Defense in depth: when perimeter security is not enough

1. © 2019, Amazon Web Services, Inc. or its Affiliates.
Samuel Waymouth, Solution Architect
Lambda Function Security
Defense in depth: when perimeter security is not
enough

2. © 2019, Amazon Web Services, Inc. or its Affiliates.
Table of contents
• Threat Model and evolution of risk
• Managing risk and evolving Security Controls
• Review of AWS Partner products

3. © 2019, Amazon Web Services, Inc. or its Affiliates.
Has the sun set on perimeter security?

4. © 2019, Amazon Web Services, Inc. or its Affiliates.
R.I.P. Perimeter Security, 8000 BC to 2007
“The businesses that use this increased connectivity
and operational features appreciate that their growth
can only be sustained by assuring that they provide
secure transactions. The corporate boundary as a
secure perimeter cannot provide this, because new
communications technologies bypass that perimeter.”
The Open Group Jericho Forum (2007). Jericho Forum
Business Rationale for De-Perimeterization Version 2.0,
https://publications.opengroup.org/w127

5. © 2019, Amazon Web Services, Inc. or its Affiliates.
The way it used to be…

6. © 2019, Amazon Web Services, Inc. or its Affiliates.
Serverless

7. © 2019, Amazon Web Services, Inc. or its Affiliates.
It’s like that, and that’s the way it is…

8. © 2019, Amazon Web Services, Inc. or its Affiliates.
Risks haven’t gone away, they’ve evolved
• Traditional controls need to evolve too
• Threat surface is larger, not smaller
• Focus on the developer, pipeline and 3rd party code

9. © 2019, Amazon Web Services, Inc. or its Affiliates.
Introducing Naïve App

10. © 2019, Amazon Web Services, Inc. or its Affiliates.
Naïve App
Administration
WriteToDynamoDB
ReadFromDynamoDB
InvokeBadAPI
index.html
Static Content

11. © 2019, Amazon Web Services, Inc. or its Affiliates.
OS Attack: Run a malicious command
Malicious Command
INPUT:
env | grep AWS
CODE:
result =
subprocess.check_output(cmd
, stderr=subprocess.STDOUT,
shell=True)
OUTPUT:
AWSSECRETKEY…
AWSACCESSKEY…
Malicious
Command

12. © 2019, Amazon Web Services, Inc. or its Affiliates.
Injection Attack: Inject a malicious payload
Malicious Command
INPUT:
<script>alert(1)
;</script>
CODE:
response=table.put_item(Item
={"uuid":myuuid,"firstname":
firstname,"surname":surname,
"email":email})
OUTPUT:
“Email”:”
<script>alert(1
);</script>
Malicious
Payload

13. © 2019, Amazon Web Services, Inc. or its Affiliates.
Network Attack: Call an untrusted API
Malicious Command
INPUT:
https://someurl
CODE:
apiresponse=requests.post(url)
OUTPUT:
<script>alert(1
);</script>
Malicious
Payload
Internet

14. © 2019, Amazon Web Services, Inc. or its Affiliates.
New Security Controls for New
Risks

15. © 2019, Amazon Web Services, Inc. or its Affiliates.
AWS Partners can help you…

16. © 2019, Amazon Web Services, Inc. or its Affiliates.
3 Key Takeaways
• Threats and risks have evolved, controls need to evolve too
• New Security focus on who is delivering code, where it came from and how
they deploy it
• In a Serverless Architecture the Identify & Access Management policies are
your perimeter

17. © 2019, Amazon Web Services, Inc. or its Affiliates.© 2019, Amazon Web Services, Inc. or its Affiliates.
Q&A

18. © 2019, Amazon Web Services, Inc. or its Affiliates.© 2019, Amazon Web Services, Inc. or its Affiliates.
Thank you!

19. © 2019, Amazon Web Services, Inc. or its Affiliates.
Useful Links
• AWS, 2020. IAM Policy Tutorials,
https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorials.html
• AWS, 2020. IAM Best Practices, https://docs.aws.amazon.com/IAM/latest/UserGuide/best-
practices.html
• AWS, 2020. Introduction to AWS Identity and Access Management,
https://www.aws.training/Details/Video?id=16448
• AWS, 2019. Deep Dive into IAM Access Analyzer, https://youtu.be/i5apYXya2m0
• AWS, 2019. Access Management in 4D, https://youtu.be/BFrWnKZ0DQ8
• AWS, 2020. Unit Testing IAM Policies Across Multiple Accounts,
https://aws.amazon.com/blogs/devops/unit-testing-iam-policies-across-multiple-accounts/
• PaloAlto Networks, 2020. PaloAlto Prisma Cloud,
https://docs.paloaltonetworks.com/prisma/prisma-cloud.html
• PureSec, 2018. The Ten Most Critical Security Risks in Serverless Architectures,
https://www.puresec.io/hubfs/SAS-Top10-2018/PureSec%20-
%20SAS%20Top%2010%20-%202018.pdf
• PureSec, 2019. Serverless Plugin for PureSec cli, https://github.com/puresec/serverless-
puresec-cli