Serverless Security: New Risks Require New Approaches
summary
Serverless apps still run code so miswritten lambdas leak secrets and permissions; a demo uses command injection via S3 upload to exfiltrate a Lambda’s env vars and AWS keys then list buckets and alter orders. Traditional SAST/DAST/IAST blind to event flows and infrastructure; there are ~8,000 AWS methods and ~5,000 IAM actions to pick from. Proposed approach is a cloud-aware continuous scanner that discovers resources, simulates attacks, verifies exploits and enforces least privilege detection across deployments and the OWASP Serverless Top 10.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:06Cloud native is the future of app development
- 1:37Cloud native transformation has begun
- 2:09More than a technology shift
- 4:09Serverless architecture
- 5:03What is serverless?
- 6:48What about security?
- 7:42Resource-based IAM
- 11:33Loss of perimeter
- 12:43Serverless risks
- 15:43OWASP serverless top 10
- 16:08Demo
- 21:09Scale
- 21:48Traditional AppSec testing for cloud native
- 22:55Traditional testing in modern CI/CD pipelines
- 24:26iRobot serverless app
- 25:17SCA & image scanning
- 25:57Infrastructure as code
- 26:33IAST
- 26:58SAST
- 27:22DAST
- 27:57AppSec testing, redefined for the cloud
- 29:20Example use case
- 31:52One DevSecOps platform
- 32:40Outro
related talks
30mServerless Security Top 10
50mAutomated Serverless Security Testing: Delivering secure apps continuously
24mServerless security: how to protect what you don't see?
46mOWASP SERVERLESS TOP 10
40mServerless Architecture Security Patterns for Securing the Unseen
30mSecurity in the Serverless Environment
18mA First Look at the Security of Serverless Applications
57mServerless Security: Attack and Defense