CloudFlow: Identifying Security-sensitive Data Flows in Serverless
summary
CloudFlow statically finds security-sensitive data flows in Python serverless apps by extracting infrastructure definitions (events, permissions, handlers), modeling cloud API inputs, and instrumenting code into a synchronous representation so general-purpose tools can run. It uses Pysa as the underlying analyzer, evaluates on CloudBench 40 microbenchmarks (passes 37/40: 1 false positive, 2 false negatives), and scans 104 real apps finding 205 sensitive flows and 11 confirmed vulnerabilities. Framework overhead is modest—75% of apps show ≤12.8% extra time.
AI-written summary · about
chapters (9)
- 0:00CloudFlow framework
- 1:56Static analysis challenges
- 2:41Security-sensitive data flow example
- 4:08Combining infrastructure and code
- 6:37CloudBench microbenchmarks
- 8:05Real-world serverless analysis
- 9:30Vulnerabilities detected
- 10:36Performance overhead and scalability
- 12:02Key takeaways and future work
related talks
20mSymFlow: Event-Chain-Aware Symbolic Execution for Serverless Sensitive Data Flow(…)
50mAutomated Serverless Security Testing: Delivering secure apps continuously
28mDefending Your Cloud Apps Against the Serverless Top 10
33mServerless Security: New Risks Require New Approaches
49mRelational Observability for Cloud-Native Security and Data Science
14mConfidence in cloud security: One step ahead of cyber threats
24mServerless security: how to protect what you don't see?
30mSecurity in the Serverless Environment