Serverless Security: Attack and Defense
summary
Compares serverless security across AWS, Azure and GCP, showing concrete attacks: an NPM supply-chain backdoor that exfiltrates environment keys (seen in 500+ installs), GCP Functions defaulting to Editor roles, Azure/GCE exposing credentials via the metadata endpoint 169.254.169.254, and a ReDoS in filename validation that enables a costly ‘Denial of Wallet’ (~$1,500 for 100k malicious invocations). Presents practical mitigations: per-function least-privilege IAM roles, block outbound egress / use VPC endpoints, store secrets in secret managers instead of env vars, and enforce API validation, concurrency limits and timeouts.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:08What is serverless?
- 11:25Serverless attack examples
- 37:51Attacks via external dependencies
- 46:20Regular expressions in serverless
- 53:38Secrets in environment variables
- 56:47Summary & Q&A
related talks
30mServerless Security Top 10
33mServerless Security: New Risks Require New Approaches
18mA First Look at the Security of Serverless Applications
40mServerless Architecture Security Patterns for Securing the Unseen
22mServerless Security 101: Everything you need to know
24mServerless security: how to protect what you don't see?
50mAutomated Serverless Security Testing: Delivering secure apps continuously
46mOWASP SERVERLESS TOP 10