{"id":4509,"date":"2017-07-07T23:02:18","date_gmt":"2017-07-07T23:02:18","guid":{"rendered":"https:\/\/redmonk.com\/jgovernor\/?p=4509"},"modified":"2017-07-07T23:03:23","modified_gmt":"2017-07-07T23:03:23","slug":"the-high-cost-of-free-on-serverless-convenience-and-security-vulnerabilities","status":"publish","type":"post","link":"https:\/\/redmonk.com\/jgovernor\/the-high-cost-of-free-on-serverless-convenience-and-security-vulnerabilities\/","title":{"rendered":"The high cost of free: on serverless, convenience and security vulnerabilities"},"content":{"rendered":"

\"Plastic<\/p>\n

Jeffconf<\/a> today was excellent, but the talk that really stuck with me was Guy Podjarny, founder of Snyk<\/a>, because he introduced an idea I had never considered before. At RedMonk we spend a fair bit of time discussing the power of convenience in technology adoption, but also its potential costs and downsides. As a metaphor think of how absurdly convenient plastic packaging is, but also how damaging.<\/p>\n

So what happens in the serverless economy, where you don\u2019t need to pay for a function until it is actually used? Well for one thing, just like plastic bottles, you\u2019re less likely to dispose of them effectively. In microservices we talk about disposability as a virtue, but with serverless it\u2019s so easy to deploy code, why bother getting rid of it? When it comes to security though, poor code hygiene essentially leads to bigger attack surfaces, which is A Bad Thing.<\/p>\n

\u201cWith serverless there is zero cost to deploying functions, so you deploy everything. Say a cron job. That is awesome, but also false from a security perspective. i am most concerned about this explosion of attack surface.Make sure you know what is disposable, and dispose of it.\u201d<\/p>\n

Snyk is all about understanding vulnerabilities in your source code, looking at dependencies and attack vectors. It turns out that serverless, by the very fact of it\u2019s convenience and low cost model, may lead to laziness, and poor security. If you\u2019re not worried about paying for your cruft, in terms of compute and storage, then why bother cleaning up after yourself?<\/p>\n

This fact could be an Achilles heel for serverless implementations. Business and government have been surprisingly accepting of security breaches, but that seems to be changing, with regulations like GDPR coming over the horizon. Just because serverless looks cheap at first sight, doesn\u2019t mean it might not be expensive in the long run. Definitely food for thought.<\/p>\n

More on Jeffconf from me next week, but the Snyk talk was really good.<\/p>\n","protected":false},"excerpt":{"rendered":"

Jeffconf today was excellent, but the talk that really stuck with me was Guy Podjarny, founder of Snyk, because he introduced an idea I had never considered before. At RedMonk we spend a fair bit of time discussing the power of convenience in technology adoption, but also its potential costs and downsides. As a metaphor<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[1],"tags":[],"class_list":["post-4509","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9wfjh-1aJ","_links":{"self":[{"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/posts\/4509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/comments?post=4509"}],"version-history":[{"count":0,"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/posts\/4509\/revisions"}],"wp:attachment":[{"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/media?parent=4509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/categories?post=4509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/redmonk.com\/jgovernor\/wp-json\/wp\/v2\/tags?post=4509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}