1

Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.

Assuming that I have a fully "serverless" AWS environment consisting only of Lambdas and Fargate based ECS containers running HTTPS services, what benefit would I get from installing an IDS/IPS gateway?

3
  • ID/IP, presumably
    – user253751
    Mar 23, 2022 at 17:55
  • Please explain what you mean by "IDS/IPS gateway". Mar 23, 2022 at 18:08
  • Intrusion detection and prevention system. An example I know of would be setting up SNORT on a network gateway so that all traffic in/out of my VPC goes through SNORT.
    – Nir Levy
    Mar 24, 2022 at 8:45

1 Answer 1

1

Yes, an IDS/IPS is still beneficial in a serverless environment if you want to detect potential intrusion/misuse. I can't speak to SNORT or other 3rd party solutions because I haven't used them in the cloud. I have used AWS GuardDuty as an IDS solution.

There are other non-server related security interests that can occur such as S3 data exfiltration, account compromise, unusual network traffic volume, etc. that an IDS would alert on. It's important to pay attention to these as they could be indicators of a far worse situation.

In the end, it depends on your risk analysis and risk acceptance when making a decision if an IDS/IPS in a serverless environment provides a benefit.

References
GuardDuty FAQ's
GuardDuty Independent Security Review

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.