Threat Modeling for Serverless

Overview

Threat modeling for serverless is a structured approach to identifying, assessing, and mitigating security risks specific to serverless computing environments. It helps organizations understand potential attack vectors and vulnerabilities inherent in serverless architectures, enabling proactive security design and risk management.

Primary Objectives

• Enable consistent identification and prioritization of security threats unique to serverless functions and their integrations
• Benefit cloud architects, security engineers, developers, and risk managers by providing clarity on serverless-specific risks
• Support informed decision-making regarding security controls and accountability for serverless application security

Scope & Applicability

• Applicable to organizations adopting serverless computing across industries such as finance, healthcare, e-commerce, and technology
• Covers security domains including function code security, event data flow, identity and access management, and third-party integrations; excludes traditional infrastructure security outside serverless scope
• Requires foundational governance such as asset inventory of serverless functions, data classification, and defined deployment pipelines

Core Structure

• Key components include threat identification, attack surface analysis, risk assessment, and mitigation strategies tailored to serverless constructs
• Organized around principles of least privilege, ephemeral compute security, and event-driven architecture considerations, progressing to policies, controls, and validation tests
• Terminology aligns with cloud security standards and maps to control frameworks like NIST SP 800-53 and CSA Cloud Controls Matrix

How It Is Used

• Adopted through phased rollout starting with critical serverless functions, expanding to full application portfolios
• Assessment workflows involve threat enumeration workshops, risk scoring, and periodic reviews integrated with security audits
• Engineering workflows incorporate threat modeling outputs into design reviews, continuous integration/continuous deployment (CI/CD) gates, and backlog prioritization for remediation

Implementation Artifacts

• Derived policies include secure coding standards for serverless, access control policies, and incident response procedures specific to serverless environments
• Control libraries map serverless-specific controls to established frameworks such as NIST, ISO 27001, and SOC 2
• Evidence artifacts encompass threat model documentation, function configuration snapshots, audit logs, and security testing results

Measurement & Maturity

• Key performance indicators include percentage of serverless functions threat modeled, vulnerability remediation rates, and frequency of security testing
• Maturity scoring evaluates capability levels from ad hoc threat identification to fully integrated, automated threat modeling processes
• Common baselines establish minimum viable controls such as input validation and access restrictions, progressing to advanced runtime protection and anomaly detection

Common Pitfalls

• Focusing on checklist compliance without addressing the dynamic nature of serverless threats
• Over-scoping by attempting to model all functions simultaneously or under-scoping by ignoring event-driven interactions
• Unowned threat models, insufficient evidence collection, and outdated documentation reducing effectiveness

Integration & Mapping

• Maps to cloud security frameworks and standards including NIST SP 800-190 (Application Container Security), CSA CCM, and OWASP Serverless Top 10
• Integrates with governance, risk, and compliance (GRC) systems, security operations centers (SOC), incident response (IR) processes, and software development lifecycle (SDLC) tools
• Tooling considerations include threat modeling software compatible with serverless architectures and automation platforms for continuous control validation

When Not to Use It

• Not suitable for organizations without serverless deployments or those with minimal cloud-native applications
• May be too resource-intensive for small teams without dedicated security roles; lightweight threat identification or checklist approaches may suffice initially

Standards & References

• NIST Special Publication 800-190: Application Container Security Guide
• Cloud Security Alliance (CSA) Cloud Controls Matrix and Serverless Working Group publications
• OWASP Serverless Top 10 Security Risks and associated threat modeling guides