Serverless security: defence against the dark arts
•
3 likes•876 views
AWS has taken over the responsibilities of patching the OS and securing the underlying physical infrastructure that runs your serverless application, so what’s left for you to secure? Quite a bit it turns out. The OWASP top 10 is as relevant to you as ever; DOS attacks are still a threat even if you can probably brute force your way through it as AWS auto-scales Lambda functions automatically; and did you know attackers can easily steal your AWS credentials via your application dependencies? In addition to the traditional threats, serverless applications have more granular deployment units and therefore there are more things to configure and secure, and the tools and practices are still catching up with this fast-changing world.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Serverless security: defence against the dark arts
Similar to Serverless security: defence against the dark arts (20)
More from Yan Cui
More from Yan Cui (20)
Recently uploaded
Recently uploaded (20)
Serverless security: defence against the dark arts
- 1. Serverless Security defense against the dark arts
- 2. Yan Cui http://theburningmonk.com @theburningmonk Principal Engineer @ Independent Consultant
- 4. We’re hiring! Visit engineering.dazn.com to learn more. follow @dazneng for updates about the engineering team
- 5. follow @dazneng for updates about the engineering team We’re hiring! Visit engineering.dazn.com to learn more. WE’RE HIRING!
- 6. AWS user since 2009
- 10. protection from OS attacks Amazon automatically apply latest patches to host VMs
- 13. still have to patch your code vulnerable code, 3rd party dependencies, etc.
- 16. https://snyk.io/blog/owasp-top-10-breaches Known Vulnerable Components cause 24% of the top 50 data breaches
- 24. sanitise inputs & outputs (standardise and encapsulate into shared lib)
- 25. security is as much about what your function should do as well as what it shouldn’t do (protect against data exfiltration)
- 27. http://bit.ly/2gSHtay Broken Access Control Insecure Direct Object Reference Information Leakage GraphQL Injection
- 30. app dependencies is a attack surface BIGGER than you think
- 35. https://snyk.io
- 36. security updates are often bundled with unrelated feature and API changes
- 37. your security is as strong as its weakest link
- 38. OS Application Dependencies physical infrastructure NPM Authors Container runs in runs in runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Networking runs on needs Source Code has maintains
- 39. OS Application Dependencies physical infrastructure NPM Authors Container runs in runs in runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Networking needs runs on this is where an attacker will target in a movie Source Code has maintains
- 42. OS Dependencies physical infrastructure NPM Authors Container runs in runs in runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application A9 Networking runs on needs Source Code has maintains A1, A3, …
- 43. people are often the WEAKEST link in the security chain
- 45. OS Dependencies physical infrastructure NPM Authors Container runs in runs in runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application phishing… Networking runs on needs Source Code has maintains
- 46. OS Dependencies physical infrastructure NPM Authors Container runs in runs in runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application brute force, known account leaks, … Networking runs on needs Source Code has maintains
- 47. OS Dependencies physical infrastructure NPM Authors Container runs in runs in runs in has hosted by published by pushes to Developers develops uses Users guardsprotects Application brute force, known account leaks, … Networking runs on needs Source Code has maintains
- 48. http://bit.ly/2sFDwYX …obtained publish access to 14% of npm packages…
- 49. http://bit.ly/2sFDwYX debug, request, react, co, express, moment, gulp, mongoose, mysql, bower, browserify, electron, jasmine, cheerio, modernizr, redux, …
- 50. http://bit.ly/2sFDwYX total downloads/month of the unique packages which I got myself publish access to was 1 972 421 945, that’s 20% of the total number of d/m directly.
- 51. 20% of all monthly NPM downloads…
- 52. brute force known account leaks from other sources leaked NPM credentials (github, etc.)
- 54. http://bit.ly/2sFDwYX 662 users had password “123456” 172 — “123” 124 — “password”
- 59. WTF!?!?
- 64. oh god, that was too easy…
- 67. compromised package is a transient dependency sigh…
- 68. still “works”…
- 73. rm -rf /!!!
- 75. NPM default - get latest “compatible” version, ie. 1.X.X
- 76. clean install (eg. on CI server) will download the latest, compromised package without any code change… NPM default - get latest “compatible” version, ie. 1.X.X
- 78. use npm shrinkwrap or upgrade to NPM 5 or above
- 79. use `npm ci` in CI environment
- 80. not specific to Node.js or NPM
- 81. the attackers are in…
- 82. the attackers are in… what now?
- 84. who can invoke the function?
- 85. what can the function access?
- 90. sensitive data
- 92. always public access is controlled via IAM
- 98. adds up to 10s to cold start!! http://bit.ly/2lNInES
- 99. compromised servers allow attacker to access all of your sensitive data!
- 100. implement authentication for internal APIs
- 102. use AWS_IAM authentication for internal APIs
- 111. AWS Lambda docs Write your Lambda function code in a stateless style, and ensure there is no affinity between your code and the underlying compute infrastructure. http://amzn.to/2jzLmkb
- 113. secure sensitive data both at rest and in-transit
- 120. Disposability is a virtue
- 121. AWS Lambda docs Delete old Lambda functions that you are no longer using. http://amzn.to/2jzLmkb
- 122. easier said than done…
- 123. identifying component ownership in a big IT organization is challenging
- 124. identifying ownership of individual functions is much harder
- 125. tag every function with Team name
- 127. more likely to scale through DoS attacks
- 128. DoS + per exec billing = Denial of Wallet problem
- 129. configure WAF rules on API Gateway and CloudFront
- 130. enable throttling
- 132. AWS Shield Advanced also gives you access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your ELB, CloudFront or Route 53 charges.
- 133. async sync S3 SNS SES CloudFormation CloudWatch Logs CloudWatch Events Scheduled Events CodeCommit AWS Config http://amzn.to/2vs2lIg Cognito Alexa Lex API Gateway pulling DynamoDB Stream Kinesis Stream SQS Lambda handles retries (twice, then DLQ)
- 136. DoS attack Regex DoS attack long Lambda timeout 2+ Retries+ ?
- 138. avoid (unnecessary) long timeouts
- 139. alert on error count
- 140. Day 1
- 141. Day 2
- 143. no long-lived compromised servers
- 144. containers are reused, avoid sensitive data in /tmp
- 149. no accidentally exposed directories
- 154. monitor activities in unused regions using CloudWatch Events
- 156. set up billing alarms in unused regions
- 157. watertight compartments that can contain water in the case of hull breach or other leaks
- 158. Michael Nygard
- 162. Recap
- 163. app dependencies is a attack surface BIGGER than you think
- 165. sanitise inputs and outputs
- 167. here’s your per function policy NEXT!
- 168. S3 AWS IoT DynamoDB RDS EventStore Elasticsearch Couchbase Redshift Neo4j Google BigQuery encrypt data at rest
- 169. S3 AWS IoT DynamoDB RDS EventStore Elasticsearch Couchbase Redshift Neo4j Google BigQuery and in-transit
- 171. DoS DoW* * Denial of Wallet
- 175. no server* no OS attacks no long lived compromised servers * I know I know, there’s still a server somewhere, but it’s managed and secured by AWS engineers who can do a much better job of it than most of us can; and the servers are ephemeral and short-lived
- 176. don’t be an unwilling bit miner
- 177. don’t be an unwilling bit miner safeguard your credentials…
- 179. people are often the WEAKEST link in the security chain