Skip to content

Latest commit

 

History

History
75 lines (56 loc) · 11.2 KB

mitigations.md

File metadata and controls

75 lines (56 loc) · 11.2 KB

Mitigation Strategies Analysis for openfaas/faas

Mitigation Strategy: Implement Principle of Least Privilege for Function Permissions within OpenFaaS

  • Description:

    • Step 1: Identify the necessary actions each function needs to perform within the OpenFaaS environment and the underlying infrastructure (e.g., access to specific namespaces, Kubernetes resources, external services via the Gateway).
    • Step 2: Utilize OpenFaaS's built-in mechanisms or the underlying platform's Role-Based Access Control (RBAC) (like Kubernetes RBAC) to define granular roles. These roles should precisely limit function permissions to only what is required for their intended operation.
    • Step 3: Assign these roles to the service accounts associated with each function deployment in OpenFaaS. This can be done through OpenFaaS function deployment configurations or Kubernetes service account bindings.
    • Step 4: Regularly review and audit function permissions within OpenFaaS as application requirements change. Ensure that functions are not granted unnecessary privileges over time.
    • Step 5: Leverage OpenFaaS and Kubernetes tooling (e.g., faas-cli describe function, kubectl describe rolebinding) to verify the effective permissions assigned to functions.

  • Threats Mitigated:

    • Lateral Movement: If a function is compromised, attackers are restricted from accessing other functions or resources within the OpenFaaS environment or the underlying infrastructure due to limited permissions. - Severity: High
    • Data Breach: Limits the scope of data accessible if a function is compromised, as the function only has access to the data necessary for its specific task. - Severity: High
    • Privilege Escalation within OpenFaaS: Prevents functions from gaining elevated privileges within the OpenFaaS platform that could be exploited to compromise other functions or the platform itself. - Severity: Medium

  • Impact:

    • Lateral Movement: Significantly reduces risk by containing potential breaches within a single function's scope.
    • Data Breach: Moderately reduces risk by limiting the data exposure from a compromised function.
    • Privilege Escalation within OpenFaaS: Moderately reduces risk by preventing functions from gaining undue control over the OpenFaaS environment.

  • Currently Implemented: Partial - Kubernetes RBAC is enabled on the underlying cluster, which OpenFaaS leverages. However, fine-grained OpenFaaS specific roles and their consistent application to functions are not fully implemented.

  • Missing Implementation: Definition and enforcement of granular OpenFaaS function roles tailored to specific function needs. Automation of permission assignment and review within the OpenFaaS deployment process.

Mitigation Strategy: Secure the OpenFaaS API Gateway Configuration

  • Description:

    • Step 1: Enable and Enforce Authentication: Configure a robust authentication mechanism for the OpenFaaS Gateway API. Utilize OpenFaaS's built-in authentication options (e.g., Basic Auth, JWT) or integrate with external identity providers (e.g., OAuth 2.0, OpenID Connect) through OpenFaaS plugins or ingress controller configurations. Ensure authentication is mandatory for all Gateway API endpoints, including function invocation and management.
    • Step 2: Implement Rate Limiting at the Gateway: Configure rate limiting directly on the OpenFaaS Gateway or at the ingress controller level (e.g., using Nginx ingress annotations or dedicated rate limiting plugins). This restricts the number of requests allowed from a single source within a given timeframe, protecting against denial-of-service attacks targeting function invocation or the Gateway itself.
    • Step 3: Strictly Enforce HTTPS/TLS for Gateway Communication: Ensure the OpenFaaS Gateway is configured to exclusively use HTTPS/TLS for all communication. Properly configure TLS certificates for the Gateway's domain and enforce HTTPS redirection to prevent unencrypted connections. Verify TLS configuration using tools like testssl.sh.
    • Step 4: Network Segmentation for Gateway Access: Deploy the OpenFaaS Gateway within a secured network zone, limiting direct external access. Control network traffic flow to and from the Gateway using firewalls and network policies. Restrict access to the Gateway's management ports and interfaces to authorized networks and personnel only.
    • Step 5: Regularly Review and Update Gateway Configuration: Periodically review the OpenFaaS Gateway configuration, including authentication settings, rate limiting rules, and TLS configuration. Keep the Gateway component and any related ingress controllers updated to the latest versions and security patches provided by the OpenFaaS project and ingress controller maintainers.

  • Threats Mitigated:

    • Unauthorized Function Access via Gateway: Prevents unauthorized users from invoking functions through the OpenFaaS Gateway due to lack of authentication. - Severity: Critical
    • Denial of Service (DoS) Attacks on Gateway/Functions: Protects the Gateway and backend functions from being overwhelmed by excessive requests, leading to service disruption. - Severity: High
    • Man-in-the-Middle (MitM) Attacks on Gateway Traffic: Prevents eavesdropping and tampering of communication between clients and the OpenFaaS Gateway, protecting sensitive data in transit. - Severity: High
    • Unauthorized Access to OpenFaaS Management API: Secures access to sensitive management endpoints of the Gateway, preventing unauthorized function deployments, updates, or deletions. - Severity: High

  • Impact:

    • Unauthorized Function Access via Gateway: Significantly reduces risk by ensuring only authenticated and authorized requests can reach functions.
    • Denial of Service (DoS) Attacks on Gateway/Functions: Significantly reduces risk by mitigating the impact of DoS attacks and maintaining service availability.
    • Man-in-the-Middle (MitM) Attacks on Gateway Traffic: Significantly reduces risk by ensuring confidentiality and integrity of communication with the Gateway.
    • Unauthorized Access to OpenFaaS Management API: Significantly reduces risk by protecting the OpenFaaS platform's management functions from unauthorized manipulation.

  • Currently Implemented: Partial - HTTPS/TLS is enabled for the Gateway. Basic authentication is configured. Rate limiting and more advanced authorization mechanisms are not fully implemented. Network segmentation is partially in place.

  • Missing Implementation: Implementation of robust authorization policies beyond basic authentication, fine-grained rate limiting rules, stricter network segmentation for the Gateway, and automated configuration audits for the Gateway.

Mitigation Strategy: Harden the OpenFaaS Control Plane Components and their Configuration

  • Description:

    • Step 1: Regularly Update OpenFaaS Platform Components: Establish a documented process for regularly updating all OpenFaaS control plane components (Gateway, Function Watchdog, NATS, Prometheus, UI, etc.) to the latest stable versions and apply security patches promptly. Subscribe to OpenFaaS security advisories and monitor release notes for security updates.
    • Step 2: Secure Access to OpenFaaS Management Interfaces (UI & faas-cli): Restrict access to the OpenFaaS UI and faas-cli to authorized administrators only. Enforce strong authentication for these interfaces, ideally using multi-factor authentication (MFA). Limit network access to these interfaces to trusted networks.
    • Step 3: Implement Monitoring and Alerting for Control Plane Components: Configure comprehensive monitoring and logging for all OpenFaaS control plane components. Monitor component health, resource utilization, and error logs. Set up alerts for suspicious activity, errors, or performance degradation in control plane components. Integrate these logs and metrics into a centralized security information and event management (SIEM) system if available.
    • Step 4: Secure Configuration of OpenFaaS Components: Review and harden the configuration of all OpenFaaS components. Follow security best practices for each component, such as disabling unnecessary features, setting strong passwords or API keys where applicable, and limiting resource consumption. For example, secure the NATS messaging system used by OpenFaaS if applicable.
    • Step 5: Secure the Underlying Infrastructure Hosting OpenFaaS: Ensure the underlying infrastructure (Kubernetes cluster, VMs) hosting OpenFaaS is itself hardened and secured. This includes OS hardening, network security configurations, access control to the infrastructure, and regular security patching of the infrastructure.

  • Threats Mitigated:

    • Compromise of OpenFaaS Control Plane: Prevents attackers from gaining control of the OpenFaaS platform itself by exploiting vulnerabilities in control plane components or their configuration. - Severity: Critical
    • Platform Vulnerabilities Exploitation: Mitigates risks associated with known vulnerabilities in OpenFaaS components by ensuring timely updates and patching. - Severity: High
    • Unauthorized Platform Management Access: Prevents unauthorized users from managing or modifying the OpenFaaS platform, potentially leading to service disruption or security breaches. - Severity: High
    • Platform Instability and Reliability Issues: Monitoring and hardening improve the stability and reliability of the OpenFaaS platform, reducing the risk of service disruptions due to misconfigurations or component failures. - Severity: Medium

  • Impact:

    • Compromise of OpenFaaS Control Plane: Significantly reduces risk by making the platform more resilient to attacks and preventing platform-wide compromise.
    • Platform Vulnerabilities Exploitation: Significantly reduces risk by proactively addressing known vulnerabilities and minimizing the attack surface.
    • Unauthorized Platform Management Access: Significantly reduces risk by controlling access to sensitive management functions and preventing unauthorized modifications.
    • Platform Instability and Reliability Issues: Moderately reduces risk by improving platform stability and reducing the likelihood of security-impacting service disruptions.

  • Currently Implemented: Partial - OpenFaaS platform updates are performed periodically. Basic monitoring of some components is in place. Access to management interfaces is restricted to some extent. Comprehensive hardening and automated configuration checks are missing.

  • Missing Implementation: Formal and automated OpenFaaS platform update process, implementation of multi-factor authentication for management interfaces, enhanced monitoring and alerting for all control plane components integrated with a SIEM, comprehensive security hardening of all component configurations, and regular security audits of the OpenFaaS control plane and its infrastructure.