Thread by @thedashbird

"If you migrate to a #serverless architecture, you don't have to worry about anything anymore! ☀️"

That's obviously not true for many points, including security! 🔐

How 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗹𝗼𝗴𝗴𝗶𝗻𝗴 helps to secure your application ↓

𝗧𝗵𝗿𝗲𝗮𝗱 𝗢𝘃𝗲𝗿𝘃𝗶𝗲𝘄 🧵

• It's not all fun & games
• Why Logging is crucial
• Invocation/Event Inputs
• Response Payload
• Performance Levels
• Authentication Requests
• Service Usage Indicators
• The 4 W's
• What you should never log 🔥

{ 1 | 17 }

𝗜𝘁’𝘀 𝗻𝗼𝘁 𝗮𝗹𝗹 𝗳𝘂𝗻 𝗮𝗻𝗱 𝗴𝗮𝗺𝗲𝘀!

Serverless brings in a lot of benefits and helps developers to focus more on actually focusing on writing their apps instead of running and maintaining them

But it's not the holy grail that drops all responsibilities

{ 2 | 17 }

You still need to be aware of your web threats like cross-site scripting and #SQL injections.

And there's more:
• Broken Authentication
• Insecure Storage of App Secrets
• Insecure deployment settings
• Misuse of permissions
• Improper exception handling

{ 3 | 17 }

Additionally, serverless brings in unique threats to take care of like #DoSattacks for 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗲𝘅𝗵𝗮𝘂𝘀𝘁𝗶𝗼𝗻.

A thing that's often missed out on:
Logging is crucial for your application security as it can lead to huge issues later.

{ 4 | 17 }

No system is 100% secure, but #logging will help to understand the flaws that were used to compromise our system.
We can use this information to fix flaws, build blocklists, or identify compromised accounts.

{ 5 | 17 }

𝗜𝗻𝘃𝗼𝗰𝗮𝘁𝗶𝗼𝗻/𝗘𝘃𝗲𝗻𝘁 𝗜𝗻𝗽𝘂𝘁𝘀

A first start is to log the inputs that are received by each function - regardless of whether they are internal or external.
It can help to retrace steps that were taken by the attacker or how validations were avoided.

{ 6 | 17 }

𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲 𝗣𝗮𝘆𝗹𝗼𝗮𝗱

Similar to invocation inputs, logging outputs help to analyze and mitigate security breaches.
In the worst-case - not being able to stop attacks - we can at least identify what information was stolen.

{ 7 | 17 }

𝗣𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲 𝗟𝗲𝘃𝗲𝗹𝘀

If a function performs badly and now takes 2.5s instead of 250ms to complete a task, we can end up in financial misery as we're paying what we use in #serverless land.

Logging for this purpose depends heavily on the use case.

{ 8 | 17 }

Nevertheless, it's vital to have this in mind when planning the application critical logs.

At Dashbird, we're also collecting & aggregating detailed insights about all of your function's performances. Having this in a single place will save time & money.

{ 9 | 17 }

𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗥𝗲𝗾𝘂𝗲𝘀𝘁𝘀

If your app has a protected area, it's important to log for authentication requests, especially failed ones.

Look for odd requests or patterns.
Maybe there's a spike in failed requests for emails that aren't even known

{ 10 | 17 }

This could indicate that someone's scanning a list of leaked passwords to find potentially vulnerable accounts in your app

Authentication logging can alert that someone is scouting our app for weak spots.
By that, you can introduce countermeasures before an attack

{ 11 | 17 }

External sources like 𝗛𝗮𝘃𝗲 𝗜 𝗯𝗲𝗲𝗻 𝗣𝘄𝗻𝗲𝗱 can be very helpful here

Preemptively search for compromised accounts & lock them, asking for a password reset.
Your customers will love to receive a preventive serverless security alert

haveibeenpwned.com

{ 12 | 17 }

𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗨𝘀𝗮𝗴𝗲 𝗜𝗻𝗱𝗶𝗰𝗮𝘁𝗼𝗿𝘀

It's always a good idea to log service usage indicators
Even with carefully planned costs & pricing structures, there could be things that went unseen
Maybe mistakes were made at dimensioning costs & pricing of our app

{ 13 | 17 }

Maybe there are cost spikes as some authorization logics are bypassed and someone is free-riding on our backs.

Logs will help to
• narrow down contributing services
• who was contributing to the cost spikes
• where services abused in a way we didn't expect?

{ 14 | 17 }

𝗧𝗵𝗲 𝟰 𝗪'𝘀

Based on OWASP Logging Cheat Sheet Recommendations, we should be logging:

• When
• Where
• Who
• What

...in every function invocation!
This applies to all items that we discussed.

cheatsheetseries.owasp.org/cheatsheets/Lo…

{ 15 | 17 }

We at Dashbird.io help you with all of them by providing the observability that lacks your serverless environment while providing monitoring & alerting

Spend less time debugging with detailed, noise-free insights and always be on top of what's going on

{ 16 | 17 }

A last reminder to complete this thread:

User-related information like personal or sensitive data should 𝗻𝗲𝘃𝗲𝗿 be logged!
Make sure to filter these out as it might get you in big trouble, not only with regulatory authorities.

{ 17 | 17 }

Thank you for reading!

You can find the complete article and more serverless-related tutorials, news, and insights at @thedashbird blog ✍️

dashbird.io/blog/serverles…