Comments
AppSec in the World of 'Serverless'
Newest First  |  Oldest First  |  Threaded View
boristcell
50%
50%
boristcell,
User Rank: Author
6/25/2018 | 5:09:41 PM
Re: Overwhelmed by servers and serverless = loss of data control
Good points. To me, "serverless" is more a sub-category of "cloud." To be sure, security concerns using serverless also can apply to cloud services in general. The article you reference is a good description of thinking through data handling and controls in general, such as by the practice of storing passwords using bcrypt, rather than in cleartext to limit the damage of data loss. That applies regardless of what infrastructure or programming model one chooses. It goes to illustrate that in the end, security fundamentals don't change; the art is in the application of those principles as the landscape changes.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/22/2018 | 6:08:21 PM
Overwhelmed by servers and serverless = loss of data control
To a certain extent, "serverless" is becoming a fancy word for "cloud". And at some point, data has to get stored and processed on some server somewhere, serverless or no. The phenomenon you describe here is similar to the loss of data-control issues in an SDLC similar to those recently discussed on Dark Reading, here: darkreading.com/putting-the-s-in-sdlc-do-you-know-where-your-data-is/a/d-id/1331185


White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-9574
PUBLISHED: 2018-07-19
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVE-2017-2673
PUBLISHED: 2018-07-19
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
CVE-2017-7481
PUBLISHED: 2018-07-19
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templati...
CVE-2018-12911
PUBLISHED: 2018-07-19
WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.
CVE-2018-14404
PUBLISHED: 2018-07-19
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulne...