cloud

Tagged

A collection of 12 posts

TL;DR on AWS Lambda Security Model

AWS recently released a whitepaper on the Security Overview of Lambda. This document is meant to be an in-depth look at Lambda Security. Its definitely a worthwhile read. However, I have tried to simplify and distill some of the most important security points for general consumption A little bit of

Abhay Bhargav Jan 25, 2021 • 3 min read

automation

Look Ma! No Swagger! An approach to automated doc generation for Serverless Apps

All of this started with this question #lazyweb is there an easier way to doc APIs other than Swagger/OpenAPI? Looking for some options. — Abhay Bhargav (@abhaybhargav) October 1, 2020 I was tired. We had this large API that we'd built out over time. And of course! Just like

Abhay Bhargav Oct 5, 2020 • 5 min read

application security

Stale-State Serverless Security Flaws

I'd like to introduce a possibly new class of serverless security flaws with a story. For our training business at we45, we orchestrate servers. A lot of servers. These servers are used by our many students to practice and learn concepts around Application Security, Cloud Security, Kubernetes Security, Cloud Security

Abhay Bhargav Sep 28, 2020 • 6 min read

kubernetes

5 Must-Have Kubernetes Security Tools

My entire months of June and July have been consumed by Kubernetes. All, largely owing to the Kubernetes Security Masterclass Training that are we are bringing to BlackHat USA 2020 👍🎉(you should register if you haven't already). And while we have been running Kubernetes Security trainings for a while now,

Abhay Bhargav Jul 15, 2020 • 4 min read

application security

AppSec Predictions for 2020

A Customary Blogpost I am going to NOT encompass "InfoSec Predictions" in this because "InfoSec" is a HUGE area and I am not nearly qualified enough to be making predictions without coming off like a jackass. That said, with AppSec, I have had the privilege of: running a company with

Abhay Bhargav Dec 28, 2019 • 5 min read

serverless

TDD for Serverless - My Setup

I have been building serverless over the last 10 months now. I am currently working on a "not-small" project that spans nearly a 100 functions in Python 3.7. I started working with Test-Driven Development (TDD) around a year ago. Its been quite a large productivity boost for me. This

Abhay Bhargav Dec 1, 2019 • 4 min read

application security

Secrets of Secrets

Secrets Management is important. Now, more than ever. Yet, I see very little attention being paid to it by Developers, DevOps teams and surprisingly, even security teams. Secrets are not only critical in protecting access to third-party APIs and components like Databases and so on, but are equally important when

Abhay Bhargav Nov 4, 2019 • 2 min read

application security

Holy s**t! We're really behind!

Have been doing a lot of work with, the Cloud, Kubernetes, Serverless and Containers over the last 2 years, and I realize that we have very little by way of effective security tooling for these technologies (especially at their depth). For me, security tools also need to be very developer

Abhay Bhargav Oct 27, 2019 • 2 min read

cloud

Notes on Open Policy Agent and Docker Security

I am starting to work with Open Policy Agent (OPA) for Kubernetes. OPA is largely known for its ability to behave as a powerful Admission Controller for Kubernetes. However, I find that Open Policy Agent is a great Admission Controller/Policy Enforcement tool for Docker, HTTP REST API and other

Abhay Bhargav Oct 21, 2019 • 2 min read

serverless

Winning with Serverless DevSecOps Pipelines

There's little doubt that Serverless Technologies are being adopted at a rapid pace [1]. I have personally seen typically stodgy, old-school enterprises take to building out serverless (especially FaaS) projects to handle some mission-critical operations. I tend to agree with experts like Simon Wardley (of the famous Wardley Maps) that

Abhay Bhargav Jul 21, 2019 • 8 min read

serverless

So you wanna build a Production-ready Serverless App?

I've been exploring serverless security for around a year now. Commonly, as a security pro, one typically looks at the offensive angle to any technology. While this can be very useful, it pales in comparison to the effort required in actually running and maintaining this technology, live, in production. And

Abhay Bhargav Jul 18, 2019 • 7 min read

graphql

The Hard Way: Security Learnings from Real-world GraphQL

This article comes (relatively) close on the heels of my talk at AppSec California. The talk was: "An Attacker's Perspective of Serverless and GraphQL Applications"The slides for that talk are available here As I was preparing for the talk. I had a project, ThreatPlaybook, that we needed to revamp.

Abhay Bhargav Feb 17, 2019 • 7 min read