Upload File

securing serverless - by breaking in...security in serverless vulnerabilities in your code...

  • Home
  • Documents
  • Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies
30
snyk.io Securing Serverless - By Breaking In Guy Podjarny, Snyk @guypod

Upload: others

Post on 30-Dec-2020

7 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Securing Serverless - By Breaking In

Guy Podjarny, Snyk @guypod

Page 2: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

About Me• Guy Podjarny, @guypod on Twitter

• CEO & Co-founder at Snyk

• History:

• Cyber Security part of Israel Defense Forces

• First Web App Firewall (AppShield), Dynamic/Static Tester (AppScan)

• Security: Worked in Sanctum -> Watchfire -> IBM

• Performance: Founded Blaze -> CTO @Akamai

• O’Reilly author, speaker

Page 3: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Serverless Security: The Theory(talk from ServerlessConf)

https://www.youtube.com/watch?v=CiyUD_rI8D8 https://snyk.io/blog/serverless-security-implications-from-infra-to-owasp/

https://www.youtube.com/watch?v=CiyUD_rI8D8
https://snyk.io/blog/serverless-security-implications-from-infra-to-owasp/
Page 4: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Today - straight to practice!

Page 5: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Agenda

• Show a demo serverless app

• Hack it

• Explain the security flaws and how to fix them

• Summary

• Q&A

Page 6: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Going Terminal…

Page 7: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Vulnerable Libraries

Page 8: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Example: Fetch file & store in s3 (Serverless Framework Example)

19 Lines of Code

2 Direct dependencies

19 dependencies (incl. indirect)

191,155 Lines of Code

https://github.com/serverless/examples/tree/master/aws-node-fetch-file-and-store-in-s3
Page 9: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Page 10: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Serverless does secureOS dependencies

Just not app dependencies

Page 11: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

1. Beware Vulnerable Libraries(test during dev, monitor over time)

Page 12: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Side Note:Snyk isn’t only for Serverless

Page 13: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Denial of Service

Page 14: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

2. ReDoS can still be costly (won’t take you down, but can hike up bill)

Page 15: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

BewareResource Exhaustion Attacks

Not all your services elastically scale

Page 16: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Secrets

Page 17: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

3. Avoid secrets in deployed code(env variables aren’t enough - Use a KMS!)

Page 18: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Serverless platforms offer aKey Management System

Just use it!

Page 19: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Granularity

Page 20: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

4. Deploy granular functions(shared function code = greater exposure)

Page 21: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

AWS Security Policy

Easier

Policy 3Policy 2

Policy 1

Safer

Page 22: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Permissions

Page 23: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

5. Use Granular Policies(only allow each function its minimum permissions)

Page 24: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

A function is a perimeterThat needs to be secured

Perimeter Perimeter

Perimeter

Perimeter

Perimeter

Page 25: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Immutability

Page 26: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

6. Don’t rely on immutability(Lambda - and others - reuse servers)

Page 27: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Serverless user is typicallyLow Privilege

Reducing impact substantially, but not eliminating it

Page 28: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

7. Worry about all functions (Every available function increases your attack surface)

Page 29: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Security in Serverless

Vulnerabilities in your code

Vulnerable App Dependencies

Permissions

Securing Data at rest

Vulnerable OS Dependencies

Denial of Service

Long-lived Compromised Servers

Third Party Services

Attack Surface

Security Monitoring

Better Neutral Worse

Page 30: Securing Serverless - By Breaking In...Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions Securing Data at rest Vulnerable OS Dependencies

snyk.io

Serverless is defined now.Let’s build Security in.

Thank You!

Guy Podjarny, Snyk @guypod

Don’t forget: OSS Security AMA

2:55pm, Waterfront CDE


Serverless IoT at iRobot - QCon San Francisco · 2020-06-05 · Serverless IoT at iRobot Ben Kehoe @ben11kehoe Cloud Robotics Research Scientist. ... Serverless Serverless-ness goes

Securing Serverless Architectures - AWS Serverless Web Day

Building stuff with monadic dependencies + unchanging dependencies + polymorphic dependencies + abstraction Neil Mitchell

Serverless London - Lambda@Edge (Serverless & Originless on AWS)

Blockchain - Apt Store for Serverless Apps - Nasir - Serverless Summit

Serverless & PHPthe future serverless? is PHP's future serverless? try! learn! share! bref.sh null serverless-php.news @matthieunapoli. Title: Bref - February 2020 Created Date:

Scaling Serverless

An NCC Group Publication SERVERLESS ARCHITECTURE: THE FUTURE OF CODE DEPLOYMENT … · An NCC Group Publication | Serverless Architecture 3 Scalability in Serverless Computing Serverless

Serverless Security and Things that Go Bump in the Night ......THE BAD NEWS • You still need to patch your software (vulnerable code, bad 3rd party libraries) • Stateless (serverless)

Serverless Framework - Creating serverless applications

Introduction to Serverless PHP - akrabat.com · Serverless Serverless is all about composing software systems from a collection of cloud services. With serverless, you can lean on

Introduction to Serverless PHP - on.notist.cloud · Serverless (e.g. OpenWhisk) Rob Allen ~ @akrabat. Serverless? The first thing to know about serverless computing is that "serverless"

Going Serverless

Nascent Notions On Serverless Computing€¦ · 2 Serverless Computing 3 Server Based Model vs Serverless Model 4 Why to use Serverless? 5 Leading Serverless providers 6 The Serverless

Serverless Presentation

Serverless Azure

Serverless On Stage - Serverless URL Shortener

Serverless applications

Democratizing Serverless—The Open Source Fn Project - Serverless Summit

Serverless Frameworks · serverless frameworks based on carefully designed set of criteria spanning the serverless application lifecycle • We view a serverless framework as: a software

Serverless use cases with AWS Lambda - More Serverless Event

Innovation with Serverless€¦ · What is serverless. Sub-second billing. Benefits of serverless. Micro-pricing. Ease of scale. Manage less. Architecting for Serverless “We must

Serverless Architecture

An NCC Group Publication SERVERLESS ARCHITECTURE: THE ... · An NCC Group Publication | Serverless Architecture 3 Scalability in Serverless Computing Serverless computing offers the

Kubernetes for Serverless - Serverless Summit 2017 - Krishna Kumar

Securing Serverless - By Breaking In · Going Terminal… snyk.io Vulnerable Libraries ... Security in Serverless Vulnerabilities in your code Vulnerable App Dependencies Permissions

Application Repository AWS Serverless · AWS Serverless Application Repository Developer Guide What Is the AWS Serverless Application Repository? The AWS Serverless Application Repository

OSGi Community Event 2010 - Dependencies, dependencies, dependencies

MULTIVALUED DEPENDENCIES, JOIN DEPENDENCIES AND FURTHER ... · PDF fileMULTIVALUED DEPENDENCIES, JOIN DEPENDENCIES AND ... to test MVDs that does not require project and join,

Conquering Serverless - Serverless Computing...Serverless is cheap enough for every developer to have their own application instances Serverless local development and testing is hard

Cheat Sheet- 10 Serverless Security Best Practices (1) · Cheat sheet: 10 Serverless Security Best Practices 1. Patch function dependencies Track the libraries you use in each function,

Chad Green From Zero to Serverless · Serverless The platform for next generation applications. From Zero to Serverless ... Challenges of Serverless Architecture 13 Complexity Organizational

Serverless Machine Learning on AWS - Serverless Meetup Milano

Well Actually Serverless, - DrupalCon Well Actually...The Serverless Framework with Node.js & AWS - Udemy Course Serverless Status - Newsletter Serverless Chronicle - Newsletter The

Dependencies, dependencies, dependencies