SLIDE 1
I was 5. What does a childhood fear in 1983 have to do with - - PowerPoint PPT Presentation
I was 5. What does a childhood fear in 1983 have to do with - - PowerPoint PPT Presentation
I was 5. What does a childhood fear in 1983 have to do with serverless security in 2019? McNuggets are introduced Mario Bros was released in the arcade ARPANET switches to IP creating the internet Challenger flew STS-7 deploying
SLIDE 2
SLIDE 3
SLIDE 4
SLIDE 5
SLIDE 6
I was 5.
SLIDE 7
SLIDE 8
What does a childhood fear in 1983 have to do with serverless security in 2019?
SLIDE 9
SLIDE 10
McNuggets are introduced
SLIDE 11
Mario Bros was released …in the arcade
SLIDE 12
ARPANET switches to IP …creating the internet
SLIDE 13
Challenger flew STS-7 deploying two satellites and conducting a number
- f experiments
SLIDE 14
Cold war tensions are high
SLIDE 15
The Baseline
SLIDE 16
by Invest Comox Valley
SLIDE 17
by Harold A. Skaarup
SLIDE 18
SLIDE 19
THE BASELINE
Enemies are working against us We are under constant threat Everyone you trust is worried
SLIDE 20
The Environment
SLIDE 21
SLIDE 22
SLIDE 23
SLIDE 24
THE ENVIRONMENT
Cold war doesn’t feel cold ICBMs could launch at any time Darth Vader is coming
SLIDE 25
The Threat
SLIDE 26
SLIDE 27
*Not actually 3200 Phaethon
SLIDE 28
*Still not 3200 Phaethon
SLIDE 29
THE THREAT
PHA is a “hairs breadth” from earth Impact would be devastating Aftermath is a slow, lingering death
SLIDE 30
SLIDE 31
Baseline Environment + + Threat
SLIDE 32
SLIDE 33
SLIDE 34
SLIDE 35
Baseline Environment + + Threat Traditional security
SLIDE 36
TRADITIONAL SECURITY
Assets are long lived Deep access is required & expected Perimeter is king
SLIDE 37
Baseline Environment + + Threat Traditional security Losing ground
SLIDE 38
LOSING GROUND
New malware every 0.3 seconds New vulnerability every 3 days Constant threat of the unknown
SLIDE 39
Baseline Environment + + Threat Traditional security Losing ground Cybercriminals
SLIDE 40
CYBERCRIMINALS
1.5T in profit in 2018 4.5T in damage in 2018 Few to no convictions
SLIDE 41
SLIDE 42
SLIDE 43
THE REACTION
OWASP Top 10 for Serverless CSA 12 Most Critical Risks… Exclusive focus on functions
SLIDE 44
*Not me, not taken in the 1980s
SLIDE 45
Misconfigurations
#1 THREAT
SLIDE 46
100’s of millions records breached from Amazon S3
#1 THREAT
SLIDE 47
SHARED RESPONSIBILITY MODEL
Data Application Operating System Virtualization Infrastructure Physical Service Configuration
SaaS
(Abstract)
+
SLIDE 48
THE FOUR PILLARS OF SERVERLESS SECURITY
Service selection
Do these services meet the business needs?
Functions
Is the code high quality?
Data flow
Is the data intact? Is access controlled?
Configuration validation
Are the service features setup?
SLIDE 49
Make sure that what you build works as intended …and only as intended
THE GOAL OF BUILDING (AND SECURITY)
SLIDE 50