Security Considerations For Serverless Computing

What is Serverless Computing?

Serverless computing is a cloud computing model where the cloud provider dynamically provisions the machine resources required to run code on demand, rather than the customer provisioning servers or virtual machines.

The key characteristics of serverless computing are:

• Fully managed infrastructure – The cloud provider completely abstracts away all infrastructure management so that developers don’t have to think about it at all.

• Event-driven – Code is executed in response to specific events such as http requests, database changes, queue messages, file uploads etc.

• Ephemeral – Containers hosting the code are ephemeral and can be terminated at any time. State needs to be managed external to the code.

• Scales automatically – The service scales automatically based on demand.

• Pay per execution – You only pay for the duration your code executes for rather than paying for idle servers waiting for requests.

Some common examples of serverless computing services are AWS Lambda, Google Cloud Functions and Azure Functions.

Benefits of Serverless Computing

Some of the key benefits of serverless computing are:

• No server management – No need to provision or manage any servers. The cloud provider handles this entirely.

• Cost savings – Pay per execution pricing model means you only pay for what you use rather than overprovisioning servers.

• Auto-scaling – The service scales seamlessly and automatically to handle any traffic spikes. No capacity planning required.

• High availability – Serverless platforms are distributed with built-in redundancy making the applications highly available.

• Faster time to market – Removes undifferentiated heavy lifting of infrastructure management so teams can focus on product.

• Event-driven – Allows reacting and scaling based on a variety of event sources beyond just inbound http.

• Flexibility – Serverless functions can be written in a wide variety of languages beyond just JavaScript.

Security Challenges with Serverless

While serverless computing can provide many benefits, it also introduces some new security challenges:

Dynamic Execution Environments

• Containers hosting the functions are ephemeral and dynamically provisioned per execution. This makes it hard to validate and enforce consistent security configurations.

Distributed Systems

• Serverless applications consist of functions that can execute anywhere in a distributed manner. Traditional network security models don’t apply well.

Authentication and Authorization

• With dynamic scaling, increased attention is needed on identity management, authentication and authorization.

Logging and Monitoring

• Logging and monitoring is more challenging in dynamic serverless environments and requires additional instrumentation.

Third Party Dependencies

• Heavy use of third party libraries brings risks of vulnerable components. Careful review of dependencies is important.

Data Protection

• With no direct control of infrastructure, additional care needs to be taken to protect data in transit and at rest.

Security Tips for Serverless Applications

Here are some tips to handle the security challenges with serverless:

Infrastructure as Code

• Use Infrastructure as Code principles to define and deploy serverless infrastructure. This improves consistency and auditing.

Least Privilege Access

• Functions should be given only the minimum permissions they need. Limit access to other functions, databases, storage etc.

Input Validation

• Validate and sanitize all input to avoid injection attacks. Handle errors gracefully.

Encrypt Data

• Encrypt data at rest and in transit to protect from exposure. Make use of cloud provider encryption features.

Logging and Monitoring

• Implement robust logging for diagnostics and security monitoring. Send logs to a central system.

Dependency Scanning

• Scan dependencies and binaries for vulnerabilities. Keep third party libraries up to date.

Infrastructure Pen Testing

• Conduct regular pen testing on the serverless infrastructure to find configuration issues.

Static Code Analysis

• Use static code analysis tools as part of CI/CD process to catch code issues early.

Conclusion

Serverless computing introduces many benefits but also new security considerations around dynamic environments, authentication, logging, dependencies, and more. By following security best practices like encryption, dependency scanning, least privilege access, and pen testing, organizations can build secure and resilient serverless applications. The key is having well-architected infrastructure and automation around securing serverless.