Shedding Light on Security Considerations in Serverless Cloud Architectures

Understanding how a serverless architecture operates entails understanding the different services involved in it. Here we discuss the connected services in an AWS serverless architecture.

To further highlight the risks of implementing bad code on a serverless system, we created a proof of concept that involves an AWS Lambda function granted with high permissions. Through this video, we show how poor coding practices could allow malicious actors to successfully alter the AWS Lambda function timeout and subsequently perform other activities such as privilege escalation and data exfiltration.

Because serverless services have stateless functions, the data in these services remains cached and is not stored in memory. When moving data from serverless services to external locations, enterprises must be mindful of how the data is moved to avoid leakage. This is what happened when a database containing half a million sensitive legal and financial documents was exposed because of a misconfiguration that occurred when access policies were changed.

It is also important to know where data is stored to ensure that it doesn’t run into compliance issues, such as when over 36,000 inmate records from various correctional facilities in the US were leaked because a data repository associated with a cloud-based application was left open. The compromise of an enterprise’s application or service could very well result in business disruption and reputational damage.

Serverless services are not above risks and threats. In fact, our research provides a comprehensive discussion of the possible compromise and attack scenarios involving serverless services. But there are ways to keep serverless services and deployments secure.

Users must understand that the shared responsibility model, in which both the CSP and the user maintain zones of responsibility to keep the cloud environment secure, also applies to serverless computing. In our research paper, we provide ways in which serverless services and deployments can be protected against risks and threats through best practices and security solutions. We also also give recommendations on how to create secure serverless applications.

As more enterprises switch to serverless technology and as more applications are built on it, keeping serverless services and deployments secure becomes more critical. Our research paper “Securing Weak Points in Serverless Architectures: Risks and Recommendations” provides vital information and guidance that enterprises can use to keep their serverless environments safe against misconfigurations, errors, and unsecure coding practices — whether they’re already using serverless technology or are just planning to shift to it.