Gone in 60 ms: Intrusion and Exfiltration in Serverless Architectures [video]

Gone in 60 ms: Intrusion and Exfiltration in Serverless Architectures [video](media.ccc.de)

34 points by ASUmusicMAN 9 years ago | 7 comments

wojcech 9 years ago |

This made me put "sign up on gun.io" on my to-do list. Very cool talk, very sympathetic guy (+1 for rapid fire info,+10 for making a stand for hacker aesthetics and fun in hacking)

Mizza 9 years ago | |

Thanks man! :D

windexh8er 9 years ago | | |

Is the repo still empty due to that one little NDA tidbit? o_O

thatwebdude 9 years ago |

AKA!!!

So, if IAM is the keys to the city for Lambda, how can I be sure I'm using IAM correctly on AWS (Since AWS documentation is not great). Any suggestions? (asking for a friend...)

Mizza 9 years ago | |

(Presenter here) - My opinion is that there is no magic bullet here. There are some 3rd party tools that can help to audit your IAM usage for large organizations, but I think manual review is necessary. I think Amazon is also starting to roll out some of there own tools. There are some general best practices you can implement - keep production on a different _account_, don't allow the use '*' anywhere, things like that.

After the talk, I spoke to a nice Dutch man who told me the way they handled it at their company was to randomly turn off an overly broad permission and see who came to complain!

Pica_soO 9 years ago |

Great Talk.

GrumpyNl 9 years ago | |

Have to watch this guy, next time he gives a talk. Rapid but motivational.