Misconfiguration of serverless workloads

Cloud Security

Misconfiguration of serverless workloads is a significant security risk in cloud environments.
Excessive permissions granted to serverless functions, lack of security controls around functions, and misconfigured third-party services are common misconfigurations that can lead to data breaches and other security incidents.
One of the most common misconfigurations in serverless workloads is excessive permissions granted to functions.
Serverless functions typically require specific permissions to access resources in the cloud environment, such as databases or object storage.
If these permissions are misconfigured or overly permissive, an attacker can gain access to sensitive data or even take control of the entire environment.

Where this idea came from

Security article

Cited from a security article or vendor blog in the original YAML; not a first-party incident report.

https://cloudsecurityalliance.org/blog/2022/11/20/top-threat-9-to-cloud-computing-misconfiguration-and-exploitation-of-serverless-and-container-workloads/

Mitigations

M1550 Implement strict access control for clouds
M1720 Implement regular patches and updates
M1770 Implement least privilege principle for serverless workloads
M1771 Regularly review and update permissions

Detections

D1260 Implement regular security audit and review
D1261 Implement penetration testing
D1262 Implement vulnerability assessment
D1500 Configure monitoring of used artifacts and open-source libraries
D1510 Implement Intrusion Detection System and anti-malware

Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.

References

https://cloudsecurityalliance.org/blog/2022/11/20/top-threat-9-to-cloud-computing-misconfiguration-and-exploitation-of-serverless-and-container-workloads/