Top Threat #9 to Cloud Computing: Misconfiguration and Exploitation of Serverless and Container Workloads

Written by the CSA Top Threats Working Group.

The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of workloads, supply chains, and new technologies shifted the cloud security landscape.

This blog summarizes the ninth threat (of eleven) from the report: misconfiguration and exploitation of serverless and container workloads. Learn more about threat #7 here and #8 here.

Serverless and Security Teams

Managing and scaling infrastructure and security controls to run applications is still a significant burden on development teams. Legacy infrastructure teams used to managing on-prem environments must learn new skills like Infrastructure as Code and cloud security. The same teams must take on more responsibility for the network and security controls supporting their applications. Serverless and cloud-native containerized workloads can seem like a silver bullet for this problem, offloading that responsibility to the cloud service provider (CSP). Still, it requires a higher level of cloud and application security maturity than migrating virtual machines to the cloud.

Implications of a Serverless Security Model

In a serverless model, the CSP takes responsibility for the security and management of the underlying infrastructure. The constantly refreshing system significantly limits persistence in the event of an exploit. However, if a CSP allows customers to configure serverless containers with longer lifetimes, the environment becomes less secure. Additional risks include a temporary file system and the leak of sensitive information due to shared memory. Access to the temporary storage may be used to host or execute malware and should be wiped by application code.

The lack of control over the infrastructure also limits mitigation options for application security issues and the visibility of traditional security tooling. This makes it critical to build strong organizational practices around cloud hygiene, application security, observability, access control, and secrets management to reduce the blast radius of an attack.

Business Impact

When serverless and containerized workloads are implemented correctly, they result in increased agility, reduced cost, simplified operations, and increased security. When implemented without the necessary expertise, they can cause major breaches, data loss, and financial exhaustion.

What Are the Key Takeaways?

Here are some key takeaways to consider:

1. Implement automated checking through Cloud Security Posture Management (CSPM), Cloud Infrastructure Entitlement Management (CIEM), and Cloud Workload Protection Platforms (CWPP).
2. Investments should be made into cloud security training, governance processes, and reusable secure cloud architecture patterns.
3. Development teams should put extra rigor around strong application security and engineering best practices before migrating to serverless.

Example

As of 2021, there’s a growing body of research around Denial of Wallet (DoW) attacks. A DoW attack is functionally similar to a Denial of Service (DoS) attack. The attacker sends a large volume of requests to a serverless application to impact the underlying infrastructure. But in a DoW attack, the objective is to cost a cloud customer money by taking advantage of the auto-scaling consumption model of serverless platforms. These attacks can be mitigated with currency limits, but that changes the attack vector from DoW to DoS.

Learn more about this threat and the other 10 top threats in our Top Threats to Cloud Computing Pandemic Eleven publication.