Build Better Defenses
October 29–30, 2017: Training
October 30–November 1, 2017: Tutorials & Conference
New York, NY

Going serverless: Security outside the box

Jack Naglieri (Airbnb), Austin Byers (Airbnb)
2:10pm–2:50pm Wednesday, November 1, 2017
Tools and processes
Location: Sutton South

Who is this presentation for?

  • Engineers, managers, analysts, or anyone interested in serverless cloud solutions

Prerequisite knowledge

  • Basic familiarity with Amazon Web Services (AWS)

What you'll learn

  • Understand the changing landscape of security tools
  • Learn how to leverage serverless designs for your own security tooling

Description

Finding an attacker’s needle in an enterprise haystack is a daunting challenge that traditionally requires a large and highly specialized security team. Endpoints, networks, and applications must be instrumented, logs must be analyzed, alerts must be triaged, and all of the supporting infrastructure must be deployed and maintained. But how can you empower security teams to build and utilize complex infrastructure without a large team?

Fortunately, with the growing popularity of cloud platforms (Amazon Web Services, Google Cloud, and others), security teams can now take advantage of the serverless application model to build capabilities such as intrusion detection and static analysis without maintaining a single server. Serverless microservices also include the benefits of low operational overhead and built-in security and scalability.

Drawing on their real-world experiences, Jack Naglieri and Austin Byers explore tools and techniques for successfully building, deploying, and debugging serverless security applications. Jack and Austin walk you through tried-and-true techniques with AWS serverless offerings to create an extensible security services ecosystem, all while keeping a low cost. Along the way, they discuss serverless application development, design patterns, monitoring, reliability, interservice communication, and more and tie everything together with the concept of infrastructure as code, teaching you how to create and deploy fully managed and reproducible security service within minutes.

Photo of Jack Naglieri

Jack Naglieri

Airbnb

Jack Naglieri is a security engineer at Airbnb. Jack has a passion for DevOps, security, and infrastructure. His exposure to information security began as an incident responder for Verisign. He spent several years at Yahoo as an incident responder before transitioning into a security engineering role, where he focused on deploying security monitoring tools at scale. Jack is the principal engineer on StreamAlert, a framework that enables serverless, real-time data analysis at scale. He holds a degree from George Mason University.

Photo of Austin Byers

Austin Byers

Airbnb

Austin Byers is a software engineer on the security team at Airbnb, where he contributes to Airbnb’s encryption services and incident response tools, including Cipher and StreamAlert, respectively. Most recently, he designed and implemented YARA as a service (YaaS), a soon-to-be open-sourced serverless binary analysis pipeline. Austin was the first security graduate from the University of Chicago computer science program, where his research focused on building a foundation for client-side web transparency by classifying JavaScript changes according to the scope of their impact.