AWS Lambda, Serverless Function-as-a-Service (FaaS), Primer

AWS paved the way via FaaS years ago.  However, I have yet to find a succinct, aggregation of best practices on how to use & deploy these solutions.  So, here you go:

Overview/Serverless Application Model (SAM): https://d1.awsstatic.com/whitepapers/serverless-architectures-with-aws-lambda.pdf; https://aws.amazon.com/blogs/compute/building-well-architected-serverless-applications-approaching-application-lifecycle-management-part-1/; https://aws.amazon.com/blogs/compute/category/compute/aws-serverless-application-model/; https://docs.aws.amazon.com/wellarchitected/latest/framework/wellarchitected-framework.pdf

Orchestrating serverless services: https://theburningmonk.com/2020/08/choreography-vs-orchestration-in-the-land-of-serverless/

Tracing & monitoring Lambda: https://www.infoq.com/articles/tracing-aws-lambda-functions/; https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-cloudwatch-metrics-logging.html

Negating latency challenges with cold starts: https://epsagon.com/development/how-to-minimize-aws-lambda-cold-starts/

Securing Lambda functions: https://medium.com/orchestrated/steps-to-secure-aws-serverless-lambda-part-1-a6e5d1b05f45

Edge functions: https://www.stackery.io/blog/lambda-at-edge/

Securing edge functions: https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-how-to-use-lambdaedge-and-json-web-tokens-to-enhance-web-application-security/ 

Tagging: https://www.cloudforecast.io/blog/aws-tagging-best-practices/

Native Versus Generic Security Baselines for Cloud

For a while now specific providers (Security Scorecard, BitSight) have provided security benchmarking for a client's ecosystem / vendors.

While that is great, these algorithms have been generic in nature versus taking cloud security nuances (i.e., AWS S3 utilization) into consideration.

To fill that gap, cloud service providers (CSPs) have now added their own benchmarks (e.g., AWS Trusted Advisor, Azure Secure Score) that will baseline a specific account versus the entire cloud ecosystem.

One would think that partnerships, maybe in conjunction with the Cloud Security Alliance's (CSA) Security, Trust & Assurance Registry (STAR) program, would allow cloud consumers to provide a holistic view of one's security maturity.

Hypervisor Replication for Virtualization Security

Vendors like Bracket & BitDefender are rolling out virtualization security solutions meant for hybrid cloud deployment to negate rootkits & chip-based exploits (Spectre, Meltdown).

However, comprehensive coverage / support seems limited & you would think that the big cloud service providers (CSPs: AWS, MSFT Azure, GCP) have hardened their own hypervisors already.

VMware's partnership w/ AWS could pave the way for hardened hypervisors that can lift & shift among on / off prem deployments.

Smart Home / IoT, Threat & Vulnerability Management (TVM) & B2C Delineation for Vendors

As the smart home becomes a reality (https://www.theverge.com/2017/12/20/16799918/homekit-vulnerability-details) so does the need to monitor & patch said smart home.

But, who from a vendor standpoint will own that market / responsibility (ISPs, Utilities, Alarm / Physical Security, AV software vendors, separate vendors: Amazon / Apple / Google / Staples: Geek Squad, B2C MSSPs / SOCs)?

The answer will vary depending on the jurisdiction / age of the house, though this wrestling match is sure to come.

So, wait & see how this shakes out, because change is coming for sure.

Enough Policy Exceptions Already

So many organizations struggle with policy exceptions.  While exceptions are a reality, the prevalence of them leads one to believe that risk management is not quite working.

While organizations try to pivot from risk to compliance focal points to enforce adherance to security / privacy best practices, the reality is that most entities are not agile, and they also lack the resources to migrate from legacy workdlows to secure processes and systems.

While the cloud and ITO / BPO of the past have promised more agility, many orgs leverage traditional internal models due to cost constraints.

GRC, risk management, and IT audit professionals have a legit argument to focus on policies, standards, and guidelines; however, for orgs to be and remain secure these days, an offensive, proactive model is more of a necessity.

Dual of Cloud Silver Bullets: Aporeto vs RedLock

Both are flush w/ cash & both have stormed outta the gate for cloud security.

The question is who is there customer?  Many orgs have existing InfoSec investments that could be extended to the cloud via virtual appliances.  So, unless cloud security providers (CSPs) bundle these solutions in, I would think that large, Fortune 1000 companies wouldnt be early adopters.

TBD....