A First Look at the Security of Serverless Applications
summary
Serverless platforms increase attack surface by mixing short-lived functions with shared, opaque infrastructure and practical tradeoffs that favor performance over isolation. The analysis shows resource-exhaustion ("denial-of-wallet") attacks and realistic cross-invocation attacks enabled by warm container reuse, plus emerging side channels based on access patterns and timing. Recommendations include treating each function as its own security perimeter, applying least privilege on IAM, encrypting data in transit and at rest, and auditing new runtimes like Firecracker for isolation gaps.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:17Background
- 1:45Serverless
- 2:53How Serverless Works
- 4:41Serverless Ecosystem
- 5:07Threat Model
- 6:00Positive Aspects
- 10:24Security and Privacy
- 11:11Serverless Platforms
- 12:00Main Attacks
- 12:33Top 10 Security Threats
- 13:30Mitigation
- 14:35Surface Specific Attacks
- 16:17Future Work
- 16:51Conclusion
related talks
33mServerless Security: New Risks Require New Approaches
24mServerless security: how to protect what you don't see?
57mServerless Security: Attack and Defense
30mServerless Security Top 10
40mServerless Architecture Security Patterns for Securing the Unseen
37mLegends and Myths of Security in Serverless
46mOWASP SERVERLESS TOP 10
01h 00mMicroservices and Serverless