Top Considerations in Serverless Computing Security

Serverless Computing Security Considerations

The following are the key security considerations in serverless computing:

1. Broken Authentication

Authentication breaches are a genuine threat to serverless computing. Because when you create an application over serverless architecture, there are numerous serverless functions available for it. For each specific purpose, there is a different function. All these functions are interconnected and form the logic of the overall system. However, with that many functions, there is always a chance that a few of these functions may expose public web APIs. Some other functions might consume events from various source types. Furthermore, there are chances that the functions may have some issues with coding. All this can eventually lead to incidents of attacks and exploits such as unauthorized authentication.

2. Function Event-Data Injection

Injection flaws can prove to be among the most critical vulnerabilities in a serverless architecture. These kinds of vulnerabilities are a result of executing or evaluating an untrusted input by passing it directly to the interpreter. You often get a multitude of even sources with most serverless architectures that might help you trigger the execution of a serverless function. This abundance increases the potential attack surface for event-data injections. Some common injection flaws in serverless architecture are:

• SQL injection
• NoSQL injection
• Function runtime code injection
• Pub/Sub Message Data Tampering
• Operating System (OS) command injection
• Object deserialization attacks
• Server-Side Request Forgery (SSRF)
• XML External Entity (XXE)

3. Over-privileged Function Roles and Permissions

It is strictly recommended that serverless applications follow the least-privileged principle. If the application users get more access to the routine activities than they essentially require, it might lead to a compromised user account and eventually damage the application. Hence, a serverless function should contain only the privileges that the user requires.

4. Improper Exception Handling and Verbose Error Messages

The scope of line-by-line debugging is quite limited in the case of serverless architecture. So, to make debugging easier, some developers use verbose error messages. Sometimes, they forget to clean the code before moving it to production. If the verbose messages are visible, they might expose critical information about serverless functions, and the logic used.