CTO Daily Dose - Impact of Serverless on Compliance
Transcript
hey it's key from the CTO advisor calm with today's CTO daily dose we're going to talk about the fun topic of compliance and audit yay you know what what makes it fun is that we're talking about the impact of a concept such as serverless on audit and compliance security in general we're gonna pick on one of my favorite beating horses and that's PCI so one of the PCI controls is I think is PCI control 11.4 me and my tech field day buddies text I will on
a Twitter and Yvonne Sharpe we got to talking through on slack about the impact of PCI on your application design specifically serverless one of the requirements is PCI 11.4 which is you must have a network intrusion detection system IDs or I are I'm sorry IPS system to prevent or detect intrusions so how does that really work and lambda if there's no servers associated with your application you can't really create any kind of border there's no edge of the lambda network to identify and filter traffic I
couldn't put a firewall on either side of this with IPS on if the if this is your data center network with your private PCI data where your card data residing in your data center we had some lamp lambda micro services running in AWS and that data has the transit the lambda service there's no way to put IP asses on either side of that I can put it on the side leaving my data center but I can't detect connections coming from the internet and to Lam or
anywhere for that I can this can be a nother data center on the other side of this connection and there's no facility from AWS to guard against or not necessarily guard against but to detect intrusions to Lambeth this is an AWS Ram service so all of this resides in AWS is network they're responsible for protecting the lamda service itself so I can't go to AWS as part of my qsa audit part of my PCI audit and qsa does the audit and say you know what give
me the IPS laws for my lamda instances that canna doesn't exist so server list breaks this 11.4 requirement that you put ids/ips in front of your card data so how do we get around that well obviously in lambda itself as I build applications I can build that to one that I'm only passing encrypted data I can have key and key management systems I can show that the data that this transient lambda into my data center if I'm transferring card data out of my data center into
lambda and out to the public internet or wherever is gonna go I can show that I have controls around that that needs to be explained to a qsa so that they understand that Wow there may not be III PS involved you do have the logical controls to ensure that the data is protected I have to tell you that that's going to be a tough conversation most qsa is the last time I dumped my hand into PC I audit are not that sophisticated to understand this level
of abstraction the concept of server lists so what does that mean from your application you know what for the most part say to go to the guidance of your cloud provider cloud providers have had these conversations with dozens if not hundreds of customers on what type of data is best suited for what platform lamda isn't advertised as a secure platform for transactions or for private specific specifically for credit card data or FDA data or HIPAA data the AWS is really good at supporting specific compliance needs
so if they don't advertise lamda as a target for this type of application I'd advise putting that type of data in that application there are DMS services they're sitting in other paths applications are recommended for secure data or regulated data at tend to build applications around those services versus lambda until AWS blesses it once AWS does bless it they can refer you to consultants or processes in order to support qsa audits in the mean time so you know what mix news we got the concept of
what lambda does bad news there really not a great facility for meeting audit controls like 11.4 however we will get AWS and xuer and Google all these services will continue to adapt and work through and help identify what controls are available within the service or via third-party to meet your PCI or audit requirements that's it for this CTO daily dose talk to you guys next Billy dose if you want to engage in the conversation simply search the hashtag hashtag CTO daily dose and you'll find this
on Twitter LinkedIn and Facebook talk to you guys tomorrow
