Instructor: FAAS and Serverless. 2 2
When I talk about FAAS 3 3
I'm talking about function as a service. 4 4
Now, function as a service is a really cool new technology 5 5
and it is really one of these newer technologies 6 6
that we're using inside the cloud computing world. 7 7
A lot of traditionalists don't like the idea 8 8
of function as a service 9 9
because there are some risks involved with it 10 10
which we'll talk about as we go through this lesson. 11 11
But I do want you to be aware of this concept 12 12
because as an analyst, I personally think 13 13
function as a service is a large part of the future 14 14
and we're going to have to learn how to use these things 15 15
and how to be able to analyze them 16 16
for security as we move forward. 17 17
Now, when I talk about function as a service or FAAS, 18 18
what exactly is that? 19 19
Well, it's a cloud service model 20 20
that supports Serverless software architecture 21 21
by provisioning runtime containers in which code is executed 22 22
in a particular programming language. 23 23
Now, that's a really long way of saying 24 24
we are going to be able to run things and make applications 25 25
without actually having our own servers. 26 26
Now, that sounds pretty cool, right? 27 27
Because now I don't know about you 28 28
but I've been a system administrator for a long time, 29 29
about 20 years, 30 30
and the idea of having to run all my own servers 31 31
and be able to run my own patches and do the updates 32 32
and do all the testing and do all that stuff 33 33
just to be able to run a simple integration program 34 34
like the one I talked about between Fresh Desk and Udemy, 35 35
to be able to make tickets go back and forth 36 36
sounds like a lot of work. 37 37
And so function as a service eliminates 38 38
the need for me to do that. 39 39
Instead, I can write the code in something like Python 40 40
and then run it in this environment. 41 41
Now, when we talk about Serverless 42 42
you notice that keyword in this definition. 43 43
Serverless is a software architecture 44 44
that runs functions within virtualized runtime containers 45 45
in a cloud rather than on dedicated server instances. 46 46
So when you deal with Serverless, 47 47
everything in Serverless is developed as a function 48 48
or a microservice. 49 49
Remember, we talked about microservices all the way back 50 50
in the beginning of this section. 51 51
What did we say about microservices? 52 52
We want to be able to give it an input and get an output 53 53
and the service should do one thing and only one thing. 54 54
So you can design it, build it 55 55
and test it completely independently. 56 56
Now, who is using things like Serverless 57 57
and function as a service? 58 58
Do you know any big examples 59 59
or big companies out there doing this now? 60 60
Well, one of the biggest ones out there is Netflix. 61 61
That's right. 62 62
If you've watched any Netflix recently 63 63
you've been actually using Serverless. 64 64
Netflix delivers over 10 billion hours of video 65 65
to 125 million customers every quarter, 66 66
and they do this using Serverless. 67 67
They do this because they're able to serve 68 68
that large of an audience by using a wide range of highly 69 69
complex infrastructure that relies on AWS, 70 70
specifically its Serverless capability known as Lambda. 71 71
Now, all of this is done using this AWS Lambda 72 72
which is a Serverless environment. 73 73
Essentially, Amazon runs all these underlying servers 74 74
and Netflix doesn't have to worry about 'em at all. 75 75
All Netflix needs to do is know that 76 76
when they give them code that's written in Python 77 77
or some other language, Lambda can run it, 78 78
and they don't care about what that looks like 79 79
underneath that. 80 80
Now we're going to talk more about how this actually works, 81 81
but Netflix is using this AWS Lambda 82 82
to essentially build this rule-based self-managing 83 83
infrastructure that replaces a lot of the old 84 84
inefficient processes and it helps them reduce 85 85
the rate of errors and save them lots of time 86 86
and lots of money. 87 87
One of the great things about doing Serverless 88 88
is that it eliminates the need to manage physical 89 89
or virtual servers. 90 90
Instead, you just get the service you need 91 91
which is something that can run some kind of a language. 92 92
For instance, mine runs Python. 93 93
Now, when you do this 94 94
you're not paying for these servers all the time either. 95 95
You're only paying when they're executing. 96 96
So my particular automation only runs 97 97
once every couple hours, and when it does that, 98 98
it runs for maybe three to 30 seconds. 99 99
When I get a bill, it's for that three 100 100
to 30 second increment four times a day or six times a day, 101 101
or 12 times a day, or however often I do it. 102 102
And so the bill for this for us 103 103
is less than a dollar a month. 104 104
It is super cheap to use these things. 105 105
Now, Netflix's bill is a lot more money, 106 106
but again you're only paying for the time 107 107
that you're actually using processing. 108 108
And so this is a really great way to do things 109 109
and it can save you a lot of money. 110 110
Now, what are some real big benefits here? 111 111
Well, for one, there's no patching 'cause there's no server. 112 112
Two, there's no administration. 113 113
You don't have to administer a server 114 114
because it doesn't exist. 115 115
And three, there's no file system monitoring 116 116
because again there's no server. 117 117
You're just running code. 118 118
Now, the underlying architecture here 119 119
is going to be managed by your cloud service provider. 120 120
So if you're using AWS Lambda, 121 121
it's Jeff Bezos and his team at Amazon 122 122
who has to worry about the underlying architecture. 123 123
They pay for the network, they pay for the service, 124 124
they pay for the operating system, 125 125
they pay for the patching, they pay for all the security 126 126
and you just get to run your code. 127 127
That's the benefit of using something like Serverless. 128 128
Now, what is your job though 129 129
as a cybersecurity professional? 130 130
Because if we don't have to patch and we don't have to scan 131 131
and we don't have to operate in admin, what are we going to do? 132 132
Well, that's a really good question. 133 133
Our job here as cybersecurity analysts 134 134
inside of this world of function as a service 135 135
and Serverless, 136 136
is to ensure that the clients accessing the services 137 137
have not been compromised. 138 138
Now, I'm not talking here about your end user's workstation. 139 139
If you're Netflix, it's not your job to make sure 140 140
that my home computer is properly patched and updated 141 141
before I connect to your service. 142 142
Instead, I'm more concerned 143 143
with your developer's workstations 144 144
and their accounts because they're the ones 145 145
who are going to update the application code 146 146
that's creating these functions and services. 147 147
So if I'm a programmer for Netflix, 148 148
then you as a cyber security analyst need to make sure 149 149
that my workstation is properly secured, 150 150
that my credentials are properly secured, 151 151
that I write my code in a very secure way. 152 152
So a lot of our job as cybersecurity professionals 153 153
starts moving from the infrastructure side of things 154 154
into more of the code analysis side of things. 155 155
And that's why cybersecurity is such a broad field 156 156
because there's all these different areas 157 157
and that doesn't mean 158 158
that we're going to be Serverless tomorrow, 159 159
that all infrastructure's going to go away, because guess what? 160 160
Amazon still has the underlying servers 161 161
and so there is going to be some role for people to work at 162 162
Amazon and Google and Microsoft 163 163
to be able to run their programs 164 164
and make sure they're being done securely. 165 165
But when we talk about working for a company like Netflix, 166 166
their cybersecurity folks are much more focused 167 167
on looking at the code that their developers are making 168 168
to make sure it's secure, 169 169
to make sure their authentication systems are good, 170 170
their authorization systems are good, and things like that. 171 171
So when it comes up to the idea of function as a service 172 172
and Serverless, we really have to ask the question, 173 173
"Is it safe or is it risky?" 174 174
Well, with Serverless it does have some considerable risks 175 175
that you have to consider. 176 176
There are use cases and best practices 177 177
when you're dealing with traditional infrastructure, 178 178
but Serverless and function as a service 179 179
is still relatively new. 180 180
So you're kind of in uncharted territory here 181 181
and being a bit of an adventurer, 182 182
that in itself makes it a bit more risky 183 183
because we don't know the long-term implications of that. 184 184
We don't know all the best cases 185 185
and the best practices to use. 186 186
Now, another thing that's risky about this 187 187
is that you're fully dependent 188 188
on the underlying service provider. 189 189
So I keep saying Amazon is an example, 190 190
but Amazon is responsible for the dependency, the redundancy 191 191
and a lot of the security that underpin your services 192 192
and you're basically wishing all that away 193 193
and hoping they do a good job. 194 194
Now, that is one of those things that is a little bit more 195 195
risky because again, they haven't been doing this 196 196
for a long, long, long time. 197 197
They're good at what they do, and they do the best they can 198 198
to make sure everything's secure. 199 199
But is it a hundred percent secure and reliable? 200 200
Well, maybe, maybe not. 201 201
Is it better than what you could do yourself? 202 202
Well, maybe, maybe not. That depends. 203 203
Now, these are decisions that the CIO 204 204
and the CSO are going to make 205 205
and then you as an analyst are going to have to fall in line 206 206
and work through those decisions, right? 207 207
Because again, these are servers that you can't see, 208 208
you can't touch because you don't own them. 209 209
Amazon owns them. Microsoft owns them. 210 210
Google owns them, right? 211 211
You only have access to the code 212 212
that you're running on top of them. 213 213
Now, if you do decide to start working with Serverless 214 214
I want you to remember 215 215
that Serverless depends on orchestration. 216 216
It's all about automation and orchestration 217 217
and being able to spin up 218 218
and spin down resources very, very quickly. 219 219
Now, a lot of that is done for you 220 220
by the underlying services, but again, 221 221
your code might need to take that into account 222 222
as you're making those actions. 223 223
Because if you're going to be using application logs 224 224
just to be able to process an action or read or write things 225 225
to a database, or read or write a log transaction 226 226
or copy a file and deliver it to a user, 227 227
all of these are things that require automation 228 228
and connection between these different services 229 229
that you're dealing with inside of this Serverless 230 230
or function as a service perspective.