OWASP SERVERLESS TOP 10
summary
Clear, actionable takeaways: OWASP Serverless Top 10 lists concrete risks like event injection (e.g. command in an S3 filename) and shows a demo that steals Lambda environment variables, turning temporary creds into full account access; finds about 90% of functions overprivileged. Tools and fixes are real: use code-scan to generate least-privilege policies, scan dependencies, encrypt secrets with KMS, use Cognito/JWTs, delete /tmp, and run the open-source dvsa vulnerable app for hands-on testing.
AI-written summary · about
chapters (7)
- 0:00Start
- 11:39Event Injection
- 22:32Best Practices
- 24:45Broken Authentication
- 28:04Sensitive Data Exposure
- 31:07Over-Privileged Functions
- 42:43Insufficient Logging & Monitoring
related talks
30mServerless Security Top 10
28mOWASP Serverless Top 10
33mServerless Security: New Risks Require New Approaches
28mDefending Your Cloud Apps Against the Serverless Top 10
24mServerless security: how to protect what you don't see?
57mServerless Security: Attack and Defense
18mA First Look at the Security of Serverless Applications
50mAutomated Serverless Security Testing: Delivering secure apps continuously