Going ‘serverless’ is like farming out mundane tasks to professional dev teams. You get increased flexibility, accelerated innovation, and reduced . All these awesome perks are included while building the . architecture costs ultimate user experience Sounds good, right? Well, it’s . too good to be true Managing a always comes at a cost. complex infrastructure In the case of serverless , its distributed nature gives a cyber breach lots of . infrastructure golden opportunities It turns out that the major differentiator of serverless is also its archenemy that provides attackers with significantly . With that being said, let us dwell on the main five problems that underpin today. more points of entry security issues Serverless - Malware Just Found A New Home In general, many well-known software risks like wrongly configured credentials or in serverless, but they manifest in a different way. SQL injection make a comeback Risk 1: Function Event-Data Injection This risk takes place when unreliable or is delivered to an interpreter and gets run or . attacker-controlled input evaluated The main reason for that is that we don’t always make sure the input is of the expected data type. And as most serverless architectures have a , it is not that hard to spark off a . myriad of event sources serverless function Risk 2: Broken Authentication Since serverless fosters a system design, applications often include a large number of functions, each with a unique target. microservices-oriented Being intertwined, create overall system logic. However, some functions may disclose public web APIs, while others ingest events from various source types. So is a no-brainer in this case. these functions unauthorized access Risk 3: Insecure Serverless Deployment Configuration offer many customizations and configuration settings to fine-tune them for each unique need or task. Some of these have alarming consequences on the overall security standpoint. Cloud providers out-of-the-box configuration settings Thus, a for cloud-based storage is incorrectly configured cloud storage authentication. And if configurations are left unchecked, it may wreak . popular weak point havoc on your security Risk 4: Overprivileged Function Permissions and Roles Serverless functions have access rights, such as the right to access a database. And if you have many functions, you’ll have the same amount of permissions. In an ideal world, these all that are as restricted as possible. should be different rights has the time to manage a zillion function authorizations? Most often, developers by applying a "wildcard" permission model. In this case, serverless functions may end up in the and used for unplanned operations. But who find a shortcut wrong hands Risk 5: Inadequate Function Monitoring and Logging It’s essential to log and instantly since it helps to uncover intruder attacks and impede data corruption. However, this architecture in a , beyond the user's data center borderline. monitor security-relevant events hosts these functions cloud environment And although many serverless providers supply highly efficient logging capabilities, these logs are in their and often fall short of delivering a full security event audit trail. basic configuration Subscribe to ’s newsletters via our subscribe form in the footer. HackerNoon

Instantly

Target

Cloud Computing for Dummies

IoT: Beyond Alexa

Subscribe to Newsletters by signing up via our footer subscription form. 

'Serverless': Malware Just Found a new Home

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

A Ring of Failure

105 Stories To Learn About K8s

10 Ways to Future-Proof Your Business With Cloud

10 Ways to Reduce Data Loss and Potential Downtime Of Your Database

10 Upcoming DevOps Conferences for 2018

A Ring of Failure

105 Stories To Learn About K8s

10 Ways to Future-Proof Your Business With Cloud

10 Ways to Reduce Data Loss and Potential Downtime Of Your Database

10 Upcoming DevOps Conferences for 2018

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps