Download ebooks file Serverless Security: Understand, Assess, and Implement Secure and Reliable Applications in AWS, Microsoft Azure, and Google Cloud Miguel A. Calles all chapters
Download ebooks file Serverless Security: Understand, Assess, and Implement Secure and Reliable Applications in AWS, Microsoft Azure, and Google Cloud Miguel A. Calles all chapters
com
https://textbookfull.com/product/serverless-security-
understand-assess-and-implement-secure-and-reliable-
applications-in-aws-microsoft-azure-and-google-cloud-miguel-
a-calles/
OR CLICK BUTTON
DOWNLOAD NOW
https://textbookfull.com/product/biota-grow-2c-gather-2c-cook-loucas/
textboxfull.com
https://textbookfull.com/product/beginning-mlops-with-mlflow-deploy-
models-in-aws-sagemaker-google-cloud-and-microsoft-azure-sridhar-alla/
textboxfull.com
Miguel A. Calles
Serverless Security: Understand, Assess, and Implement Secure and Reliable
Applications in AWS, Microsoft Azure, and Google Cloud
Miguel A. Calles
La Habra, CA, USA
Introduction�����������������������������������������������������������������������������������������������������������xvii
iii
Table of Contents
iv
Table of Contents
Key Takeaways���������������������������������������������������������������������������������������������������������������������������� 63
Notes������������������������������������������������������������������������������������������������������������������������������������������� 64
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
AWS������������������������������������������������������������������������������������������������������������������������������������� 309
Azure����������������������������������������������������������������������������������������������������������������������������������� 310
Google Cloud����������������������������������������������������������������������������������������������������������������������� 311
Key Takeaways�������������������������������������������������������������������������������������������������������������������������� 312
viii
Table of Contents
Index��������������������������������������������������������������������������������������������������������������������� 339
ix
About the Author
Miguel A. Calles is a certified Cybersecurity engineer, works on cloud computing
projects, and writes about Cybersecurity. He has worked on multiple serverless projects
as a developer and security engineer, contributed to open source serverless projects,
and worked on large military systems in various engineering roles. He started in
Cybersecurity in 2016 for a US government contract, has been doing technical writing
since 2007, and has worked in multiple engineering roles since 2004. Miguel started to
gain interest in Cybersecurity when he was in middle school and was trying to reverse
engineer websites.
Miguel is a Principal Solutions and Security Engineer at VeriToll, LLC. He has a
Bachelor of Science degree in Material Science and Engineering from the Massachusetts
Institute of Technology, a Master of Business Administrator degree from the University of
Florida, a Cloud Security Alliance’s Certificate of Cloud Security Knowledge certification,
and a CompTIA A+ certification.
xi
About the Technical Reviewer
David A. Gershman is a Cybersecurity engineer for a government contractor and has
the CISSP certification. He has also taught Computer Science at California Polytechnic
University, Pomona, on topics ranging from introduction programming to computer
networking and Cybersecurity for over 20 years. In his spare time, David enjoys restoring
and programming retro 8-bit computers.
xiii
Acknowledgments
I would like to express thanks to the following persons and organizations:
• Guise Bule for inviting me to join Secjuice (a blog site that promotes
writing about Cybersecurity and information security), where I first
started writing about Cybersecurity and serverless computing topics.
• David Huang from Paradigm Sift for his friendship since my college
days and helping me troubleshoot a topic in Chapter 8.
• Last but not least, my Creator for helping me achieve a life goal and
His provision.
xv
Introduction
When I started working with the Serverless Framework, I was curious about the security
aspect. I was transitioning to a project for a mobile app with a serverless back end.
Previously, I was an information assurance (IA) engineer working on Cybersecurity
for US Government military systems. I had become accustomed to using well-defined
processes and requirements in my role as an IA engineer. The systems we were securing
were part of a vast network of other systems with strict IA requirements. The threats
seemed limited; and implementing Cybersecurity, in many cases, was following a list of
checklists and requirements. But, Cybersecurity in the world of serverless development
was a new frontier.
The more I worked with serverless, the more I wondered about its Cybersecurity.
Cybersecurity with serverless projects seemed to lack the oversight that I experienced
in the IA world. The team could release a serverless application without addressing
security. I searched for serverless security and found limited information. I did find
some helpful documents on the top serverless security risks and well-written blog posts
about specific topics. I was looking for a book that provided an overview of serverless
security and guidance on approaching it.
I decided to write this book with the intent to fill that void and provide a resource
that addressed multiple aspects of serverless security. I leveraged my IA and
Cybersecurity experience, my hands-on experience with serverless, and my research
to write this book. In one perspective, this book provides an overview of serverless
security. You could be new to serverless and learn how to approach serverless security
by performing a risk assessment. From another perspective, this book provides
practical ways to address serverless security. You could be looking for examples and
recommendations to implement in your serverless projects. I am excited to share this
book with you because I believe it will guide you in identifying areas of consideration
when securing your serverless application.
xvii
CHAPTER 1
Introduction to Cloud
Computing Security
In this chapter, we will review cloud computing and how its security evolved. We will
learn how serverless computing relates to cloud computing and how securing serverless
computing differs from the typical cloud computing Cybersecurity. We will review
Cybersecurity, how it applies to cloud computing, and why it is needed. This chapter will
set the foundation for Cybersecurity in serverless computing by putting it in the context
of cloud computing and its security.
1
© Miguel A. Calles 2020
M. Calles, Serverless Security, https://doi.org/10.1007/978-1-4842-6100-2_1
Chapter 1 Introduction to Cloud Computing Security
Application C C C C VR C
Data C C C C V C
Functions C C C VR V C
Runtime C C VR V V C
Security† C C VR V V C
Middleware C C VR V V C
Databases C C VR V V C
Operating Systems C C VR V V C
Containers C VR V V V C
Virtualization VR V V V V C
Servers/Workstations VR V V V V C
Storage VR V V V V C
Networking VR V V V V C
Data Centers V V V V V C
2
Chapter 1 Introduction to Cloud Computing Security
1
ocker is a registered trademark of Docker, Inc.
D
2
Kubernetes is a registered trademark of The Linux Foundation.
3
Chapter 1 Introduction to Cloud Computing Security
time needed to execute the functions without needing to maintain any supporting
software and hardware. The client is responsible for writing all the software functions
and defining the orchestration among them. The provider is responsible for properly
configuring and maintaining the infrastructure and platforms needed to execute the
functions. This type of cloud computing provides similar benefits as PaaS and CaaS
offerings, but without having to configure the platforms and containers, and enables the
client to develop a SaaS offering.
4
Chapter 1 Introduction to Cloud Computing Security
internal Internet). Ideally, the data is only accessible within the physical premises of
the enterprise for the highest Cybersecurity benefit; see Figure 1-1. An enterprise might
choose a private cloud to protect sensitive data.
A private cloud can have the lowest Cybersecurity risk, assuming proper
Cybersecurity measures are in place. The enterprise is mostly or entirely responsible
for the Cybersecurity risk. It, therefore, results in higher costs because it must procure,
configure, and maintain all the networking and computing equipment and configure
and maintain any Cybersecurity measures. The enterprise may favor the private cloud
because the higher costs might be lower than those of a Cybersecurity breach, and it has
greater control over the Cybersecurity measures.
5
Chapter 1 Introduction to Cloud Computing Security
A public cloud might have higher Cybersecurity risks because there is no direct
purview over the infrastructure and Cybersecurity measures. The provider and the
enterprise share the Cybersecurity risk. The enterprise must have the expertise to
adequately configure the cloud’s Cybersecurity measures and protect its data. The
enterprise might favor the shared Cybersecurity risk because it cannot afford to set up
and maintain a private cloud, lacks the expertise to secure a private cloud, or prefers
faster development and deployment.
6
Chapter 1 Introduction to Cloud Computing Security
The hybrid cloud might be the best of both worlds in some situations. Still, it
potentially has a higher Cybersecurity risk than a private cloud and not necessarily a
lower risk than a public cloud. We should use properly configured private cloud security
equipment (e.g., firewall systems, intrusion detection/prevention systems, and security
information and event management systems) to establish a connection between the
public and private clouds. The connectivity between the private and public clouds
presents an opportunity for the bypassing of security equipment and exposing the data
within the private cloud. The enterprise might favor the increased Cybersecurity risk
for several reasons: it wants to take advantage of features within the public cloud; it has
several layers of Cybersecurity measures to mitigate the risk of the external connection;
it has multiple private clouds; the public cloud only has access to a limited set of private
clouds.
7
Chapter 1 Introduction to Cloud Computing Security
Confidentiality
Applying confidentiality to a piece of data is giving access only to the intended recipients.
Said another way, confidentiality is preventing unauthorized access from unintended
recipients. A common term in recent news is “privacy.” An enterprise may choose to
implement confidentiality using encryption and access control.
Data has no encryption by default. Applying encryption to data prevents access to
it. The data is encrypted using a key, and only that key can decrypt the file to return it to
its original state. The key can be a password, file, or certificate. The encryption should
happen while the data is at rest (i.e., while it sits in the file system) or while it is in transit
(e.g., being transferred over the Internet).
Data has no access control by default, but modern operating systems do implement
some level of access control. Access control defines which data is accessible to others
and how that data is used. In an operating system that supports it, the access control
determines whether the current user can read, modify, or execute the data and also
defines whether other users can have similar privileges. It might also allow specifying a
subset of users that can read, modify, or execute the data.
FaaS solutions provide encryption and access control. The account owner needs to
enable shared access or public access; the account owner is the person or entity that
manages the account on the public cloud. The data owner can assign read, modify, and
8
Chapter 1 Introduction to Cloud Computing Security
delete privileges to the data; the data owner is the person or entity that manages the data
stores in the public cloud. The account owner is responsible for configuring the cloud
infrastructure to set the desired level of confidentiality. The cloud infrastructure provides
encryption for data in transit, data at rest, and access control to the data owner and
others. The provider’s cloud infrastructure only gives the account owner access to the
data. Cloud infrastructure supports encryption in transit and at rest.
Integrity
Ensuring integrity for a piece of data is giving confidence the data someone sent you
is the same data you received. Said another way, integrity is making sure there are no
unintended modifications to the data, and the intended recipient has trust they received
the expected data. The enterprise may choose to implement integrity using checksums,
version control, or logging.
A checksum is a representation of the data and is used to determine whether the file
has changed since it was last accessed. For example, when a user creates a file, the system
records its checksum. When the user modifies the file, the checksum also changes. The
user or file system can use the checksum to determine whether the file has changed.
Whenever a user creates, modifies, or deletes a file, a version control system or a
logging system captures the change. The version control system saves a copy of the file
for each version (and sometimes a checksum). In contrast, a logging system records the
type of change, the user who invoked the change, the time the change occurred, and
other relevant information.
FaaS solutions provide integrity solutions natively and as an add-on feature. The
account owner is responsible for configuring the cloud infrastructure to set the desired
level of integrity. The owner can also enable logging systems to capture changes to the
file and add checksums to the different versions of the data. The cloud infrastructure
supports version control of files. The cloud infrastructure natively does file replication at
the hardware level while maintaining the data integrity.
Availability
Providing availability for a piece of data is using measures to ensure intended recipients
can use the data. Said another way, availability is making sure the intended recipient
can access the data at any time. The enterprise may increase availability through
maintenance, replication, and redundancy.
9
Chapter 1 Introduction to Cloud Computing Security
Performing maintenance ensures the hardware hosting the data continues operating
as long as possible without interruption. For example, if a user stores a piece of data on
one piece of equipment, and it stops functioning, that data is no longer available for
a user to access. Had that unit been adequately maintained, it could have continued
operating longer, or the maintainer could have observed symptoms of imminent failure.
Therefore, it is essential to maintain hardware to keep it running to increase availability.
Replication and redundancy create replicas of data on other pieces of hardware. For
example, in the event one unit fails, others make the data available for a user to access.
An enterprise will use hardware components (e.g., Redundant Arrays of Independent
Disks, or RAIDs) to provide local, built-in redundancy and data backup software to
achieve geographical (offsite) redundancy.
FaaS solutions provide availability natively when storing data in the public cloud,
which has a minimum level of guaranteed availability. The account owner is responsible
for selecting a cloud infrastructure with the desired minimum availability and
configuring any additional availability features. For increased availability, the data owner
can choose to replicate the data across multiple geographic locations within the public
cloud infrastructure. Using cloud infrastructure eliminates the need to perform routine
hardware maintenance. However, regular checks of the account configuration and data
access are still warranted.
Examples of Threats
Threats exist in the three cloud computing models and manifest themselves in several
ways. We will explore a few examples of how threats manifest.
10
Chapter 1 Introduction to Cloud Computing Security
3
“ 100GB of secret NSA data found on unsecured AWS S3 bucket. 29 November 2017. Adam Shepard.
IT Pro. www.itpro.co.uk/security/30060/100gb-of-secret-nsa-data-found-on-unsecured-
aws-s3-bucket
4
“What Retailers Need to Learn from the Target Breach to Protect against Similar Attacks.”
January 31, 2014. Chris Poulin. Security Intelligence. https://securityintelligence.com/
target-breach-protect-against-similar-attacks-retailers
11
Chapter 1 Introduction to Cloud Computing Security
application takes a significant time to process the entire data or eventually times out.5
If thousands or millions of requests are sent simultaneously to a vulnerable software
function, the application may stop responding for all users and result in a DoS to the
user base.
I dentifying Threats
The three previous examples illustrate the realization of threats. Your understanding of
the threats to your application will help you determine how to protect against them. We
will explore how to identify threats in the next chapter.
K
ey Takeaways
In this chapter, we reviewed cloud computing and Cybersecurity. This chapter aimed
to provide a foundation for the remainder of this book. We established concepts and
terminology in cloud computing. We will briefly review these concepts and terms.
We explored cloud computing service models:
We covered cloud computing deployment models and how FaaS supports them:
5
“ Serverless Security & The Weakest Link (Avoiding App DoS).” 8 February 2019. Ory Segal.
PureSec Blog. www.puresec.io/blog/serverless-security-and-the-weakest-link-or-how-
not-to-get-nuked-by-app-dos
12
Chapter 1 Introduction to Cloud Computing Security
13
CHAPTER 2
Performing a Risk
Assessment
In this chapter, we will learn how to perform a risk assessment for a serverless
application. We will explore how to understand how the application works, which
includes reviewing documentation, source code, and system accounts and using the
application. We will discuss why we scope the risk assessment. We will learn how to
develop a threat model and how to use it to start creating the risk assessment.
C
onventions
We will review the conventions used throughout this book. For clarity, we will use one
example application throughout. We might deviate from this example application
at times when it makes sense to explain a concept better. We will use one FaaS
framework (or typically referred to as a serverless framework) for consistency, except
where it lacks support for a security configuration we are learning or when we can
better learn a principle by directly modifying the configuration. For simplicity, we will
use one programming language in the examples because it may become overwhelming
to cover the same principle in all programming languages supported by the serverless
provider and framework. The goal is to ensure an optimal experience in learning security
concepts with less focus on prescriptive approaches for implementing them.
15
© Miguel A. Calles 2020
M. Calles, Serverless Security, https://doi.org/10.1007/978-1-4842-6100-2_2
Chapter 2 Performing a Risk Assessment
The serverless framework will create the API. The serverless application will integrate
with other third-party services, which provide additional capabilities. The examples and
exercises reference this fictitious application but do not provide a fully functioning system.
S
erverless Frameworks
The three major FaaS and serverless providers are Amazon Web Services (AWS),
Microsoft Azure,1 and Google Cloud.2 You can manually set up functions using their
web-based consoles. You can choose an automated way to deploy the functions by
leveraging FaaS or serverless frameworks. There are several serverless frameworks,
which support different programming languages and multiple providers. We will focus
on a framework that supports AWS, Azure, and Google Cloud.
We will use the Serverless Framework3 in this book, not to be confused with the term
“serverless framework.” Serverless, Inc. created a serverless framework that supports
AWS, Azure, Google Cloud, and other serverless providers. The Serverless Framework
is written in Node.js4 JavaScript and has open source and paid versions. At the time
of this writing, the open source project has over 30,000 stars, forked over 3000 times,
and is actively maintained.5 For these reasons, we will use the Serverless Framework
throughout this book.
P
rogramming Language
The Serverless Framework was built using Node.js and exists as a package in the npm6
package manager. npm is arguably the fastest growing package repository with at least
one million packages at the time of this writing.7 The popularity is probably a result of
JavaScript being one of the easiest programming languages to learn.8 We will use Node.js
1
zure is a registered trademark of Microsoft Corporation.
A
2
Google and Google Cloud are registered trademarks of Google LLC.
3
Serverless Framework is a registered trademark of Serverless, Inc.
4
Node.js is a trademark of Joyent, Inc.
5
Serverless GitHub repository. https://github.com/serverless/serverless
6
npm is a registered trademark of npm, Inc.
7
Module Counts website. www.modulecounts.com
8
“The 10 easiest programming languages to learn.” 17 July, 2017. Alison DeNisco Rayome.
TechRepublic. www.techrepublic.com/article/the-10-easiest-programming-languages-
to-learn
16
Another Random Scribd Document
with Unrelated Content
Montoro de Diego looked at his informant with a startled
countenance, and then suddenly bent his eyes upon the ground as
though he expected to see the 'brothers' blood' crying for vengeance
from the soil.
"It is no good," he exclaimed at last. "I will stay in this accursed place
no longer. To my restlessness I might have opposed a sense of duty;
but to fight any longer against my miserable disgust at the scenes
around me is beyond my strength."
The bishop mused awhile before replying slowly,—
"And yet, good example is valuable."
"Elsewhere it may be, but not here," returned Diego hastily. "Else,
Riverenza, must your own bright example long since have turned
devils into saints, murderers into good Samaritans. What good did
your example do, even in the matter of the repartimientos? Did your
giving up your share of these unjustly and basely-enslaved creatures
serve any other purpose than that of impoverishing one who ever
uses his wealth for the relief of suffering? Nay, further, your good
example on this accursed island worked actually on the side of evil."
"How so?" asked Las Casas. But he looked as though he knew the
answer, even before his companion said heavily,—
"Even we reaped some miserable advantage at 'Palmyra' from your
renunciation. Some half-dozen poor creatures who had thriven under
your mild rule were made over to us to die. But see," Montoro
suddenly exclaimed, interrupting himself and springing to his feet,
"the day is passing, and I should have been in San Domingo hours
ago. I started early enough, but some suspicion that I was leaving
mischief behind me brought me back, and now poor Don is dead."
It was only a dog that was dead, but that dog was Don—the dog on
whose head his mother's tears had fallen—the dog for whose sake
he had once endangered his own life; and with these thoughts
suddenly recalled to his mind, Montoro de Diego was glad to beat a
hasty retreat from further observation.
Las Casas remained deep in earnest ponderings long after his friend
had left him, for he too had begun to think that it was vain to continue
his efforts of philanthropy any longer on the island of Hispaniola, and
that he would do wisely to exert his influence as protector of the
Indians in new fields, less overcrowded with the refuse population of
his own country.
Meantime Montoro reached the town, and was instantly accosted by
a young man of about his own age, and tall, bright, and handsome
as himself, but with a dash of off-hand daring about his person and
manner instead of Montoro's lofty dignity.
"Diego!" he exclaimed, as soon as he caught sight of him, "you are
just the comrade I most desire in our coming campaign. Throw thy
paltry bales into the sea, man, and enrol thyself under our captain's
standard."
"But who then is thy captain?" asked Montoro with some interest,
"and what is this new campaign? Thou art ever mad, my Cortes,
upon some fresh undertaking."
The handsome young notary laughed.
"Better that than sticking to the same spot till thy feet bid fair to grow
to the soil, like thy money-grubber, Don Alonzo, yonder. But, I
warrant thee, this undertaking now on hand is no mere pastime for a
summer's evening. Our captain, Don Diego Velasquez, hath it in
commission to conquer an island, the island of Cuba."
"Ay, doubtless," returned Montoro bitterly. "And hath also leave and
licence, and perchance it may be even orders likewise, to kill off the
inhabitants there, like so many mosquitoes, as hath been done
here!"
The other shrugged his shoulders rather contemptuously.
"Verily, Diego, thou and our bishop yonder have been bitten by the
same dog. But to comfort thy heart, know that Bartholomew Las
Casas is to be invited to go with us to guard thy pets, lest one of us
should so much as slap one of their brats to still its overmuch
squalling at strange faces. So, what say'st thou now?"
Montoro's face cleared to a smile.
"This is what I say—that if Las Casas goes, then do I go also."
CHAPTER XIX.
THE WAY TO TREAT THE REDSKINS.
"Montoro! I say, Montoro, I have news for thee."
"Out with it then," came the answer from our friend, who was once
more engaged in his occupation of eight years before at Veragua.
Houses were built there for a colony that was never founded, and
now Montoro and his companions were building houses on the
island of Cuba, with a very fair prospect of inhabiting them.
Only one chief had offered any determined resistance to the
invaders, and even his followers were not numerous enough to
excite much anxiety. He had fled from his native land of Hispaniola to
escape the Spanish rule, and now he was brought to bay, and
compelled to make a final effort for independence. It had just been
decided to send out a party against him, strong enough, as
Velasquez put it, "To conquer the rebel once for all, and have done
with it."
"And I am to be one of the party," said Juan de Cabrera, excitedly.
"And if you choose you also are to have a hand in catching this
Hatuey, and helping to make him an example."
"He is that already," replied Montoro gravely. "Would that the poor
sheep, his countrymen, knew how to profit by it."
"By my faith," exclaimed Cabrera impatiently, "you are a queer
fellow, Diego. Wouldst thou then that these 'poor sheep,' who are as
a hundred to one of us, should know their strength, and shoot us
down like vermin in a barn?"
Montoro flung down the great wooden hammer with which he had
been driving stakes, and came forward, his face set with mingled
sternness and sorrow.
"Ay, truly, Juan de Cabrera, less would it shame me that the heathen
should thus treat us, than to know that we Christians have acted that
hideous part towards them. Hast thou heard of the late campaign in
Trinidad, where our countrymen have burnt alive in cold blood—to
save trouble!—nigh upon two hundred men and women, and
innocent babes scarcely more helpless than their kind and gentle-
natured fathers? How shall Spanish tears or Spanish blood, thinkest
thou, ever wash out that foul stain?"
Juan de Cabrera turned away for a moment, for he had no answer
ready. When he turned round again he said, with an assumption of
flippancy he was for once far from feeling,—
"Ah, well, I have not heard this shady tale before, and I don't
suppose that it has lost any of its shadows by coming through thy
lips. Doubtless it was but a toss up whether our brethren should be
killed, or should kill."
"Not so," said Montoro, sternly. "Juan Bono hath confessed, himself,
that the unhappy creatures whom he thus repaid had been as
fathers and mothers to him, and to all his party; but he had been sent
to make slaves, and he made them the more readily by burning part
of the population before resistance was dreamt of."
He stopped abruptly, and stooped to pick up his tool. Then once
more raising his eyes to his companion's face, he said slowly and
quietly—
"That is all; but a ghastly all; and I would to God that the heathen
had shot me ere I heard it."
There was a long silence after this ere Cabrera ventured once more
to ask—
"But, Diego, for all this thou wilt join us, wilt thou not? Even for the
sake of thine own feelings thou shouldst do so to help in the
promotion of fair play."
"If I were the Governor himself," said Montoro hastily, "I should exert
myself in vain for justice where this unfortunate Hatuey is concerned.
He has been as a king in his own land, and now we dare to proclaim
him a rebel because he proves himself a patriot, and in the face of
despair fights for his country and his people's liberty. No; I will have
nought to do with 'catching' this noble-hearted heathen Cacique, and
aiding to throw him into slavery."
Cabrera cast a keen, furtive glance at his companion at the
utterance of that last word. Evidently, although Diego had heard that
horrible Trinidad news, he had not yet heard of the doom
pronounced against the troublesomely desperate Cacique of
Hispaniola, when he should be once safely caught in the hands of
the Cuban governor. As for Don Juan de Cabrera, he had no
inclination to give the information. To turn the subject, he said after a
short pause—
"Well then, friend Diego, if thou comest not with us, what is it thou
hast a mind to? Something nobler, I trust, than wood-cutting, as
though thou wert born a boor in a German forest rather than a
Spanish nobleman."
"I feel little inclined to boast just now of my Spanish birthright, I can
tell thee," said Montoro heavily. "But to answer thy question—Ay; I
have other plans on hand than my present employment. I
accompany Las Casas on his progress of pacification through the
island, and we hope great things from our efforts, both for the natives
and the colony."
Cabrera's shoulders went up in a slight shrug, almost in spite of
himself.
"It is to be hoped that you and the clerigo have picked your
associates carefully for your peaceful expedition," he said, with a
touch of scorn. "Otherwise I fear me there may chance some rubs to
your tender consciences ere it is accomplished."
"Little danger," answered Montoro, confidently, adding with a smile,
"for we have, as you say, chosen our companions with due thought.
You see, we have not invited you."
Juan de Cabrera laughed.
"Thanks for the compliment, my friend. I would a hundred-fold rather
be found guilty of too much impetuosity, than of a calm, cold-blooded
calculation."
The smile died out of Montoro's face as he now exclaimed hotly—
"It is easy at all times for men to sneer at right and justice, and to
clothe evil with grand words. In Spain our impetuosity has been a
sword in the hand of honour; why is it here a weapon that would be
disdained even by the paid tool of an assassin? But there, Juan, I
but waste my breath on thee. This is no true impetuosity, no true
impulsive daring, that robs and massacres the harmless peoples of
these lands; but rather is it the base, despicable, grovelling fruit of
cold-blooded reckonings of ounces of gold against lives. By heaven,
I—"
"There, there, Toro," interrupted the light-hearted cavalier, with
unusual quietness of manner, "do not spend thy eloquence upon an
unworthy mortal like me. And for thy solace learn that, although
methinks thou and the clerigo draw the line too fine, I loathe some of
our doings out here well-nigh as greatly as thou canst do thyself. But
adios, for my party will be starting on the Hatuey hunt without me if I
do not hasten."
So saying, the gay adventurer departed with an air as jaunty as
though he were bound for one of the Court tournaments of Spain, to
be rewarded by winning kingly smiles and his lady's scarf. And
shortly after his friend Montoro de Diego, with Las Casas, departed
on their Cuban tour, accompanied by a number of armed followers,
who were intended, by their formidable appearance, to ensure
unbroken peace, not to win it after battle. But unhappily Juan de
Cabrera's prognostications proved truer than Diego's hopes.
"Well, comrade," said a soldier to a companion at the evening halt of
the first day's march; "well, comrade, thou hast then recovered
health and strength in time to have another try for fortune; at any rate
for such flimsy fragments as our present soft-hearted leaders will
permit us to accept. For my part, I had fain that I had been rather
sent off after the rebel Cacique. There will be more pickings to be
gathered up there I doubt, than we shall be able to find baskets for in
this direction. But as for saving souls—"
"As for saving souls," interrupted the man addressed in a deep,
fierce tone; "as for that matter, Guzman, we will save our own souls
by clearing God's earth of these vile, idol-serving vermin. Joshua
was sent forth of old, as Father Gonzalo saith, to rid the world of the
heathen, and so have we the like mission now. And for one Andrea
Botello will obey."
Guzman stared.
"My faith, Botello, let not the noble Señor Diego hear thee speak
thus, or thou wilt most assuredly get ordered back to the settlement
again!"
But Botello's eyes blazed with a yet fiercer fire, and his brow grew
blacker, as he muttered:
"Against those who have a mission from on high, man's orders avail
nought. The commands to slay and destroy, and leave not one
remaining, have come to me from authority, supreme e'en over the
Governor Velasquez himself. Speak not to me of orders!"
"Nay, then, that will I not," murmured Guzman to himself, as he went
off to more cheerful companions. "I will spend no more words on
thee, friend Botello," he continued in soliloquy, "so long as it appears
that the remnants of thy late fever are yet burning in thy veins. It
might chance thou wouldst find thou hadst an order to stick thy
poniard into me."
A few minutes later the prudent soldier was consulting with some
friends, whether a warning hint respecting Botello's aspirations
should not be given to their priest commander.
"But say, then," laughed another, "what need to trouble the good
clerigo for nought? What can one man's moody fancies do of harm,
with so many against him on the other side?"
"Umph, no," said another, somewhat less confidently; "if all the rest
are on the other side; but one fanatic can make an army of disciples,
if his feelings be but strong enough."
"Just so," was the off-hand reply. "If they be strong enough, but not if
they be the half-delirious fancies of a sick man, who ought still to be
in his bed at St. Jago yonder, instead of travelling with us. But come
on, let's hurry up to that party of redskins over there; they seem well
laden, and for my part I prefer to dine on their providing than on my
own, or that of our commanders. They treat us better."
The whole of the little expedition, including Las Casas and Montoro,
appeared to be of the same way of thinking, to judge by the way the
hospitable and kind-hearted Indians were soon surrounded. Whether
owing to the absence of newspapers and telegrams in those days, or
to the hopes of the poor inhabitants of the New World that kindness
would gain kindness, at any rate in their own case, cannot now be
said; but while the refugee Cacique, who had fled from the
barbarities of the Spaniards on his own island, was being hunted
down in one part of Cuba, in another the gentle, courteous natives
were treating their invaders with the most true-hearted friendliness.
"They must, verily, be worse than the tigers of the forests who harm
these simple creatures!" exclaimed Montoro one day, as a number of
Indians hastened to the new encampment with the farewell offerings
of fruit, rice, cooked food, and various little presents as tokens of
peace and good-will, accepting smiles for thanks with inborn
graciousness.
Las Casas smiled at his friend's ardour.
"I feel now," he said joyously, "that I can afford to smile, for all things
here are going forward as I would wish. The natives are learning that
there are at least some amongst the white men who have a
knowledge of right and wrong. And for these with us, Montoro,
thinkest thou not that they have begun to find it pleasant to continue
in well-doing, and to awaken smiles instead of tears? For myself, I
do hope so, I confess."
"And I," assented Montoro earnestly. "I do believe, my father, that thy
noble example has reaped at length the good fruit it has so long
merited."
The two friends passed on, nor marked a pallid-faced, fierce-eyed
man, who had stood near them, and now muttered between his
teeth, gazing after the clerigo:
"Tremble, thou Saul, who wouldst spare Agag, and the chief of the
spoil, when thou shouldst destroy! Guard thyself, lest the vengeance
that falls upon the enemies of the Cross encompass thee also, as
were meet."
CHAPTER XX.
THE MASSACRE AT CAONAO.
Some weeks had passed, and all had hitherto gone well, when one
day, on arriving at the suburbs of the native town of Caonao, Las
Casas announced it to be his intention to remain there two or three
days, making it the limit of his present expedition, and then to return
to the head-quarters of Velasquez, with the report of their doings and
adventures.
"Meantime," he said, with the cheerful good-humour proper to his
nature when at ease for others—"meantime we will make holiday for
the next forty-eight hours."
"And," said Diego smiling, "thanks to our good red brothers here, we
can also give our holiday its proper accompaniment of feasting."
"Just so," agreed Las Casas, with an answering smile. "I confess the
truth; it was the sight of the abundant supplies of all kinds with which
we are provided, that led me to resolve on marking this terminus of
our pleasant expedition with something of the nature of a festival.
Gather the men for me, Diego, some into the surrounding houses,
the remainder may well encamp out here in these gardens, fit for
Paradise itself."
"And for yourself, father?" asked Montoro. "Are you bent on other
explorations?"
"Not very distant ones," was the bright answer. "I am but about to
explore yon temple, and endeavour to use my stammering tongue
for God's glory with its inmates. They may now better believe, I trust,
that we come as bearers of a message of mercy."
"Truly I hope so," replied Montoro, as he nodded the brief adieu to
his friend, and then turned quickly to execute the duties committed to
him. In thus hastily turning, he almost knocked over a man who,
unobserved, had silently moved up close to the two chiefs of the
party, until he stood almost shoulder to shoulder with de Diego.
Diego was about to administer a sharp and haughty reproof to the
presumptuous intruder on the society of his superiors, but a second
look at his companion checked the words on his lips; and he stood a
listener instead of a speaker, as the man uttered, through drawn lips
that scarcely moved, a wild denunciation of the Amorites, the Hivites,
the Canaanites, the Hittites, the Perizzites, the Gergashites, and the
Jebusites.
Those who hear of the matter now may feel tempted to smile, but
there was no smile on the countenance of the young nobleman, no
feeling of mirth in his heart, as he stood facing the mad fanatic. The
man's eyes were fixed in a glassy stare that saw nought then visible;
and his eager, bloodthirsty curses against those he denounced as
the enemies of God, and of his Christ, made Montoro's blood run
cold.
"Friend," he began at last—"friend, rouse thyself. Recall thy
scattered thoughts. Those enemies of God's people, and daring
breakers of His laws, have perished for their iniquities more than two
thousand years ago. What priestly tales from the Holy Scriptures
have been startling thy ears of late?"
"He hath been ill, at death's door with malarious fever, but a few
days before joining this expedition, Señor," answered another of the
soldiers coming forward now, and hastily putting his hand on his
comrade's arm, as though to draw him away, but at the same time
with an air of secret warning which, at another time, would not have
escaped the keen eyes of the young officer. Now, however, Montoro
was anxious to get the clerigo's wishes carried out before his return
on the scene, and he was more intent on taking a view of the ground
around him, as to its capabilities for comfortable encampment, than
in noting the actions of individuals.
"See," he said kindly, but somewhat absently, "yonder come our kind
Indian friends with supplies of water; doubtless thy comrade is
suffering from thirst. Go forward with him, and see that his wants are
well attended to."
The man bowed, and quickly pulled his companion on to hinder the
word answer he seemed about to give.
"Thou art a very fool, Botello," he muttered angrily, when out of
earshot of Diego. "Of what good to rouse us up to help fulfil thy
purpose, when thy blabbing lips must go well-nigh to betray it, to the
one of all others most keen to hinder it. The clerigo hath some
thoughts to spare from his red lambs to his own comfortable living,
but this Señor Diego carrieth the vile heathen on his back to his own
greatest detriment. Verily, methinks he would far sooner have that
sword of thine pierce him than one of them."
Botello turned, with those dull-burning, sullen eyes of his fixed upon
his friend.
"If it is thus with him," he said between his clenched teeth, "then will
he receive due punishment in witnessing the slaughter of those he
thus dares to cherish. But come, the hour has arrived, and the
victims."
And suddenly, with a wild cry, he dashed forward towards a group of
some hundreds of defenceless Indians—men, women, and children
—laden with fruits, and jars of water for their Spanish guests.
Snatching his sword from its sheath it flashed for a few moments in
the sun, as he brandished it on high, and then, with a madman's
howl, he plunged it into the bodies of an infant and its mother who
was advancing with a timid smile to offer drink to the thirsty
travellers.
Tearing the reeking weapon from his first quivering victims he rushed
on over them, dealing death and wounds frantically around him. For
some moments he was alone in his dread activity. The Indians were
spellbound with the dismal horror. Even his own fellows were awe-
struck with the impetus of the hideous onslaught.
But quickly the scene changed. In his fatal career the wretched
madman cut down the beloved young squaw of a tall and unusually
powerful Indian, before he could fling himself before her as a cover.
Baffled of his loving effort he threw himself upon the Spaniard, utterly
regardless, in his despairing fury, of the blood-dripping sword.
Snapping it with his hands as though it had been a thread from his
native cotton plants, he tossed away the pieces, and then, with those
sinewy, disengaged fingers, throttled his antagonist, and cast the
dead body of the wretched Botello beside that of the murdered
Indian.
The red man's ferocious shout of triumph was the signal for
answering shouts of fury from the Spaniards. They had looked on
while innocent and gentle women and children were ruthlessly
slaughtered, but the sight of one of their own number slain was one
that aroused all their fiercest feelings of revenge, and ere it could be
well said that they had had time for thought swords and daggers
were flashing in the light, the fair, flower-bestrewn earth was
streaming with blood, and mangled bodies of dead and dying
creatures, some still clasping their simple offerings, that pleaded for
good-will, in their stiffening hands, were piled in awful heaps around
the camping ground.
To this drear, sickening sight Montoro de Diego rushed forward as he
saw the tumult that was raging. Guzman, one of the few who
remained faithful to his leader's trust in him, flew to the temple to
summon Las Casas. The redskins' friend was just issuing from the
building when his follower reached it, breathless with haste, pallid
with horror, and bespattered with gore from the pitiful victims who
had been falling in wholesale crowds around him. The countenance
of the clerigo turned pale also as he caught sight of the panting
soldier.
"What is it?" he exclaimed. "Our brethren—what of them? Is it a
massacre?"
Guzman nodded. He could not speak; one word he managed to
gasp out—"Go." For a massacre it was indeed, though not of the
nature imagined by Las Casas; not a massacre perpetrated by
ignorant heathen of those from whom they had scarce ever received
ought but wrong, but a massacre barbarously committed by
Christians on those from whom they had received nought but
kindness and submissive respect. But Las Casas waited not to learn
more from his breathless retainer. He saw the wild tumult surging in
the distance; he heard the confused roar of mingled shrieks, shouts,
yells, and groans; and whatever was going forward that concerned
his company his place was in their midst, to die with them if their
rescue were no longer possible.
In a moment of time this decision had darted through his brain, and
the next instant he was flying over the ground that intervened
between the temple of Caonao, and the open plain where the
deadliest of the uproar was in awful progress.
Two or three huts of less pretensions than the houses in the town
were scattered here and there. Close to the fighting, dying,
struggling multitudes stood one of these wooden buildings somewhat
larger than the rest. In it a number of the hospitable Indian women
had been gathered, a few minutes since, cooking and preparing food
for their cruel invaders. Now a panic-stricken, shrieking rabble of
both sexes and all ages was dashing into it, Indians pursued by
Spaniards—Indians, as Las Casas perceived at the first horror-
stricken glance, with nothing but crushed fruits and flowers in their
hands, or wounded infants moaning in their arms, Spaniards with
blood-dropping, crimsoned swords. Then he knew all. A groan of
bitterest anguish burst from his lips—
"Oh, my God!"
The words were a prayer, an abject prayer to the Most High for
mercy. Had the earth at that moment opened her black jaws and
swallowed up every Spaniard present, had fire from heaven licked
them up and carried them to hell, Las Casas would have felt no
wonder. He wondered more that an all-powerful God should spare.
One moment he gave to that groan, one moment to that prayer, and
then, throwing himself in the doorway of the hut, he dashed aside a
half-frenzied soldier who was entering in pursuit of the wretched
fugitives, and uttered a mighty, furious shout:
"Back, Spaniards, back, you dastardly mean hounds, every one of
you, or run your swords thus hallowed with the blood of the
innocents into your leader's body. I invite you to it, fiends every one
of you rather than men, that I may the more speedily close mine
eyes for ever on this scene fit only for the shades of hell."
Then he looked into the hut upon the huddled flock of trembling,
weeping, wounded human sheep. Some had climbed, for refuge
from their bloodthirsty pursuers, to the rafters of the roof, and hung
there, with their wild eyes gleaming, through their long black hair,
down upon events below, and their white teeth chattering for fear.
The sudden appearance of Las Casas upon the spot, and the
change of his usual mild demeanour to one of such haughty, biting
indignation, had created a temporary, rapid lull about the spot where
he stood. A permanent arrest of the massacre in that direction, he all
too fondly believed, and so he began to soothe and reassure the
poor creatures gathered together for death within the walls of that
humble little dwelling. Some few words of comfort in their own
language he knew, and spoke most eagerly, but the deep sympathy
of his countenance, his pitying eyes, spoke still more eloquently, and
above all, his fame had come before him even here, as a father and
friend of the helpless.
Gradually some put back the hair from their faces and ventured to
look around them, mothers loosened their convulsive grasp of their
children, and the climbers on the rafters swung themselves down to
the ground again. But even Las Casas could see that all was not yet
achieved for the restoration of peace. At a few hundred yards'
distance the horrible, shameful work of slaughter still continued, and
once more quitting the hut and its defenceless multitude,
Bartholomew Las Casas dashed onwards to repeat his efforts at
arresting the wholesale murder of defenceless men, helpless
women, the aged and the infant.
"Oh, Montoro!" he ejaculated as to himself, as he neared this fresh
scene of horror. "Alas! Montoro de Diego, where canst thou have
been to allow such things!"
A voice from beside his feet answered him—"I am here, my friend.
Disabled at the first moment. But do not heed me. Hasten to save
what poor remnant there may yet remain of these unhappy victims."
Las Casas looked at his half fainting friend, then at the dreadful
mêlée beyond, and with a hurried—"I will return immediately," he ran
on, and a second time hurled his furious commands at his followers
to cease their cowardly slaughter of their helpless prey.
A second time the leader's voice and the leader's presence cowed
the Spaniards back to order—momentarily. From the rear where the
hut lay there suddenly broke upon the air wilder shrieks and yells
than had been heard before. Deep oaths and curses of Spanish
throats were mingled with the shrill Indian cries, and off darted the
soldiers gathered about Las Casas to join their other comrades.
They were like so many score of bloodhounds, with the taste for
blood so aroused that it could no more be satisfied. Not again could
the friend of the Indians reach the doorway of that hut until it had
become a charnel-house, so crammed with the dead and dying, that
the stoutest heart might turn away from the ghastly task of learning if
there were yet any, amongst those heaps of mangled bodies, to
whom it might be possible to speak last words of pity.
There had been five hundred living human beings crowded into that
building when Las Casas left it ten minutes ago, now there lay there
five hundred mangled bodies lying in crimson pools, some already
stiff and stark, some writhing in the death agonies, none ever to see
the sun in this world again, or to learn on earth that the religion
called the Christian faith, which those white intruders came to
spread, was not the religion of a demon more vile than any their
untaught imaginings had ever dared portray.
A poor mother's despairing wail over her mortally wounded child,
had been the slight spark needed to rekindle the blind rage of the
Spanish soldiers. A soldier had held a crucifix before the infant's
dying eyes, and the mother, fearing fresh cruelties, had wildly
dashed it from the man's hand. That was more than provocation
enough for gold-seekers who salved their greed for wealth and fame
with the plea, that their journeyings were to widen the limits of
Christ's kingdom.
Scarcely had the crucifix fallen to the ground ere the murdered
woman fell beside it. Many a dead body had the man to move the
following day ere he recovered the treasured symbol of an immortal
love. All that night the leader of the expedition knelt, alone, in prayer.
All that night Montoro de Diego lay praying, faint and weak from loss
of blood, shed at the commencement of the hideous fray in the vain
effort to arrest the massacre. Never, so long as Montoro lived, did he
hear the name of the little town of Caonao without a shudder, never
did he remember the sounds of those women's wails, the sounds of
those children's cries of dying agony, without a moan escaping his
own lips, and a shivering horror overwhelming him that such things
should have been.
One day for a day of burial, and then, in a solemn hush as though a
funeral cortége, or a train of vanquished fugitives, the expedition
formed again for marching, and retraced its steps to St. Jago.
Montoro made one attempt to cheer his friend, but the soothing
words were hurriedly put aside.
"Nay, nay, Diego. Speak not to me of comfort in our shame and bitter
affliction. I came forth confident in my own strength, in my own
power to rule man and to guide those under me in the ways of
peace, and the Lord of Hosts has thus humbled my
presumptuousness in the dust. Speak not to me of comfort; there is
none save in prayer."
CHAPTER XXI.
THE PATRIOT CACIQUE HATUEY.
The march back to the Cuban seat of government was made more
rapidly than the march out had been. Then, all had been gaiety and
brightness. A band of picked men under a favourite and joyous-
natured leader, peace and good-will for their motto, and friendly
natives hovering ever around them as they journeyed, to turn each
day into one of pleasant feastings.
Now the leader had but stern, grief-stricken eyes to turn upon those
under his command, and the men walked on bowed with a sense of
well-merited disgrace. Few and far between were the offerings made
to them now, and those were bestowed with trembling hands, and
countenances marked by abject terror. None of the circumstances of
the homeward way tempted the explorers to linger.
But full as was the generous-hearted Montoro's cup of sorrow, it was
not yet so full but that it was to be called upon to hold more, even to
overflowing.
The shadows of the marching men were beginning to lengthen as
they moved along, as though the shades had learnt the art of
deception with each hour of the growing day, and wished to startle
the whole race of earth's crawlers, beetles, snakes, worms, and their
fellows, with the semblance of an oncoming race of giants. The air
was full of humming insects, quivering heat, and the rich scent of
leaves and flowers.
The Spaniards stepped onwards slowly. They were near the end of
their journey now, and their eyes were tired with gazing at that
"Landscape winking through the heat."
A hot shimmer over all things, such as Tennyson had never seen
when he wrote a line which almost makes one feel warm even on a
cold winter's day.
Montoro was feeling depressed and weary, and sentiments of
gladness and regret were pretty equally mingled in his breast as he
saw the various roofs close before him of the newly-founded town of
St. Jago. But personal sorrow cannot be indulged by leaders.
"Put your best feet forward, my friends," cried Bartholomew Las
Casas at this moment. However bitterly he might grieve over recent
occurrences, there was still sufficient of the spirit of the commander
in him to rebel against the notion of reappearing before Velasquez,
Cortes, and the rest of their fellow-adventurers, like a company of
whipped dogs; but he need not have troubled himself, for an event
was taking place at that hour in St. Jago that absorbed all interests.
Hatuey, the Cacique of Hispaniola—Hatuey, the noble, untutored
patriot—had been taken prisoner whilst fighting his last battles for
freedom and his country, and Hatuey was adjudged to suffer as a
rebel! He was to be made an example of, so the Governor declared
—to be the scarecrow to frighten all others of his race and the
surrounding nations from daring to perform one of the most sacred
duties of mankind. The Spaniards acknowledged it to be so for
themselves; but then—Hatuey was a heathen, and had refused to be
forced into Christianity at the point of the sword.
Las Casas, Montoro, and their followers were close to the town when
Montoro de Diego was suddenly almost thrown to the ground by an
Indian woman, who flung herself before him with a wild, heart-
rending cry, and clasped his knees convulsively.
Already Diego had become known on the island as a friend of the
friendless, an eager helper of the helpless, and this poor, despairing
creature had been on the look-out for him, during the past hours of
that day, with a gnawing agony of longing that had made the hours
seem like weeks. He was her last hope, and now, catching sight of
Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
textbookfull.com