See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/344000589

Serverless Computing Security: Protecting Application Logic

Conference Paper · June 2020

DOI: 10.1109/ISSC49989.2020.9180214

CITATIONS READS

14 400

2 authors, including:

Ruth G. Lennon
Atlantic Technoloical University (ATU) Donegal
36 PUBLICATIONS 162 CITATIONS

SEE PROFILE

All content following this page was uploaded by Ruth G. Lennon on 15 July 2022.

The user has requested enhancement of the downloaded file.

 Serverless Computing Security: Protecting
Application Logic
Wesley O’Meara Ruth G. Lennon
Dept. of Computing Dept. of Computing
Letterkenny Institute of Technology Letterkenny Institute of Technology
Letterkenny, Co. Donegal, Ireland Letterkenny, Co. Donegal, Ireland
[email protected] [email protected]

Abstract— Serverless computing enables organisations to architecture of serverless applications, development and
avail of the inherent and unlimited flexibility and scalability support teams can incur additional complexity as the design
that serverless provides, without having to consider the of serverless applications include creating application
underlying infrastructure. However, there are security workflows by combining multiple cloud services, functions,
considerations that are unique to serverless architectures, that triggers and events. Configuration and security
if not included early in application design, can lead to administration of these components is implemented at the
vulnerabilities which could be exposed to common attack individual component level and as the architecture is event
vectors. While cloud service providers manage the security driven, each component can be triggered from a range of
of the underlying infrastructure, it is up to the consumer to sources [6] such as e.g. user input, database updates or
ensure that serverless applications are fully protected. We go storage events. Another factor is that security scanning and
on to discuss common attack vectors, the risks associated testing tools, used within traditional software development,
with misconfiguration within security and application setup, have not been able to adapt [7] to the stateless architectural
how attackers target vulnerabilities within the workflow logic nature of serverless. Consumers need to ensure that they
of serverless applications and their functions to focus their implement a strong and thorough security strategy for the
attacks, and how consumers can implement measures to application design and security implementation or potentially
protect their applications within a serverless architecture. they could leave their serverless architecture vulnerable to
cyber-attack.
Keywords—serverless, function as a service, cybersecurity,
Cybercriminals target the applications that consumers host on
application security, cloud computing.
cloud services, with the intention of profiting from illegally
I. INTRODUCTION accessing sensitive data, denying services to the consumer or
utilizing the cloud resources for their own purposes. One
As serverless computing becomes increasingly prevalent aspect that affects their ability to gain unauthorized access to
across the industry, expenditure on Serverless technologies is
a consumers’ cloud resources, is whether they can visualize
projected to have an annual growth rate of 33% [1],
and map the internal business logic and application
increasing from $1.9 billion in 2016, to a projected $7.7
workflow, by gaining access to execution timings and
billion by 2021. IT departments are examining this new
patterns of functions and other cloud services, that drives a
service offering with a view to enabling their business consumers serverless hosted application. Gaining an
partners gain value from adopting serverless and transitioning understanding of an applications workflow can enable an
their infrastructure and services to the cloud.
attacker to focus on weaknesses, such as vulnerabilities
within the flow of functions [7], within the application
As a cloud computing service model, serverless offers
architecture and utilize multiple attack vectors to try
consumers the ability to build and host event-driven
circumvent security measures or input validation processes,
applications on pooled resources [2]. The workflow of these and allow them to attack critical services directly.
applications consists of a series of (functions), that execute
upon predefined events (triggers) [3]. All of which is
To fully realise the benefits of serverless while protecting the
supported by a serverless service model that will dynamically
integrity of their applications and sensitive data, consumers
allocate resources in response to demand. The benefits for
need to consider these types of attacks when designing and
consumers, from building out their applications with the
implementing their security strategies and application
serverless model, is that there is infinite elasticity with the architectures, and gain an understanding of what aspects of
underlying infrastructure, minimal costs [4] within the pay- the architecture are vulnerable to malicious attack.
as-you-go model for the service usage, easy to use interface
and configuration [5], and no requirement for consumers to II. BACKGROUND
understand or visualize the underlying infrastructure.
Serverless, known as function-as-a-service (FaaS) [8] and
backend-as-a-service (BaaS), is a new service model being
However, as consumers adopt serverless, issues can arise
offered for public consumption, by cloud service providers
from the speed and complexity of this transition, coupled with
(CSP). Amongst the CSPs, Amazon was the first to launch a
the need to adhere to statutory and security requirements.
public serverless service, called Lambda, back in 2014 [9],
This can be challenging for organisations that may want
other CSPs quickly followed with Google, Microsoft and
quickly seize business opportunities but may be short of
IBM all devising and offering their serverless services to the
technical expertise and resources. Due to microservices

XXX-X-XXXX-XXXX-X/XX/$XX.00 ©2020 IEEE

public. Serverless enables cloud consumers to build and host managing the cloud infrastructure, consumers no longer need
applications, whose workflows that are triggered by events their own data centres and can avoid the financial investment
[10], where billing for service usage is granular, and the in static infrastructure.
application owners and development do not have to concern
themselves with the supporting infrastructure. III. SECURITY CONSIDERATIONS
The microservices, event-driven nature of a Serverless
Usage of the term, serverless, isn’t accurate as it still relies on architecture can increase the attack surface of an application
servers within the cloud infrastructure, but the term does and can make it vulnerable to malicious attacks.
enable consumers to better visualise their role within its
usage, as they are not required to have visibility of, or In 2017, OWASP released a report [6] that detailed the most
configure, any of the underlying infrastructure [11], i.e. common attack and risks associated with serverless, these
Servers. were:
1. Code Injection – can potentially allow attackers to alter
Serverless services enable consumers to create and host the execution pattern of code by injecting malicious code
applications that are designed within microservices into the application.
architectures, on CSP provided cloud infrastructure. The 2. Broken Authentication - Enables access to services by
computing logic within these applications is provided by the capture or bypass of authentication methods.
event driven action-based units of code called functions [12]., 3. Sensitive Data Exposure – Data breaches where
each with a single purpose. These functions can then be unauthorised access to obtained to sensitive data.
connected together with additional cloud services to create 4. XML External Entities (XXE) - Similar to a code
business workflows. The use cases for serverless include injection attack that exploits any application that parses
supporting event based applications, such as multimedia XML input.
processing or the Internet of Things (IoT). For multimedia 5. Broken Access Control – can potentially allow users to
processing, e.g. a service can be provided to the public that perform tasks that may not be within their role or
enables them to upload a file to an S3 bucket. Once that file responsibilities.
is uploaded, it will trigger a downstream function that will 6. Security Misconfigurations – if the design and
execute transformational processes upon that file and return implementation of security protocols is not thorough,
it to the user. Another use case would be to support the attackers may be able to exploit these to gain
Internet of Things (IoT), where it can enable the ability to unauthorised access to services.
respond to sensor input messages and automatically scale in 7. Cross-Site Scripting (XSS) – cybercriminals could
response to the volume of input received. potentially modify the code that the frontend of an
application delivers to the users’ browser.
Application workflows within serverless follow an event 8. Insecure Deserialization - where untrusted or unknown
driven model, as the functions are invoked by an event, called data is injected into an application to try affect the
a trigger [13]. These triggers can be initiated by actions such application logic and e.g. attempt to bypass
as e.g. user input, or changes within a database, and as these authentication or affect the stability of the application.
functions are completely stateless, they can be scaled 9. Using Components with Known Vulnerabilities –
independently [14]. Serverless is best suited to applications Updates to tools are often released, that include patches
that are stateless, event-driven and short running [15]. To to fix vulnerabilities that may have been discovered after
ensure that consumers design their functions to be small the tool was released. Cyber criminals are also aware of
independent units of code, CSPs enforce restrictions on the these published vulnerabilities and may utilise these to
size and runtime of the functions execution. Typically, this is focus their attacks.
up to 256MB for the code and a runtime max 5 minutes [16] 10. Insufficient Logging and Monitoring – enables cyber-
for the function. attacks to go unnoticed as consumers are unable to
identify that their applications have been compromised
One of the key advantages that serverless provides to or their services are used for illicit purposes.
consumers is that they no longer need to consider the
underlying infrastructure as part of the application design. Another such attack vector is for cybercriminals to target
Allowing development team to rapidly develop code for vulnerabilities produced by the application of inadequate
applications without needing to consider the underlying security protections, and authentication protocols to
infrastructure [17]. This is due to the CSP taking functions, thereby weakening the integrity of the application
responsibility for the cloud infrastructure, managing security, flow between these functions [19]. These “Business
performance, patching etc., while also ensuring that the logic/Flow Manipulation” [6] or “Function-Flow
infrastructure elastically scales appropriately [18] during Vulnerabilities” [7] can enable attackers to identify where,
periods of increased demand. within an application workflow, they can attempt to bypass
the application logic and manipulate its workflow. Potentially
Another benefit of adopting serverless is that potential to enabling attackers to pass unverified data or commands
reduce costs for the consumer, CSPs offer a pay-as-you-go directly into downstream functions for processing, allowing
model for usage of their services and only charge at a granular them to bypass access controls, change user access privileges
level for the services that consumers actually use e.g. costs or disrupt the applications stability.
are incurred solely for the timeframe that a service, e.g. a
function, is in use, [16]. As the CSPS are hosting and
 Figure 2 Bypassing verifications steps via workflow
manipulation

IV. METHODOLOGY
As outlined by OWASP [6], an attacker can exploit security
misconfiguration such as Broken Authentication or Broken
Access Control, to enable the attacker to remotely execute
code or access standard AWS commands, or sdks, to gather
pertinent information on the application workflow from
Amazons application and infrastructure monitoring service,
CloudWatch.

Figure 1 Attack points for workflow manipulation A simple list-metrics command, executed against
CloudWatch, will output the information sampled in Figure
Figure 1, illustrates the possible attack points within a sample 3, 4 and 5.
serverless application, illustrating a Publication component
of a Pub/Sub (Publication/Subscription) use case, workflow The output displayed in Figure 3 identifies an API Gateway
where vulnerabilities could be manipulated to divert the resource called Subscription which is configured as a
workflow: Production stage.

1. API Gateway is used to validate the authentication of

requests. Vulnerabilities in the authentication protocols
could enable the frontend to be bypassed via direct
utilisation of APIs to send input to the API Gateway.
2. Lambda is used to verify if requests and their content are
valid. Vulnerabilities can exist as functions can consume
malicious input from unexpected sources across multiple
function triggers.
3. Lambda is also used process the request, this can
introduce vulnerabilities if authentication protocols are
weak and direct utilisation of APIs is used to send input
directly to this function, bypassing all verification steps
4. DynamoDB is used for record creation in this scenario.
Gaps in database security could enable data breaches as Figure 3 Identifies an API Gateway resource called
unauthorised commands could expose sensitive data. Subscription
5. Simple Email System (SES) is used to distribute
information via email. If poorly protected, this can be a Figure 4 identifies a DynamoDB instance with a table called
means for attackers to send sensitive data outside of the Subscriptions, and SCAN operation against that Table by a
application architecture Lambda function called Initiate_Publishing.

Figure 2, illustrates how a function workflow could be

manipulated to directly access the DyanmoDB instance,
bypassing all authentication and validation checks, and
potentially exposing sensitive data

Figure 4 Identifies a functions capability within DynamoDB

Figure 5 details that the Lambda function is triggering a the security of their applications hosted on AWS essentially
SEND event within SES. security “in” the cloud [20]. From a consumers’ perspective,
this means that they are responsible for ensuring that
serverless applications design follow best practices. Amazon
will ensure that the underlying infrastructure is secure and
that AWS provides the functionality to enact security policies
at a granular level. If the consumer follows best practice, they
should be able to prevent the common serverless attack
vectors that OWASP list in their Serverless Top 10.

As the majority of attack vectors focus their efforts on

exploiting weaknesses within a consumers’ configuration
[21] of serverless services, this is where the most value can
be gained from ensuring that application architectures are
protected from these type of vulnerabilities. Implementing
automation and designing architecture with security in mind
can enable cloud consumers to develop applications where
security is inherent in its design.
Figure 5 Lambda Function triggering a SES SEND event.

V. RESULTS There are a number of areas across resourcing, architecture,

automation and monitoring where consumers can strengthen
Utilising the information gained in Figures 3, 4 and 5, an their security mindset, these are:
attacker can chain together the connected services and begin
to infer flow within the application logic. Further probing  Education the decision makers and support roles -
would be necessary to fully determine the input requirements ensure that all decision makers and operations support
of the functions but it is enough information to infer that a roles have the adequate skills and training required to
API called Subscription is triggering a Lambda function implement best practice across all areas of the serverless
called Initiate_Publishing, which is executing a SCAN architecture, especially within network, database and
operation against a DynamoDB table called Subscriptions. It application security.
also details that the function has the capability to call AWSs  Introduce a culture of collaboration - As the line
Simple Email System (SES). Figure 6 illustrates the points between the traditional roles within the IT organisations
within the workflow which an attacker was able to identify is diminished, implementing a DevOps culture has
via the CloudWatch logs. become even more important. A culture of collaboration,
with a focus on DevSecOps principles for security across
all stakeholders responsible for the application
architecture, will foster knowledge sharing across all
teams and enable the business to holistically introduce a
security mind-set with the aim of reducing security
vulnerabilities.
 Design architecture with security in mind – ensure that
security is at the forefront of all architecture design
considerations. For example, designing the application
architecture to follow a three-tier (or multi-tier)
architecture consisting of a presentation, application and
data layer. Clearly defining these layers enables a clearer
Figure 6 The points now identified by attackers within the focus on the interfaces between these layers and allows
application workflow for security realms to be tailored for each layer.
Understanding the interfaces and interactions between
As a possible attack vectors, it is conceivable that an attacker the layers would enable the expected behaviour of an
could utilise this information and focus their attack on the application be clearer and aide the highlighting of
SCAN functionality, within the function, to try read data from unexpected or malicious activities. This would have
the database and export that data via the SES connection to multiple benefits such as enabling the system to be more
that function. Resulting in a data breach for the legitimate robust, scale independently and be more resilient to
consumer which could lead to financial losses or reputational attack.
damage.  Introduce Threat Modelling – use threat modelling as a
VI. SECURING SERVERLESS APPLICATIONS means of systematically analysing the controls and
methods of defence needed to neutralise attack vectors
Amazons’ AWS documentation separates cloud security used by cybercriminals.
ownership into two realms: (1) the Cloud Service Providers  Introduce limitation of authorisation – segregate the
responsibility for all security of the underlying cloud security realms between the layers of the architecture and
infrastructure, which Amazon term as security “of” the
cloud; (2) and the consumers’ responsibility for ensuring that
View publication stats

ensure that user and service accounts are only authorised [3] Glikson, A., Nastić, S., Dustdar, S., 2017. Deviceless edge computing:
extending serverless computing to the edge of the network.Publication:
to access the services that are required for their roles. SYSTOR '17: Proceedings of the 10th ACM International Systems and
 Implement secure coding standards – secure coding can Storage Conference. ACM. p1
aide the prevention of security vulnerabilities within the [4] Kritikos, K., Skrzypek, P., 2018. A Review of Serverless Frameworks.
application code itself. Such practices can cover areas 2018 IEEE/ACM International Conference on Utility and Cloud
such as input validation, output encoding, session Computing Companion (UCC Companion). IEEE. p161.
management, error handling and logging. [5] Kim, J., Park, J., Lee, K., 2019. Network Resource Isolation in
Serverless Cloud Function Service. 2019 IEEE 4th International
 Automate and secure deployment systems – remove Workshops on Foundations and Applications of Self* Systems
manual intervention by automating deployments where (FAS*W). IEEE. p183.
possible, implementing infrastructure as code and [6] Melamed, T., 2017. OWASP Top 10 (2017) Interpretation for
release artefact management for all infrastructure setup Serverless. https://www.owasp.org/images/5/5c/OWASP-Top-10-
Serverless-Interpretation-en.pdf.
and configuration. The introduction of DevOps and its
[7] Patnayakuni, R., Patnayakuni, N., 2018. Securing Serverless
utilisation of CI/CD practices, i.e. Continuous Computing. (SIGSEC). Association for Information Systems AIS
Integration/Continuous Delivery and Continuous Electronic WISP 2018 Proceedings Pre-ICIS Workshop on
Deployment, combined with a DevSecOps focus on Information Security and Privacy Library
Security, can ensure that deployment processes are built (AISeL).https://aisel.aisnet.org/wisp2018/15/.
with security in mind. Enforce governance of [8] Kanso, A., Youssef, A., 2017. Serverless: beyond the cloud. WoSC '17:
Proceedings of the 2nd International Workshop on Serverless
deployment infrastructure via segregation of duties, Computing. ACM. p6.
audits and security checks. [9] Asghar, T., Rasool, S., Iqbal, M., ul Qayyum, Z., Noor Mian, A.,
 Continuous Monitoring - Ensure that consumers have Ubakanma, G. Feasibility of Serverless Cloud Services for Disaster
visibility of all cloud services and usage. Implement Management Information Systems. 2018 IEEE 20th International
Conference on High Performance Computing and Communications.
monitoring and metrics packages, create processes for IEEE
the handling of incidents, continually scan for [10] van Eyk, E., Toader, L., Talluri, S., Versluis, L., Uță, A., Iosup, A.
vulnerabilities within the architecture, categorise risk. (2018). Serverless is More: From PaaS to Present Cloud Computing.
Published in: IEEE Internet Computing (Volume: 22, Issue: 5,
VII. CONCLUSIONS Sep./Oct. 2018). IEEE. p9.
[11] Lee, H., Satyam, K., Fox, G., 2018. Evaluation of Production
This research has tried to analyse common attack patterns Serverless Computing Environments. In 2018 IEEE 11th International
within serverless and make recommendations on Conference on Cloud Computing (CLOUD). IEEE. p442.
counteracting these types of attacks. As the majority of attack [12] Saha, A., Jindal, S., (2018). EMARS: Efficient Management and
patterns are reliant on misconfiguration of serverless services Allocation of Resources in Serverless. Published in: 2018 IEEE 11th
International Conference on Cloud Computing (CLOUD). IEEE. p827
[21], it is imperative that consumers incorporate security
[13] Parres-Peredo, A., Piza-Davila, I., Cervantes, F., 2019. Building and
considerations early in their application lifecycle and put Evaluating User Network Profiles for Cybersecurity Using Serverless
practices in place to continually implement and enforce these Architecture. 2019 42nd International Conference on
practices throughout the lifespan of their applications. Telecommunications and Signal Processing (TSP). IEEE. p165.
[14] Mohanty, S., Premsankar, G., di Francesco, M., 2018. An Evaluation
We have included a discussion on serverless security of Open Source Serverless Computing Frameworks. 2018 IEEE
International Conference on Cloud Computing Technology and
vulnerabilities associated with the exploitation of function Science (CloudCom). IEEE. p115.
flow vulnerabilities, especially as the services and [15] Feng, L., Kudva, P., Da Silva, D., Hu, J., 2018. Exploring Serverless
capabilities provided by cloud service providers mature, so Computing for Neural Network Training. 2018 IEEE 11th International
do the attack vectors utilized by cybercriminals. This ensures Conference on Cloud Computing (CLOUD). IEEE. p334.
that security issues with serverless architectures remain [16] Lloyd, W., Ramesh, S., Chinthalapati, S., Ly, L., Pallickara, S., 2018.
Serverless Computing: An Investigation of Factors Influencing
relevant and should be an ongoing consideration for all Microservice Performance. 2018 IEEE International Conference on
serverless consumers. Cloud Engineering (IC2E). IEEE. p159.
[17] Sewak, M., Singh, S., 2018. Winning in the Era of Serverless
As long as these continue, further research is needed to Computing and Function as a Service. 2018 3rd International
counteract these attack vectors and ensure that consumers are Conference for Convergence in Technology (I2CT). IEEE. p1
protected. [18] Adzic, G., Chatley, R., 2017. Serverless computing: economic and
architectural impact. ESEC/FSE 2017: Proceedings of the 2017 11th
Joint Meeting on Foundations of Software Engineering. ACM.
ACKNOWLEDGMENT
[19] Thomas, I., 2018. Top 10 Security Risks In Serverless.
The authors would like to thank Letterkenny Institute of https://www.we45.com/blog/top-10-security-risks-in-serverless.
Technology for their funding of this research work. [20] Amazon, 2020. Security in AWS Security Hub.
https://docs.aws.amazon.com/securityhub/latest/userguide/security.ht
REFERENCES ml
[1] Taylor, H., 2019. 2020 CYBERSECURITY PREDICTIONS FOR [21] Radichel, T., 2020. Serverless Attack Vectors. RSA Conference 2020.
SOFTWARE DEVELOPMENT AND ENTERPRISE
ARCHITECTURE. ttps://journalofcyberpolicy.com/2019/12/21/2020-
cybersecurity-predictions-software-development-enterprise-
architecture/
[2] Lynn, T., Rosati, P., Lejeune, A., Emeakaroha, V., 2017. A Preliminary
Review of Enterprise Serverless Cloud Computing (Function-as-a-
Service) Platforms 2017 IEEE International Conference on Cloud
Computing Technology and Science (CloudCom). IEEE. p162.