Serverless security best practices: from IAM to data protection
Best practices like secure key management, custom access permissions for functions, and not relying on WAFs can help
Generative AI in DevSecOps
As enterprises explore ways to utilize generative AI, a primary concern is the protection of data and intellectual property. The partnership between GitLab and Google Cloud aims to maintain a privacy-first approach while enhancing DevSecOps security with generative AI features. By leveraging Google Cloud's Vertex AI, GitLab developers receive natural language explanations of code vulnerabilities.These concise explanations help accelerate detection and remediation processes by offering remediation options at the time of detection. The goal is to ensure that by automating detection and remediation with AI, developers can maintain rapid development and deployment without sacrificing security. GitLab strives to demonstrate that its generative AI features can both streamline DevSecOps workflows and promote a more secure software development environment, with security being a crucial factor for enterprise adoption.For more deep dives, read NPW Insights.
Insights
Serverless security best practices
Serverless environments are not as well-understood as web environments, where untrustworthy components are known. This, coupled with a large number of event sources makes them prone to injection vulnerabilities like SQL/NoSQL injection, object deserialization attacks, and Server-Side Request Forgery. Moreover, broken authentication and over-privileged permissions can make them vulnerable to cross-site scripting and session hijacking. Best practices like secure key management, custom access permissions for functions, and not relying on WAFs can help. Also useful: using session timeout to prevent memory leaks, infinite loops, and DDoS, serverless security actions for each stage of the SDLC, and best-practices for securing inter-service communication. ARTICLE
