Celidor
  • Blog
  • About
  • People
  • News
  • TALKS
  • Contact

10 steps to Lambda security

20/10/2018

3 Comments

 
AWS Lambda, launched in 2015, is a service which allows customers to create event driven serverless functions of short duration.

Since then Lambda has become amazingly popular, Lambda functions are widely used for many different purposes ranging from low latency web applications and IoT, to AWS account operational and maintenance tasks.
Picture
Just like any other application in the cloud, a vulnerable or poorly configured Lambda function can lead to data loss, privilege escalation and even AWS account takeover, see for example this blog post.
​
I’ve created “10 steps to Lambda security” based on my experience of working with customers using AWS Lambda:
  1. Use environment variables for configuration details and encrypt with KMS
  2. Retrieve sensitive data from DynamoDB, Secrets Manager, or similar service
  3. Enable encryption helpers to protect data in transit
  4. Configure API Gateway custom domain with SSL cert for web access
  5. List minimum specific actions in role policies – not “*”
  6. Limit outbound access to Internet to prevent unauthorised data exfiltration
  7. Do not use /tmp for sensitive information
  8. Application security testing and source code analysis
  9. Ensure no vulnerable or unmaintained dependencies
  10. Monitor Lambda logs and investigate unusual behaviour
© 2018 Paul Schwarzenberger www.celidor.co.uk May be used with acknowledgement
3 Comments

Building continuous cloud compliance

13/10/2018

0 Comments

 
Continuous cloud compliance is essential to maintain the security of applications and systems in the cloud. At DevSecCon London next week I'll be talking about my experiences in this area, and how an effective solution needs to include prevention, detection and remediation elements.
Picture
In my talk "A journey to continuous cloud compliance", I'll give a live demonstration of techniques and approaches with a system I've built in AWS using Capital One's open source Cloud Custodian project, combined with Lambda functions and other AWS services to provide customised notifications via email and Slack.

Click on the read more link to see other examples of alerts and automated remediation. 

Read More
0 Comments

a DevSecOps toolkit

6/10/2018

0 Comments

 
As I was developing the course DevSecOps Hands-On I realised the need for a DevSecOps Framework - covered in my earlier blog post - and a DevSecOps Toolkit.
Picture
DevSecOps toolkit © 2018 Paul Schwarzenberger www.celidor.co.uk, may be used with acknowledgement
The DevSecOps Toolkit illustrates the spectrum of tools which can be used for various purposes (columns) across the primary system components (rows). The named open source projects and vendors are examples - it's not possible to be completely comprehensive in a single diagram.

An organisation can use the toolkit to help assess their DevSecOps maturity - ideally there should be at least one tool in each area.

This is a very fast moving field – for example “SOAR” – Security Orchestration, Automation and Response – is a new category created in late 2017.
0 Comments

    Author

    Paul Schwarzenberger is a Cloud Security Architect and Engineer

    Archives

    April 2025
    March 2025
    October 2024
    September 2024
    August 2024
    July 2024
    May 2024
    March 2024
    October 2023
    September 2023
    February 2023
    January 2023
    December 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    January 2022
    November 2021
    September 2021
    July 2021
    March 2021
    July 2020
    June 2020
    February 2020
    December 2019
    November 2019
    October 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    November 2018
    October 2018
    September 2018
    August 2018

    Categories

    All
    Cloud Security
    DevSecOps

    RSS Feed


Contact us via email at [email protected] 

© 2020 Celidor Limited. All Rights Reserved.

Celidor Limited

Company Number: 08870661


  • Blog
  • About
  • People
  • News
  • TALKS
  • Contact