Serverless Security: What's Left to Protect?

> However, managing granular permissions for hundreds or thousands of functions is very hard to do.

When building a FaaS app from scratch granular permissions are manageable. Functions are small, so it’s easy to reason about the capabilities they need and write tight policies.

I don’t see why this doesn’t scale to a larger FaaS app.

I think the real trick is to avoid the bundling of functions and policies the article suggests people do out of convenience.

I’m working on a practical guide to Lambda and IAM policies here:

https://github.com/nzoschke/gofaas/blob/master/docs/per-func...

"Since the OS is unreachable"

Woah slow down there what? That's a significant presumption.

This 'serverless' thing is a fad.

as a system administrator, I find the summary as laughable as the FAAS movement itself.

"FaaS takes on the responsibility for “patching” the underlying servers, freeing you from OS patching"

So a sysadm-er, devops admin will be rolling these out and back with CI on a regular basis to dev,test and prod.

"Denial of Service (DoS) attacks are naturally thwarted by the (presumed) infinite capacity Serverless offers."

Unless youre invoicing department is cutting cheques to cloudflare, you'd be surprised just how limited the service is. Capacity might be amorphously defined as infinite on paper, but network capacity is quite real.

"Since the OS is unreachable, attackers will shift their attention to the areas that remain exposed – and first amongst those would be the application itself."

the OS is reachable, what you mean to say is that its not your problem.

Admin'ing a system is hard work requiring a deep understanding of many different application, os and network systems, rigorous attention to detail, good communication skills and being subscribed to a variety of fractured news and alert systems to sort out what inbound patches and mitigations are relevant and what can/should be applied.

Which leads me to the point of FAAS (and other managed services like Heroku, etc). which is to let you put up a web service on the increasingly hostile and dangerous Internet without either:

- Learning all of the above (none of which is taught in a standard CS degree)

- Hiring a Sysadmin for six figures.

Any time FAAS comes up people correctly point out that a sysadmin still needs to do the work of handling the underlying OS updates, etc - which misses the point. It's the difference between flying in a 737 that's been inspected by a certified mechanic who is looking for a hundred things it would never occur for me to even consider and flown by a pilot with thousands of hours in the cockpit versus someone who flies their small aircraft a couple weekends a month and does their own inspections.

In general, I trust that the security and SRE teams at Google, AWS, Microsoft who are the main people deploying building out these FAAS systems have a better handle on these things than whoever is handling sysadmin tasks on random VPS.

I don't think it's a fad, we will see more like this, just another layer of abstraction.

Might have been better to write, assuming the OS is unreachable - which is the security contract I assume.