The Serverless Mirage - Navigating Risks in an Invisible Infrastructure

The talk traces computing from bare metal through virtualization and containers to AWS Lambda, arguing that serverless shifts security responsibility rather than removing it. The provider secures the layers beneath the function, while customers still own identities, data, dependencies, and triggers. The speakers group the serverless attack surface into event sources, vulnerable function code and exposed secrets, platform and CI/CD misconfiguration, and monitoring gaps.

Risks are then mapped to OWASP and CWE categories with practical mitigations: validating event payloads at the edge, centralizing logs and tracing, scanning dependencies and producing SBOMs, signing artifacts, and limiting egress and tokens. Business impact and cyber insurance trends are discussed briefly. The core case study is Links Lab, an open-source command-line tool that deploys a sentiment-analysis stack on AWS, including an API gateway, an authorizer function, a worker function, a secrets store, a logging bucket, and a hosted model, then tears it down.

The demonstration walks through deploying and verifying the stack, sending requests with a REST client, and running attack and defense scenarios: input injection, a misconfigured policy that can disable function logging, and a vulnerable third-party package that leaks secrets. The closing guidance is to trace requests across services, enforce least privilege and automated deployment checks, validate inputs at the edge, keep handlers small and idempotent, and design for failure.