Doing Security in 100 milliseconds--The Speed of Serverless Computing
No ratings
Presented at lascon 2016 by
Serverless is awesome. It provides massive value in terms of simplicity and economics, enabling really great things. However security is not ready for serverless. Security struggled to find its footing in the era of virtual machines and public clouds, but now the new area of serverless is going to be the next challenge. Serverless is a design pattern for writing applications at scale without managing the servers or processes running the applications. This is done across the continuum of cloud--from storage as a service to database as a service but the center of serverless is using Functions as a Service (FaaS). FaaS offerings on the market right now are AWS Lambda, Azure Functions, and Google Cloud Functions. Now processes run for milliseconds before being destroyed and then get instantiated for subsequent requests. In serverless architectures, technology like antivirus and intrusion detection become meaningless. We will examine how traditional approaches need to be adapted to serverless. Principles that will be covered will range from “Harden the Pipeline not the OS” to “extend Application Security practices across apps, APIs, and third-party integrations.” This session will focus on practical security approaches and the four key areas of serverless security: software supply chain, delivery pipeline, data flow and attack detection. Even if you don’t have any experience with serverless, don’t worry, in this session we will start with the basics. You will learn what serverless is (it’s still being defined) and practical patterns for serverless adoption. This session will have plenty of principles, practices and definition for anyone wanting to get started with serverless and understand the security implications therein. However, this will not just be theory! This fast-paced session will provide a demo of building a complete serverless application (with the code provided as open source) and giving practical examples of how to secure it. The hope is that anyone from the C-level to developers can get something out of the talk. Welcome to serverless security, it’s a whole lot of fun!