What are the best techniques for securing cloud-based serverless architectures?

Not only serverless , security becomes a big concern when we talk about public cloud. There are bunch of ways to ensure code security co over serverless architecture. 1.Defining serverless functions under private subnetworks with restricted accessibility. 2.Integration with Sast tools:Static application security tools scan application source code to identify vulnerabilities and flaws. 3. Integration with external security validation tools: Which regularly checks any network flaws ,port vulnerabilities and openes to internet etc 4.Build automated test framework & implement shift left principles of devsecops. 5.Encryption - Make sure to follow and update with latest encryption algos. ( at rest and transit) in compliance with owasp.

Managing permission is one of the first layer of defence in terms of authorization. Step by step proces to manage permissions 1: Defining user personas - and make it very generic 2. Persona based roles and policies ( RBAC) . eg: Data engineer to get roles on ETL and storage related services. Data scientist gets on ML related services. 3. Applying further granular control ( ABAC) - Add tags to the services which could further restrict the boundaries of access. Tag/Attribute based access controls are second level of security after RBAC. ABAC helps in curtailing the unnecessary roles creation and tag can also help in cost and performance monitoring. 4. Managing keys permissions and governance

One of the approaches I’ve been using more and more in recent years is ChatOps. In case of AWS it is really easy to set up their chatbot - create a slack channel, connect the bot, choose the metrics and configure the alerts. It’s important to configure the thresholds appropriately - the alerts in prod monitoring channel should always be actionable. Meaning that when the engineer receives it, the troubleahooting and the discussion starts immediately.

Observability and monitoring are must for any applications irrespective of being in cloud. Its a standard SDLC practice. Collecting and shipping Network , application , data logs etc and then analyzing it helps detect fraud and anamolies.Logging framework plays a major role in retail/banking industry where it is collected in real time for fraud prevention.

Hardening endpoints strengthens cloud security by preventing unauthorized access, protecting against malware, enabling data loss prevention, managing identities, ensuring patch management, implementing encryption, and enhancing monitoring for swift incident response.

1. Virtual Private Cloud (VPC) Configuration: A VPC allows you to create a logically isolated section of the cloud where you can launch resources such as serverless functions. 2. Function-Level IAM Roles and Permissions: Follow the principle of least privilege, granting each function only the permissions it needs to perform its specific tasks. 3. Isolation Through Deployment: Consider deploying different functions into separate environments or accounts. For example, you might have separate environments for development, testing, and production. By combining these methods, you can establish a multi-layered approach to isolate your serverless functions, enhancing security and minimizing the impact of potential vulnerabilities or breaches

Great perspectives shared by all.. But if we are mentioning Server less architecture in today's context we have to consider Ai to pre-empt security threats. Big names like AWS and Azure are using smart tools powered by AI to spot and stop threats even before they can cause harm. It's like having a security guard who can predict problems and deal with them instantly. This helps keep serverless systems safe and running smoothly. The Zero Trust Architecture which includes the principle of least privilege (PoLP) is a foundational cybersecurity tenet, advocating that any process, user, or application should only be granted the bare minimum permissions necessary to perform its task.

If ingesting outside/Public data into org ecosystem make sure to have a virus Scan check and quarrantine the files and push only the validated files into ETL framework and data store.