Serverless Computing

Risks and Mitigation Strategies

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

Serverless computing has revolutionized the way organizations deploy and manage applications, offering unparalleled scalability, cost efficiency, and reduced operational overhead. By abstracting the underlying infrastructure, developers can focus solely on writing code, while cloud providers handle the execution environment. However, this shift introduces a unique set of security challenges that require a nuanced understanding and proactive approach.

1. Expanded Attack Surface Due to Diverse Event Sources

In serverless architectures, functions are triggered by a myriad of event sources such as HTTP requests, database changes, cloud storage events, and message queues. Each of these triggers represents a potential entry point for attackers, expanding the application’s attack surface.

Example: Consider a function that processes images uploaded to a cloud storage bucket. If an attacker uploads a maliciously crafted file, it could exploit vulnerabilities in the function’s code or its dependencies, leading to unauthorized access or data exfiltration.

Mitigation Strategies:

• Input Validation and Sanitization: Implement rigorous checks on all incoming data to ensure it adheres to expected formats and reject any anomalous inputs.
• Use of API Gateways: Deploy API gateways to act as intermediaries between clients and serverless functions, providing an additional layer of security by enforcing authentication, authorization, and input validation policies.

2. Security Misconfigurations and Inadequate Access Controls

Misconfigurations in serverless environments can lead to unintended data exposure and unauthorized access. Functions often require permissions to interact with other cloud services, and assigning overly permissive roles can be detrimental.

Example: An AWS Lambda function with excessive permissions could be exploited to access sensitive data across various services, violating the principle of least privilege.

Mitigation Strategies:

• Principle of Least Privilege: Assign only the necessary permissions to each function, ensuring they have access solely to the resources required for their operation.
• Regular Audits: Conduct frequent reviews of function configurations and permissions to detect and rectify misconfigurations promptly.
• Environment Variable Management: Avoid storing sensitive information such as API keys or database credentials in environment variables. Instead, utilize secure secret management services provided by cloud platforms.

3. Inadequate Authentication and Authorization Mechanisms

Serverless applications often consist of numerous functions, each potentially requiring its own authentication and authorization mechanisms. Inconsistent or weak implementations can lead to unauthorized access and data breaches.

Example: A function exposed via an API endpoint without proper authentication could be invoked by unauthorized users, leading to data leakage or unauthorized operations.

Mitigation Strategies:

• Centralized Authentication: Implement centralized authentication mechanisms, such as OAuth or OpenID Connect, to ensure consistent and robust authentication across all functions.
• Role-Based Access Control (RBAC): Define clear roles and permissions for users and services interacting with serverless functions, ensuring that only authorized entities can invoke specific functions.

4. Dependency on Third-Party Libraries and Supply Chain Vulnerabilities

Serverless functions often rely on external libraries and packages, introducing risks associated with supply chain attacks. Vulnerable or malicious dependencies can compromise the security of the entire application.

Example: A widely-used npm package was compromised, injecting malicious code into applications that depended on it, leading to widespread security incidents.

Mitigation Strategies:

• Regular Dependency Audits: Continuously monitor and update dependencies, removing unused packages and patching known vulnerabilities.
• Use of Trusted Sources: Download libraries and packages only from reputable sources, and verify their integrity using checksums or digital signatures.
• Static Analysis Tools: Employ static analysis tools to detect vulnerabilities within dependencies and assess their impact on your application.

5. Denial-of-Service (DoS) and Denial-of-Wallet (DoW) Attacks

While serverless architectures can automatically scale to handle increased load, they are susceptible to DoS attacks that can lead to resource exhaustion and increased costs, known as Denial-of-Wallet attacks.

Example: An attacker floods a serverless function with requests, causing it to scale up and incur significant costs for the organization without achieving service disruption.

Mitigation Strategies:

• Rate Limiting: Implement rate limiting to control the number of requests a function can handle within a specific timeframe, preventing abuse.
• Budget Alerts: Set up budget alerts and spending limits to detect and respond to unexpected increases in resource consumption promptly.
• Monitoring and Logging: Utilize monitoring tools to detect unusual patterns in function invocations and resource usage, enabling swift identification and mitigation of potential attacks.

6. Limited Visibility and Monitoring Challenges

The ephemeral nature of serverless functions poses challenges for monitoring and gaining visibility into their execution, complicating the detection of malicious activities and performance issues.

Example: Traditional monitoring tools may not capture short-lived function executions, leading to blind spots in application performance and security monitoring.

Mitigation Strategies:

• Adopt Serverless-Compatible Monitoring Tools: Implement monitoring solutions designed for serverless environments, capable of capturing and analyzing function executions effectively.
• Centralized Logging: Aggregate logs from all functions into a centralized system, facilitating comprehensive analysis and correlation of events.
• Distributed Tracing: Use distributed tracing to track requests across functions and services, providing insights into the application’s behavior and performance bottlenecks.

Conclusion

Embracing serverless computing offers significant advantages, but it necessitates a reevaluation of traditional security practices. By understanding the unique risks associated with serverless architectures and implementing tailored mitigation strategies, organizations can harness the benefits of serverless computing while maintaining a robust security posture. Continuous education, vigilant monitoring, and proactive risk management are paramount in navigating the evolving landscape of serverless security.

Publication Note & Disclaimer
This article was originally published on LinkedIn on March 25, 2025 and may have been edited or updated for publication on this site.

It reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.