Defending Your Cloud Apps Against the Serverless Top 10
summary
Maps the OWASP Serverless Top 10 risks to concrete defenses and names the tools that find them: OWASP ZAP for API and web scans (including async gaps), dependency scans against NVD to catch outdated libraries, GitLeaks for secrets in git, Prowler with roughly 200 checks to scan AWS/Azure runtime misconfigurations, and IAM/Bridgecrew checks for least-privilege. Describes scheduled or event-driven scans, detection of exposed buckets/unencrypted at-rest data and CloudTrail gaps, and an implementation of security-as-code that automates config, runs scans and surfaces remediation steps.
AI-written summary · about
chapters (16)
- 0:00Securing serverless apps
- 1:39Common threats in cloud apps
- 4:11Shared responsibility in security
- 6:45OWASP Serverless Top 10
- 8:09Mitigating injection and third-party risks
- 9:59Authentication and identity threats
- 11:27Preventing access control leaks
- 12:53Security misconfiguration and monitoring
- 13:57Scanning dependencies and secrets
- 15:43Runtime misconfiguration tools
- 16:44Least privileged access with IAM
- 17:28Mapping threats to tools
- 21:45Securing code and resources
- 24:15Protecting data and monitoring
- 25:41Automating security with Jit
- 27:05Conclusion
related talks
46mOWASP SERVERLESS TOP 10
30mServerless Security Top 10
33mServerless Security: New Risks Require New Approaches
28mOWASP Serverless Top 10
50mAutomated Serverless Security Testing: Delivering secure apps continuously
59mSecuring the Digital Landscape: A Deep Dive into OWASP Top 10 for Applications, APIs, and LLMs
57mServerless Security: Attack and Defense
29mPragmatic Security Automation and DevSecOps in the Cloud