Serverless security considerations in Cybersecurity - Mini Project: Build & Apply

Serverless Security Considerations

📖 Scenario: You are working in a company that uses serverless computing to run applications. Your team wants to ensure the applications are secure from common risks.

🎯 Goal: Build a checklist of key security considerations for serverless applications to help your team understand and apply best practices.

📋 What You'll Learn

Create a list of common serverless security risks

Add a variable to set a security risk threshold

Use a loop to filter risks above the threshold

Add a final note about continuous monitoring

💡 Why This Matters

🌍 Real World

Serverless computing is popular for building scalable applications without managing servers. Knowing security risks helps protect data and services.

💼 Career

Security analysts and cloud engineers must understand serverless risks to design safe applications and respond to threats effectively.

1

Create a list of serverless security risks

Create a list called security_risks with these exact strings: 'Insecure function permissions', 'Excessive resource access', 'Injection attacks', 'Data exposure', and 'Lack of monitoring'.

Cybersecurity

# Create the list security_risks with the given entries
# Your code here

Hint

Use square brackets to create a list and include all the exact strings separated by commas.

2

Set a risk severity threshold

Create a dictionary called risk_severity that assigns these exact severity scores: 'Insecure function permissions': 8, 'Excessive resource access': 7, 'Injection attacks': 9, 'Data exposure': 6, and 'Lack of monitoring': 5.

Cybersecurity

security_risks = ['Insecure function permissions', 'Excessive resource access', 'Injection attacks', 'Data exposure', 'Lack of monitoring']
# Create the dictionary risk_severity with the given key-value pairs
# Your code here

Hint

Use curly braces to create a dictionary with the exact keys and integer values.

3

Filter high severity risks

Create a list called high_risks that includes only the risks from security_risks whose severity in risk_severity is greater than or equal to 7. Use a for loop with variables risk and check risk_severity[risk].

Cybersecurity

security_risks = ['Insecure function permissions', 'Excessive resource access', 'Injection attacks', 'Data exposure', 'Lack of monitoring']
risk_severity = {'Insecure function permissions': 8, 'Excessive resource access': 7, 'Injection attacks': 9, 'Data exposure': 6, 'Lack of monitoring': 5}
# Create the list high_risks with risks having severity >= 7
# Your code here

Hint

Use a for loop to check each risk's severity and add it to high_risks if it meets the threshold.

4

Add a final note on monitoring

Create a string variable called final_note with this exact text: 'Continuous monitoring is essential to maintain serverless security.'

Cybersecurity

security_risks = ['Insecure function permissions', 'Excessive resource access', 'Injection attacks', 'Data exposure', 'Lack of monitoring']
risk_severity = {'Insecure function permissions': 8, 'Excessive resource access': 7, 'Injection attacks': 9, 'Data exposure': 6, 'Lack of monitoring': 5}
high_risks = []
for risk in security_risks:
    if risk_severity[risk] >= 7:
        high_risks.append(risk)
# Create the final_note string with the given text
# Your code here

Hint

Assign the exact text to the variable final_note using quotes.

Practice

1. What is a key security principle to follow when configuring permissions for serverless functions?

easy

A. Allow permissions only during business hours

B. Give all permissions to avoid errors

C. Use default permissions without changes

D. Grant only the minimum permissions needed for the function to work

Solution

1. Step 1: Understand the principle of least privilege

   Least privilege means giving only the permissions necessary for a task, nothing extra.

2. Step 2: Apply least privilege to serverless functions

   Serverless functions should have minimal permissions to reduce risk if compromised.

3. Final Answer:

   Grant only the minimum permissions needed for the function to work -> Option D

4. Quick Check:

   Least privilege = Grant minimum permissions [OK]

Hint: Always limit permissions to what is strictly needed [OK]

Common Mistakes:

• Giving too many permissions increases risk
• Using default permissions without review
• Assuming permissions can be broad safely

2. Which of the following is the correct way to validate input data in a serverless function?

easy

A. Ignore input validation to save time

B. Validate inputs against expected formats and reject invalid data

C. Trust all inputs from authenticated users

D. Validate inputs only after processing

Solution

1. Step 1: Recognize the importance of input validation

   Validating inputs prevents malicious or malformed data from causing harm.

2. Step 2: Apply validation before processing inputs

   Rejecting invalid data early protects the function and backend systems.

3. Final Answer:

   Validate inputs against expected formats and reject invalid data -> Option B

4. Quick Check:

   Input validation = Check and reject bad data [OK]

Hint: Always check inputs before using them in your code [OK]

Common Mistakes:

• Trusting inputs from authenticated users blindly
• Skipping validation to speed up development
• Validating inputs only after processing

3. Consider this serverless function snippet that processes user data:

def handler(event):
    user_input = event.get('input')
    if not user_input:
        return 'No input'
    return f'Processed: {user_input}'

What is a potential security risk in this code?

medium

A. It does not validate or sanitize the user input

B. It does not encrypt the user input

C. It uses a return statement

D. It checks if input is missing

Solution

1. Step 1: Analyze input handling in the function

   The function accepts user input but does not check if it is safe or clean.

2. Step 2: Identify missing input validation or sanitization

   Without validation, malicious input could cause injection or other attacks.

3. Final Answer:

   It does not validate or sanitize the user input -> Option A

4. Quick Check:

   Missing input validation = Security risk [OK]

Hint: Look for missing input checks in code snippets [OK]

Common Mistakes:

• Thinking encryption is needed for all inputs
• Confusing return usage with security
• Ignoring input validation importance

4. A developer wrote this serverless function to encrypt data but it fails to run:

import cryptography

def encrypt(data):
    return cryptography.encrypt(data)

What is the main error?

medium

A. The cryptography module does not have a direct encrypt function

B. The function encrypts data correctly

C. Missing import for json module

D. The function encrypts data twice

Solution

1. Step 1: Check the cryptography module usage

   The cryptography library requires specific classes and methods for encryption, not a direct encrypt function.

2. Step 2: Identify the incorrect function call

   Calling cryptography.encrypt(data) will cause an error because no such function exists directly.

3. Final Answer:

   The cryptography module does not have a direct encrypt function -> Option A

4. Quick Check:

   cryptography.encrypt() does not exist [OK]

Hint: Check library docs for correct function names [OK]

Common Mistakes:

• Assuming all modules have simple encrypt() functions
• Ignoring import errors
• Confusing encryption with data formatting

5. You want to secure a serverless app that processes sensitive user data. Which combination of practices best improves security?

hard

A. Encrypt data only after processing and ignore monitoring

B. Grant full permissions to speed up development and skip input validation

C. Use least privilege permissions, validate inputs, encrypt data at rest and in transit, and monitor logs for suspicious activity

D. Use default permissions and rely on cloud provider security alone

Solution

1. Step 1: Identify best security practices for serverless apps

   Key practices include least privilege, input validation, encryption, and monitoring.

2. Step 2: Evaluate each option against these practices

   Use least privilege permissions, validate inputs, encrypt data at rest and in transit, and monitor logs for suspicious activity includes all important steps; others skip critical protections.

3. Final Answer:

   Use least privilege permissions, validate inputs, encrypt data at rest and in transit, and monitor logs for suspicious activity -> Option C

4. Quick Check:

   Combine key security steps = Strong protection [OK]

Hint: Combine multiple security steps for best protection [OK]

Common Mistakes:

• Skipping input validation or monitoring
• Granting excessive permissions
• Relying only on cloud defaults