Governance, Risk
and Compliance
Managed Cloud Controls
• Best practice validation
• Continuous compliance
monitoring
• Continuous cost
monitoring
• AWS environment configu-
ration validation
• Security Group monitoring
& management
DevSecOps
AWS Manage-
ment Console
Internet
AWS Shield
AWS WAF
Amazon API
Gateway
AWS Config
invoke
Data Protection
AWS Step
Functions
VPN Gateway / ELBs (TLS
and IPSEC):
• Data in transit protection
• Confidentiality
• Integrity
KMS, EBS and S3 encryption
• Data at rest protection
• Confidentiality
• Integrity
write/
read
AWS KMS
Amazon
Kinesis
put/get
IAM
invoke
• Runtime Protection
• Behavioral Analysis
• Serverless App Firewall
• D
ependency Vulnerability
Monitoring
• Vulnerability Assessment
Lambda
function
invoke
Amazon SQS
get logs
IAM STS
log
S3 Buckets
& Objects
• Identity as a Service
forward
AWS STS:
• Temporary credentials for
Identity Federation
• One time password
AWS Secrets Manager
• Secrets Management
• Password Vault
Threat and Vulnera-
bility Management
invoke
Amazon
DynamoDB
Lambda
function
Identity and Access
Management
AWS IAM:
• User and application iden-
tity management
• Identity Federation
• IDP/SAML 2.0
• Access Control
• Multi-Factor
Authentication
• Asset Mgmt.
• Configuration Mgmt.
• Function Mgmt.
• Versioning
• Continuous Integration
• Continuous Delivery
• Code Scan
CloudTrail flow logs
forward forward
Amazon
CloudWatch
Logging and Monitoring
• Security information event mgmt.
• Log collection and correlation
• Alerts, reports and dashboards
CloudTrail, Flowlogs, S3 Access logs:
• Audit
• Logging and monitoring
Figure 8: Example of serverless design artifacts
The result is both a high-level and low-level logical view of
serverless security, which takes the abstracted contents of
the capabilities matrix and details the roll out of each com-
ponent in a simple to understand diagram.
Summary
As adoption of the cloud continues and matures, securing
serverless applications is an inevitable requirement, as
many enterprises are adopting this approach to their cloud
applications.
The serverless security model is a well structured method
for security professionals, serverless developers and archi-
tects to produce a secure design and implementation of
serverless technology.
The SRA (security reference architecture) provides an easy
way to communicate information to all parties, including
executives, application owners, architects and developers.
The SAM (security assessment matrix) provides a tool for
the execution of the reference architecture, and the contin-
uous assessment of your serverles implementation. The
design artifacts provide ready-to-execute controls, specific
to that platform.
Our serverless security model is based on a validated and
battle-tested reference architecture. It integrates communi-
ties research, vendor toolings and recommendations into
the entire approach.
FALL 2019 | THE DOPPLER | 27