Published 27/08/2019 – est. 4 minutes to read.
Serverless can be daunting to some Security Pros
As it’s a complete shift from the ‘norm’, the norm being running Windows and Linux server Operating systems on EC2 instances, maybe with a few Docker containers orchestrated with ECS or EKS.
At Cyber Security Specialists, we have always embraced technological advances that benefit our clients and work tirelessly to ensure their workloads remain secure. As Lambda became more popular among our client base, we conducted a technical deep dive to identify the security considerations we should address.
Let’s start at the beginning: what is Lambda?
AWS Lambda lets customers run code without provisioning or managing servers, hence the term ‘serverless’. You pay only for the compute time you consume – there is no charge when your code is not running! So customers love it, as it can provide cost savings of up to 80% compared to running EC2 instances.
What are some of the security advantages?
Some of the quick security wins of Lambda include a reduced attack surface: the Lambda worker node (a temporary server) runs only when the function (your code) is executing; after that, it’s gone. This is very different from EC2 servers and containers, which often run 24/7/365 and are therefore available to attackers at all times.
The other little bonus is that Operating System patching is handled automatically by AWS behind the scenes. No need for customers to worry about O/S level vulnerabilities and maintenance windows with Lambda – it’s all dealt with by Amazon.
What are the main security considerations?
If you are reading this and thinking I want to use Lambda right now – make sure you read and take note of our list of 10 Serverless security best practices:
- Follow secure coding practices and inspect your code for vulnerabilities
- Patch code dependencies (e.g OWASP Dependency-Check is a great open-source tool)
- Adopt the principle of least privilege
- Maintain isolated function perimeters
- Sanitise event input to avoid injection
- Employ API gateways as a security buffer
- Log and alert on all functions
- Secure all data in transit (TLS v1.2) and at rest (AES256)
- Manage secrets in secure storage (e.g AWS Secrets Manager)
- Deploy functions in minimal granularity
Finally, Skyscanner released an awesome open-source auditing tool designed to review Lambda functions against security best practices and highlight any misconfigurations and weaknesses. Click here to read more about LambdaGuard.
If you need help with Lambda or the secure design of your AWS workloads, please get in touch with a member of the Cyber Security Specialists team on 0161 706 0244 or email info@cybersecurityspecialists.co.uk
Related Pages
