Jordan Obey
Karishma Asthana
Sourabh Katti
The popularity of serverless architectures continues to grow as organizations seek to simplify scalability and eliminate the need to provision and manage infrastructure. In our most recent State of Serverless report, we found that there has been significant serverless adoption across Azure, Google Cloud, and AWS.
While serverless architectures have shifted the responsibility of server-side security to trusted cloud providers, customers are still responsible for securing their applications against application-level attacks such as Command/SQL injection, Cross Site Scripting (XSS), and more. Securing serverless applications is uniquely challenging because they are highly distributed and comprise several ephemeral stateless components. This requires security at different layers; serverless functions need to be secured not only in the code but also at the invocation level, which further complicates application security as functions are often invoked millions or billions of times a month. This new attack surface offers more opportunities for attackers to exploit vulnerable applications and compromise the integrity of applications and underlying data.
Datadog App and API Protection (AAP) helps improve your security posture by detecting threats to applications built on AWS Lambda. Datadog AAP leverages the same Datadog tracing library as Application Performance Monitoring (APM), which means you can monitor threats to your applications without any additional agents or instrumentation.
AAP monitors the traffic of your serverless application to generate security signals and provide insight into attacks attempting to exploit vulnerabilities in serverless applications.
In this post, we'll look at how we address the challenges of securing serverless architectures by letting you:
- Detect critical attacks across your serverless applications
- Investigate attacks with distributed traces
- Respond within existing workflows and tools
Detect critical attacks across your serverless applications
Because every invocation of a serverless application could be an attack attempt, securing them requires visibility into every invocation. Without visibility into the full scope of a request, it can be difficult to distinguish between legitimate and malicious traffic, giving an attacker more time to successfully exploit a vulnerability.
Datadog AAP operates at runtime and monitors on an invocation basis. Once enabled, AAP will monitor requests across your Lambda functions to detect and alert you of security threats. To explore ways to enable AAP, please see our documentation.
You can see the attack exposure across your serverless applications in the Service Catalog. If you notice that a Lambda function received attack attempts but isn't being monitored by AAP, you can quickly enable AAP to ensure it's well-protected and secure.
AAP includes out-of-the-box detection rules that automatically flag harmful attacks—including OWASP Top 10 attacks such as Local File Inclusion and business logic attacks such as account takeovers—with the added functionality of creating your own custom rules. When an attack is detected, Datadog will generate a security signal to notify you.
Investigate attacks with distributed traces
Another challenge to securing serverless architectures is the ephemeral nature of Lambda functions, which makes it difficult to determine the scope of an attack and how best to respond. Datadog APM distributed tracing addresses this challenge and helps you identify the most urgent ongoing attack attempts by tracing requests as they spread across your serverless application. Within AAP, you can pivot from a security signal directly to its related traces, letting you immediately investigate with the context you need to understand what happened and determine the best way to respond and remediate.
Distributed tracing also enables you to see Attack Flows that show how an attack propagated across functions to understand its blast radius and gain the context you need to determine the appropriate response. In the screenshot below, you can see that a Server-Side Request Forgery (SSRF) attack has occurred on a web-store service that's upstream of a sensitive MongoDB database, and therefore calls for immediate action.
Respond within existing workflows and tools
Datadog AAP also helps facilitate your response by enabling you to create or run a Workflow directly from a security signal, which triggers a series of preset actions that help with responding to specific issues or threats. For example, in the event you receive a security signal about an SQL injection attack, you can immediately run a Workflow that tells your AWS web application firewall (WAF) to block all the listed malicious IPs from reaching your application. Additionally, you can further collaborate with other teams through various integrations, such as Slack notifications or Jira tickets.
Secure your serverless applications with Datadog AAP today
Datadog App and API Protection provides insight into attacks throughout your serverless architecture, enabling you to understand an attack's blast radius and respond quickly. This means you can spend less time investigating and responding to threats and more time developing and shipping new features to your customers.
To start monitoring your serverless functions for threats, enable AAP today by checking out your AWS Lambda functions in the Service Catalog.
If you aren’t already using Datadog, sign up today for a 14-day free trial.
