Automated Serverless Security Testing: Delivering secure apps continuously
summary
Claims a fully automated, frictionless serverless testing pipeline that discovers every cloud resource and maps flows, then runs targeted scans and can generate least-privilege IAM policies automatically. Demo shows a vulnerable Lambda exploited to exfiltrate a DynamoDB and to flip an S3 bucket public, proving the exploit and the mitigation. Notes scale problems—one customer reports millions of functions and industry prediction of 25% developer serverless adoption—and delivers continuous, in‑cloud scanning with no test scripts or pipeline delays.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:33Tals background
- 1:23About Serverless
- 1:49Cloud Native Transformation
- 2:44What is Cloud Native
- 5:10Security in Serverless
- 6:59Eventdriven architecture
- 9:09AWS Lambda environment
- 12:12Serverless security
- 14:20Application security landscape
- 20:12Demo
- 22:45Lost Perimeter
- 24:27Security Risks
- 31:19Security Scale
- 33:22Traditional Testing
- 34:20Traditional Problems
- 35:08Server Authentication
- 35:47Testing
- 36:32Infrastructure as Code
- 37:18AppSec Limitations
- 37:52SAS Limitations
- 39:03SAS Last Resort
- 39:50Cloud Monitoring
- 41:17Cloud Monitoring Example
- 43:44Top 10 Project
related talks
33mServerless Security: New Risks Require New Approaches
30mSecurity in the Serverless Environment
40mServerless Architecture Security Patterns for Securing the Unseen
30mServerless Security Top 10
29mPragmatic Security Automation and DevSecOps in the Cloud
24mServerless security: how to protect what you don't see?
14mDeveloping and deploying secure AWS Lambda applications
57mServerless Security: Attack and Defense