Circle
Events
Blog

Download Publication

How to Design a Secure Serverless Architecture
How to Design a Secure Serverless Architecture
Who it's for:
  • application developers  
  • security professionals  
  • CISOs  
  • system and security administrators  
  • information system security officers  

How to Design a Secure Serverless Architecture

Release Date: 09/14/2021

Working Group: Serverless

Like any solution, serverless computing brings with it a variety of cyber risks. This paper provides best practices and recommendations for securing serverless applications. It offers an extensive overview of the different threats, focusing on the application owner risks that serverless platforms are exposed to and suggesting the appropriate security controls.

The document assumes that the readers have some knowledge of coding practices, security and networking expertise, and application containers, microservices, functions, and agile application development.

Key Takeaways: 

  1. What is Serverless
  2. Advantages and benefits of serverless architecture
  3. Shared responsibility model for serverless
  4. Security design, controls and best practices
  5. Kubernetes security best practices 
  6. CI-CD pipelines, Function Code, Code scans and policy enforcement for Functions and Containers    
  7. Compliance and governance for serverless

Help CSA better understand how we can support the cloud community. Answer a couple of questions to download this resource.

In my current job I work in:

CSA is a community driven organization. We would like to send you updates about our ongoing initiatives and opportunities to participate.

By opting into this agreement I am indicating that I want to receive email updates from CSA on related projects. (Marketing purposes, Section 3 of the Privacy Policy).

You’ve made safer cloud computing possible.

Download
Provide feedback on this form

CSA is a community driven organization. We would like to send you updates about our ongoing initiatives and opportunities to participate.

By opting into this agreement I am indicating that I want to receive email updates from CSA on related projects. (Marketing purposes, Section 3 of the Privacy Policy).

Download
Provide feedback on this form

Acknowledgements

Aradhna Chetal Headshot
Aradhna Chetal
Aradhna Chetal

Aradhna Chetal is a Senior Director Executive - Cloud Security at TIAA. She has worked for a number of enterprises like JP Morgan Chase, HSBC, Merck, Boeing Company, T-Mobile and Microsoft where she was responsible for defining cloud security strategies, cloud security architecture, digital transformation and migration of applications to the cloud.

Aradhna is a Cloud Security Alliance Research Fellow and has been a key contributor...

Read more

Vishwas Manral Headshot
Vishwas Manral
Vishwas Manral

Head of Cloud Native Security and Chief Architect, Cloud at McAfee Enterprise

Vishwas is the co-chair of CSA’s Serverless working group and a contributor to the Application Containers and Microservices working group. He has ser...

Read more

Madhav Chablani Headshot Missing
Madhav Chablani
Madhav Chablani

This person does not have a biography listed with CSA.

Peter Campbell Headshot
Peter Campbell
Peter Campbell

Director - Global Security Engineering - Cigna

Cloud Security Engineering leader responsible for security engineering and security innovation. Enables new and untried technologies, runs proof of concepts, designs and engineers security configurations and enables the business to leverage new technology safely. Led the creation of Cigna’s security assurance framework which ensures that the security vision is consistently executed. Current research focuses on the domains of sec...

Read more

Vani Murthy Headshot
Vani Murthy
Vani Murthy

Senior advisor Security & Compliance at Akamai Technologies

Vani is an active contributor to several Cloud Security Alliance working groups, including Application Containers and Microservices, Serverless, Top threats, Cloud Control Matrix (CCMv4), SDP Expert Group (Advisory Group to the Office of the CTO), Cloud Key Management etc. Vani has co-authored publications such as "How to Design a Secure Serverless Architecture", "CCM v4.0 Implementation Guidelines", "Cloud Top Threats". She has...

Read more

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?