Security best practices

When talking about security best practices, our ultimate goal should be to ensure that no unauthorized third-party has to access to any part of either our application or infrastructure that we do not want them to have.

For example, I would want an end user to be able to run a script that calls one of my serverless functions via an HTTP request made directly, by a webpage or mobile application. However, I would not want that same user to be able to access my Kubernetes dashboard, for example.

Now, this may seem like a pretty obvious example, but, as we have seen over the past few years, out-of-the-box configurations do not always have this most basic security requirement in mind. A good example of this is MongoDB.

Back in January, June, and September 2017, it was reported by several major news outlets that around 99,000 MongoDB installations were exposed to the internet; these installations were either unpatched or badly configured. This resulted in third parties accessing...