Cloud Security
Mitigating Security Risks in Publicly Exposed Cloud Functions and Serverless Deployments
Mandiant security assessments reveal that publicly exposed serverless functions lacking authentication frequently suffer from application-level flaws like file inclusion and command injection. Attackers leveraging these unauthenticated endpoints can compromise underlying containers and pivot into the broader cloud environment. Defenders must implement strict IAM controls, input validation, and proper network segmentation to secure FaaS architectures.
What Happened
Security evaluations frequently uncover serverless applications and Function-as-a-Service (FaaS) deployments left publicly accessible without proper authentication mechanisms. Due to specific operational or business needs, these endpoints accept unauthenticated requests directly from the internet. Because serverless workloads execute custom code relying on numerous third-party packages, they present a broad attack surface for application-layer vulnerabilities.
Technical Impact
Exploitation of unauthenticated serverless endpoints typically centers on software flaws such as Remote File Inclusion (RFI), Local File Inclusion (LFI), and command injection. Successful compromise of these application vulnerabilities yields arbitrary code execution within the container instance hosting the function. From this initial foothold, threat actors can escalate privileges, access sensitive environment variables, or leverage attached service accounts to pivot laterally throughout the wider cloud ecosystem.
What Defenders Should Do
Securing public-facing serverless functions requires a defense-in-depth approach that balances accessibility with strict runtime isolation and identity enforcement:
- Enforce mandatory authentication on all cloud functions and serverless services unless public access is strictly required by design.
- Apply the principle of least privilege to the IAM service accounts associated with serverless workloads to limit potential blast radius.
- Implement rigorous input validation and sanitization to neutralize injection vectors and file inclusion attempts.
- Monitor container runtime logs and function invocation metrics for anomalous execution patterns or unexpected outbound network traffic.
Related vulnerabilities
Mitigating Stale Sharing Risks in Microsoft 365 Through Access Governance
Microsoft 365 environments frequently accumulate stale file-sharing permissions and orphaned links, leaving sensitive enterprise data exposed. SecOps and sysadmins must implement centralized access governance and owner-driven reviews to audit permissions and revoke unnecessary access.
Read briefing
Falcon Cloud Security Adds Third‑Party App Insights and AI‑Enhanced Remediation
CrowdStrike’s latest Falcon Cloud Security update delivers visibility into third‑party SaaS applications and AI‑driven remediation. Defenders can now automatically identify risky app activity and apply containment actions, reducing response time.
Read briefing
Falcon Cloud Security Adds Third‑Party App Insights and AI‑Enhanced Remediation
CrowdStrike has updated Falcon Cloud Security to provide visibility into third‑party applications and AI‑driven remediation. The new features give SecOps teams a consolidated view of SaaS integrations and automated playbooks. Defenders should enable the module, review insights, and integrate remediation workflows with existing SOAR tools.
Read briefing
CrowdStrike Deploys On-Device AI for Real-Time Data Classification in Falcon Data Security
CrowdStrike has added on-device language‑model classification to Falcon Data Security, enabling instant detection of sensitive data without cloud latency. The update targets organizations using Falcon to protect endpoints and cloud workloads. Defenders should enable the new feature, review classification rules, and monitor for false positives.
Read briefing