Serverless Security: Doing Security in 100 milliseconds

@WICKETT
DOING SECURITY IN
100 MILLISECONDS
SERVERLESS
SECURITY

@WICKETT
JAMES WICKETT
๏ Head of Research at Signal
Sciences
๏ Author at Lynda/LinkedIn Training
for DevOps Fundamentals course
releasing in November
๏ Blogger at theagileadmin.com and
labs.signalsciences.com

@WICKETT
DEVOPS ROADMAP
FOR SECURITY
http://info.signalsciences.com/book

@WICKETT
๏ Web App Firewall for modern workloads
๏ Cloud-native and devops friendly
๏ Answer the questions: Am I being attacked
right now? Are attackers becoming
successful?
๏ We are hiring (Golang, appsec, devops)
@WICKETT

@WICKETT
CONCLUSION
๏ Serverless encourages functions as deploy
units, coupled with third party services
that allow running end-to-end applications
without worrying about system operation.
๏ New serverless patterns are just emerging
๏ Security with serverless is easier
๏ Security with serverless is harder

@WICKETT
CONCLUSION (2)
๏ Four key areas apply to serverless security
๏ Software Supply Chain Security
๏ Delivery Pipeline Security
๏ Data Flow Security
๏ Attack Detection

@WICKETT
IT’S MARKETING
(CLOUD REBRANDED)

@WICKETT
SERVERLESS ==
NO SERVERS

@WICKETT
SERVERLESS ==
BACKEND AS A
SERVICE

@WICKETT
SERVERLESS ==
PLATFORM AS A
SERVICE

@WICKETT
SO, WHAT IS
SERVERLESS?

@WICKETT http://martinfowler.com/articles/serverless.html

@WICKETT
Serverless was first used
to describe applications
that significantly or fully
depend on 3rd party
applications / services (‘in
the cloud’) to manage
server-side logic and
state.
http://martinfowler.com/articles/serverless.html

@WICKETT
Serverless can also mean
applications where some amount
of server-side logic is still written
by the application developer but
unlike traditional architectures is
run in stateless compute
containers that are event-
triggered, ephemeral (may only
last for one invocation), and fully
managed by a 3rd party.

@WICKETT
HISTORY OF SERVERLESS
๏ 2012 - used to describe BaaS and Continuous Integration
services run by third parties
๏ Late 2014 - AWS launched Lambda
๏ July 2015 - AWS launched API Gateway
๏ October 2015 - AWS re:Invent - The Serverless company
using AWS Lambda
๏ 2015 to present - Frameworks forming
๏ 2016 - Serverless Conference
http://www.slideshare.net/AmazonWebServices/arc308-
the-serverless-company-using-aws-lambda

@WICKETT
Client
Server
Database
Proxy/LB
Server
Server

@WICKETT
Client
Auth Service API Gateway
Database
Service
Function A
Function B
Web Delivery

@WICKETT
WHAT CAN WE SAY
IS SERVERLESS?

@WICKETT
SERVERLESS IS
FUNCTIONS AS A
SERVICE (FaaS)

@WICKETT
BUT, BUT…
CONTAINERS!

@WICKETT
CONTAINERS …
ON DEMAND

@WICKETT
SERVERLESS IS
(NO MANAGEMENT OF)
SERVERS

@WICKETT
SERVERLESS IS
SERVICEFULL

@WICKETT
SERVERLESS IS AN
OPINIONATED FRAMEWORK
FOR COMPUTE

@WICKETT
Serverless encourages
functions as deploy units,
coupled with third party
services that allow running
end-to-end applications
without worrying about
system operation.

@WICKETT
A SHORT HISTORY
OF CLOUD

@WICKETT
THEN, ALONG
CAME CONTAINERS

@WICKETT
CONTAINERS ARE
TEH HAWTNESS

@WICKETT
LOTS OF EFFORT IN
CONTAINER
ORCHESTRATION

@WICKETT
THE CLOUD WAS TO
VIRTUALIZATION AS
SERVERLESS WILL
BE TO CONTAINERS

@WICKETT
IF YOU WANT TO LEAD YOUR
COMPANY BRAVELY INTO THE
NEW WORLD, YOU WOULD DO
WELL TO FOCUS LOT ON HOW
SERVERLESS WILL EVOLVE.
- @CLOUDOPINION
https://medium.com/@cloud_opinion/the-pattern-may-
repeat-26de1e8b489d

@WICKETT
SO, WHAT ARE THE
UPSIDES?

@WICKETT
PAY FOR WHAT YOU
USE IN 100MS
INCREMENTS

@WICKETT
WITH SERVERLESS
SYSTEM ADMINISTRATION
IS (MOSTLY) LOWER

@WICKETT
SERVERLESS IS
IMPLICIT
MICROSERVICES

@WICKETT
SHORT CIRCUITS OPS
AND MOVES
INFRASTRUCTURE
RUNTIME CLOSER TO
DEVS

@WICKETT
YOU CAN SKIP
CHEFFING DOCKERING
ALL THE THINGS!

@WICKETT
LEAN STARTUP
FRIENDLY

@WICKETT
GREAT, WHAT’S
THE CATCH?

@WICKETT
OPS BURDEN TO
RATIONALIZE
SERVERLESS MODEL
(SPECIFICALLY DEPLOY)

@WICKETT
STATELESS FOR REAL NO
MEMORY PERSISTENCE
ACROSS FUNCTION RUNS

@WICKETT
QUEUE PROCESSING

@WICKETT
RUN A WEB
APPLICATION

@WICKETT
API GATEWAY

@WICKETT
SECURITY IS THE
SAME AND DIFFERENT

@WICKETT
EVERYTHING IS
HTTP(S)

@WICKETT
WHAT USED TO BE
SYSTEM CALLS IS
NOW DISTRIBUTED
COMPUTING OVER
THE NETWORK

@WICKETT
SERVERLESS SHIFTS
ATTACK SURFACE TO
THIRD PARTIES

@WICKETT
LETS TRY A SAMPLE
APPLICATION IN AWS

@WICKETT
๏ Golang!
๏ AWS Lambda supports bring your own
binary
๏ Sparta wraps your binary with node.js shim

@WICKETT
OTHER OPTIONS
๏ Serverless Framework
๏ APEX
๏ Kappa

@WICKETT
WORDY
๏ Analyzes textual
occurrences given a block
of text, returns JSON
count of words
๏ Calls API under the hood
to get text
๏ It is comprised of
Lambda, s3, API Gateway

@WICKETT
go run main.go provision -s S3_BUCKET

@WICKETT
WHAT I LEARNED
ABOUT SERVERLESS
SECURITY

@WICKETT
FOUR AREAS OF
SERVERLESS SECURITY
๏ Secure Software Supply Chain
๏ Delivery Pipeline
๏ Data Flow Security
๏ Attack Detection

@WICKETT
SURFACE AREA
REDUCTION!

@WICKETT
SURFACE AREA
EXPANSION!

@WICKETT
SSL / TLS FROM
THE PROVIDER

@WICKETT
LAMBDA + S3 +
KINESIS + DYNAMODB
+ CLOUDFORMATION +
API GATEWAY + AUTH0

@WICKETT
USE A THIRD-PARTY
SERVICE FOR CONFIG
CHANGES

@WICKETT
DELIVERY PIPELINE
SECURITY

@WICKETT
CONFIGURATION IS
PART OF DELIVERY

@WICKETT
PROVIDER SECURITY
๏ Disable root access keys
๏ Manage users with profiles
๏ Secure your keys in your deploy system
๏ Secure keys in dev system
๏ Use provider MFA

@WICKETT
SIMPLE DEPLOY
PIPELINE SECURITY
๏ Only dev keys can push to ‘dev’
๏ Only build/deploy system can push to pre-
prod
๏ Integration tests must pass in this env
๏ Security validation must take place
๏ Allow push to prod, only by deploy system

@WICKETT
SECURITY INTEGRATION
TESTING
๏ BDD-Security - github.com/
continuumsecurity/bdd-security
๏ Gauntlt - gauntlt.org

@WICKETT
http://www.slideshare.net/wickett/pragmatic-security-and-
rugged-devops-sxsw-2015

@WICKETT
DATA FLOW
SECURITY
๏ Development
๏ Data Flow
Diagrams
๏ Threat modeling
๏ Runtime

@WICKETT
Application layer
DoS

@WICKETT
TIMEOUTS AND
EXECUTION
RESTRICTIONS

@WICKETT
DEVELOPMENT
๏ Normal OWASP tooling
๏ Language filtering and more

@WICKETT
DEFENSE
๏ Logging, emitting events
๏ Vandium (SQLi) wrapper
๏ Content Security Policy (CSP)
๏ More work needs to be done here…

@WICKETT
LET’S TALK!
๏ james@signalsciences.com
๏ @wickett
๏ http://info.signalsciences.com/book

Serverless Security: Doing Security in 100 milliseconds

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Serverless Security: Doing Security in 100 milliseconds

Similar to Serverless Security: Doing Security in 100 milliseconds (20)

More from James Wickett

More from James Wickett (20)

Recently uploaded

Recently uploaded (20)

Serverless Security: Doing Security in 100 milliseconds