Serverless Security Top 10
summary
OWASP Serverless Top 10 presents concrete risks and countermeasures for AWS Lambda and similar platforms and contrasts them with traditional web threats. The talk shows a live demo: command injection to make S3 public and send phishing emails, cites that over 95 percent of functions are overprivileged, and names mitigations like Cognito for auth, KMS and secret managers for secrets, dependency scanning and CI checks, comprehensive logging, and enforcing least privilege. It also demonstrates automated scanning with Contrast and references the OWASP DVS8 tooling.
AI-written summary · about
chapters (16)
- 0:00Serverless security intro
- 1:28Serverless overview
- 3:37What is serverless
- 6:07Event injection
- 9:19Broken auth
- 11:45Data exposure risks
- 14:15Overprivileged functions
- 17:05Vulnerable dependencies
- 18:30Logging and monitoring
- 19:14Exploit demo
- 24:52Open resources
- 25:36Denial of Service vs Denial of Wallet
- 26:39Temp data leaks
- 27:24Secret management
- 28:09Security tools
- 29:11Conclusion
related talks
46mOWASP SERVERLESS TOP 10
33mServerless Security: New Risks Require New Approaches
57mServerless Security: Attack and Defense
40mServerless Architecture Security Patterns for Securing the Unseen
28mDefending Your Cloud Apps Against the Serverless Top 10
28mOWASP Serverless Top 10
50mAutomated Serverless Security Testing: Delivering secure apps continuously
18mA First Look at the Security of Serverless Applications