cloud

A collection of 12 posts

TL;DR on AWS Lambda Security Model

AWS recently released a whitepaper on the Security Overview of Lambda. This document [https://d1.awsstatic.com/whitepapers/Overview-AWS-Lambda-Security.pdf] is meant to be an in-depth look at Lambda Security. Its definitely a worthwhile read. However, I have tried to simplify and distill some of the most important security points

Jan 25, 2021 3 min read

automation

Look Ma! No Swagger! An approach to automated doc generation for Serverless Apps

All of this started with this question > #lazyweb [https://twitter.com/hashtag/lazyweb?src=hash&ref_src=twsrc%5Etfw] is there an easier way to doc APIs other than Swagger/OpenAPI? Looking for some options. — Abhay Bhargav (@abhaybhargav) October 1, 2020 [https://twitter.com/abhaybhargav/status/1311658406302760960?ref_src=twsrc%

Oct 5, 2020 5 min read

application security Featured

Stale-State Serverless Security Flaws

I'd like to introduce a possibly new class of serverless security flaws with a story. For our training business at we45, we orchestrate servers. A lot of servers. These servers are used by our many students to practice and learn concepts around Application Security, Cloud Security, Kubernetes Security, Cloud Security

Sep 28, 2020 6 min read

kubernetes Featured

5 Must-Have Kubernetes Security Tools

My entire months of June and July have been consumed by Kubernetes. All, largely owing to the Kubernetes Security Masterclass Training [https://www.blackhat.com/us-20/training/schedule/#kubernetes-masterclass-19217] that are we are bringing to BlackHat USA 2020 👍🎉(you should register if you haven't already). And while we have been

Jul 15, 2020 4 min read

application security Featured

AppSec Predictions for 2020

> > A Customary Blogpost I am going to NOT encompass "InfoSec Predictions" in this because "InfoSec" is a HUGE area and I am not nearly qualified enough to be making predictions without coming off like a jackass. That said, with AppSec, I have had the privilege of: * running a company with

Dec 28, 2019 5 min read

serverless

TDD for Serverless - My Setup

I have been building serverless over the last 10 months now. I am currently working on a "not-small" project that spans nearly a 100 functions in Python 3.7. I started working with Test-Driven Development (TDD) around a year ago. Its been quite a large productivity boost for me. This

Dec 1, 2019 4 min read

application security

Secrets of Secrets

Secrets Management is important. Now, more than ever. Yet, I see very little attention being paid to it by Developers, DevOps teams and surprisingly, even security teams. Secrets are not only critical in protecting access to third-party APIs and components like Databases and so on, but are equally important when

Nov 4, 2019 2 min read

application security

Holy s**t! We're really behind!

Have been doing a lot of work with, the Cloud, Kubernetes, Serverless and Containers over the last 2 years, and I realize that we have very little by way of effective security tooling for these technologies (especially at their depth). For me, security tools also need to be very developer

Oct 27, 2019 2 min read

cloud

Notes on Open Policy Agent and Docker Security

I am starting to work with Open Policy Agent (OPA) for Kubernetes. OPA is largely known for its ability to behave as a powerful Admission Controller for Kubernetes. However, I find that Open Policy Agent is a great Admission Controller/Policy Enforcement tool for Docker, HTTP REST API and other

Oct 21, 2019 2 min read

serverless Featured

Winning with Serverless DevSecOps Pipelines

There's little doubt that Serverless Technologies are being adopted at a rapid pace [1] [https://thenewstack.io/why-serverless-is-being-adopted-at-a-faster-rate-than-expected/] . I have personally seen typically stodgy, old-school enterprises take to building out serverless (especially FaaS) projects to handle some mission-critical operations. I tend to agree [https://read.acloud.guru/simon-wardley-is-a-big-fan-of-containers-despite-what-you-might-think-18c9f5352147] with experts

Jul 21, 2019 8 min read

serverless

So you wanna build a Production-ready Serverless App?

I've been exploring serverless security for around a year now. Commonly, as a security pro, one typically looks at the offensive angle to any technology. While this can be very useful, it pales in comparison to the effort required in actually running and maintaining this technology, live, in production. And

Jul 18, 2019 7 min read

graphql Featured

The Hard Way: Security Learnings from Real-world GraphQL

This article comes (relatively) close on the heels of my talk at AppSec California. The talk was: > "An Attacker's Perspective of Serverless and GraphQL Applications" The slides for that talk are available here [https://github.com/we45/we45-Public-Presentations/blob/master/2019/AbhayBhargav_AppSecCali_SLS%26GQL.pdf] As I was preparing

Feb 17, 2019 7 min read

Page 1 of 1