Guy Podjarny from Snyk gave a presentation on securing serverless applications. He demonstrated vulnerabilities in a sample serverless app and how to fix them. The main security issues discussed were vulnerable dependencies, denial of service attacks from regular expression denial of service (ReDoS) vulnerabilities, secrets in code, granular permissions and functions, and immutable servers being reused. Podjarny emphasized testing for vulnerabilities, using key management systems, deploying narrowly-scoped functions, and monitoring functions over time.

1. snyk.io
Securing Serverless -
By Breaking In
Guy Podjarny, Snyk
@guypod

2. InfoQ.com: News & Community Site
• Over 1,000,000 software developers, architects and CTOs read the site world-
wide every month
• 250,000 senior developers subscribe to our weekly newsletter
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• 2 dedicated podcast channels: The InfoQ Podcast, with a focus on
Architecture and The Engineering Culture Podcast, with a focus on building
• 96 deep dives on innovative topics packed as downloadable emags and
minibooks
• Over 40 new content items per week
Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
serverless-security-2017

3. Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide
Presented at QCon San Francisco
www.qconsf.com

4. snyk.io
About Me
• Guy Podjarny, @guypod on Twitter
• CEO & Co-founder at Snyk
• History:
• Cyber Security part of Israel Defense Forces
• First Web App Firewall(AppShield), Dynamic/Static Tester(AppScan)
• Security: Worked in Sanctum -> Watchfire -> IBM
• Performance: Founded Blaze -> CTO @Akamai
• O’Reilly author, speaker

5. snyk.io
Serverless Security: The Theory
(talk from ServerlessConf)
https://www.youtube.com/watch?v=CiyUD_rI8D8
https://snyk.io/blog/serverless-security-implications-from-infra-to-owasp/

6. snyk.io
Today - straight to practice!

7. snyk.io
Agenda
• Show a demo serverless app
• Hack it
• Explain the security flaws and how to fix them
• Summary
• Q&A

8. snyk.io
Going Terminal…

9. snyk.io
Vulnerable Libraries

10. snyk.io
Example: Fetch file & store in s3
(Serverless Framework Example)
19 Lines of Code
2 Direct dependencies
19 dependencies(incl. indirect)
191,155 Lines of Code

11. snyk.io

12. snyk.io
Serverless does secure
OS dependencies
Just not app dependencies

13. snyk.io
1. Beware Vulnerable Libraries
(test during dev, monitor over time)

14. snyk.io
Side Note:
Snyk isn’t only for Serverless

15. snyk.io
Denial of Service

16. snyk.io
2. ReDoS can still be costly
(won’t take you down, but can hike up bill)

17. snyk.io
Beware
Resource Exhaustion Attacks
Not all your services elastically scale

18. snyk.io
Secrets

19. snyk.io
3. Avoid secrets in deployed code
(env variables aren’t enough - Use a KMS!)

20. snyk.io
Serverless platforms offer a
Key Management System
Just use it!

21. snyk.io
Granularity

22. snyk.io
4. Deploy granular functions
(shared function code = greater exposure)

23. snyk.io
AWS Security Policy
Easier
Policy 3Policy 2
Policy 1
Safer

24. snyk.io
Permissions

25. snyk.io
5. Use Granular Policies
(only allow each function its minimum permissions)

26. snyk.io
A function is a perimeter
That needs to be secured
Perimeter Perimeter
Perimeter
Perimeter
Perimeter

27. snyk.io
Immutability

28. snyk.io
6. Don’t rely on immutability
(Lambda - and others - reuse servers)

29. snyk.io
Serverless user is typically
Low Privilege
Reducing impact substantially, but not eliminating it

30. snyk.io
7. Worry about all functions
(Every available function increases your attack surface)

31. snyk.io
Security in Serverless
Vulnerabilities in your code
Vulnerable App Dependencies
Permissions
Securing Data at rest
Vulnerable OS Dependencies
Denial of Service
Long-lived Compromised
Servers
Third Party Services
Attack Surface
Security Monitoring
Better Neutral Worse

32. snyk.io
Serverless is defined now.
Let’s build Security in.
Thank You!
Guy Podjarny, Snyk
@guypod
Don’t forget:
OSS Security AMA
2:55pm, Waterfront CDE

33. Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
serverless-security-2017