Serverless architectures are becoming more popular as cloud providers take on the majority of the workload, allowing developers to focus on building and running their applications. This has attracted the attention of malicious actors, and although serverless environments have a reduced attack surface, users must be careful not to introduce extra risk. To evaluate the security of Microsoft Azure serverless environments, researchers conducted simulations of user-provided code vulnerabilities. This revealed sensitive environmental variables inside the Microsoft Azure environment, which could be exploited by attackers. It was also found that if Azure customers use a master key for SSH access, it could allow attackers to escalate privileges inside a container with a known password. To stay secure, users must deploy public key cryptography for authentication to SSH. It is important to remember that users are responsible for implementing security best practices and policies to supplement Microsofts default security measures. Application code must be properly secured, as it could be an entry point for attackers. Organizations using serverless computing services should understand and exercise their responsibility for securing these environments. To read a full copy of the report, The State of Serverless Security on Microsoft Azure, please visit: https://www.
This Cyber News was published on www.trendmicro.com. Publication date: Thu, 02 Feb 2023 05:20:03 +0000