
- 70.
- 71. NPM default -get latest “compatible” version, ie. 1.X.X
- 72. clean install (eg.on CI server) will download the latest, compromised package without any code change… NPM default - get latest “compatible” version, ie. 1.X.X
- 74. use npm shrinkwrap orupgrade to NPM 5 or above
- 75. not specific toNode.js or NPM
- 76.
- 77. the attackers arein… what now?
- 78.
- 79. who can invokethe function?
- 80. what can thefunction access?
- 81.
- 83.
- 85.
- 86.
- 87. always public access iscontrolled via IAM
- 92.
- 93. adds up to10s to cold start!! http://bit.ly/2lNInES
- 94. compromised servers allow attackerto access all of your sensitive data!
- 95.
- 97. always public implement authenticationwith API keys, Cognito, or custom authorizer functions
- 98.
- 100.
- 104.
- 108. AWS Lambda docs Write yourLambda function code in a stateless style, and ensure there is no affinity between your code and the underlying compute infrastructure. http://amzn.to/2jzLmkb
- 109.
- 110. secure sensitive databoth at rest and in-transit
- 111.
- 112.
- 113.
- 114.
- 115.
- 116. Disposability is avirtue
- 117. AWS Lambda docs Delete oldLambda functions that you are no longer using. http://amzn.to/2jzLmkb
- 118. easier said thandone…
- 119. identifying component ownership ina big IT organization is challenging
- 120. identifying ownership of individualfunctions is much harder
- 121.
- 122. more likely toscale through DoS attacks
- 123. DoS + perexec billing = Denial of Wallet problem
- 124. have to choosebetween a DoS and a DoW problem…
- 126. AWS Shield Advancedalso gives you access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your ELB, CloudFront or Route 53 charges.
- 127. async sync S3 SNS SES CloudFormation CloudWatch Logs CloudWatchEvents Scheduled Events CodeCommit AWS Config http://amzn.to/2vs2lIg Cognito Alexa Lex API Gateway streams DynamoDB Stream Kinesis Stream Lambda handles retries (twice, then DLQ)
- 128.
- 129.
- 130. DoS attack Regex DoSattack long Lambda timeout 2+ Retries+ ?
- 132.
- 133.
- 135. no long-lived compromisedservers
- 136. containers are reused,avoid sensitive data in /tmp
- 137.
- 141. no accidentally exposeddirectories
- 145.
- 146. monitor activities in unusedregions using CloudWatch Events
- 148. set up billingalarms in unused regions
- 149. watertight compartments thatcan contain water in the case of hull breach or other leaks
- 150.
- 151.
- 152.
- 153.
- 154.
- 155. app dependencies is a attacksurface BIGGER than you think
- 157. sanitise inputs andoutputs
- 158.
- 159. here’s your perfunction policy NEXT!
- 160. S3 AWS IoT DynamoDB RDS EventStore Elasticsearch Couchbase Redshift Neo4j GoogleBigQuery encrypt data at rest
- 161. S3 AWS IoT DynamoDB RDS EventStore Elasticsearch Couchbase Redshift Neo4j GoogleBigQuery and in-transit
- 162.
- 163. DoS DoW* * Denialof Wallet
- 167. no server* no OSattacks no long lived compromised servers * I know I know, there’s still a server somewhere, but it’s managed and secured by AWS engineers who can do a much better job of it than most of us can; and the servers are ephemeral and short-lived
- 168. don’t be anunwilling bit miner
- 169. don’t be anunwilling bit miner safeguard your credentials…
- 170.
- 171. people are oftenthe WEAKEST link in the security chain
- 172. LONDON 18-19 OCT 2018 [Thank You! @theburningmonk theburningmonk.com ]