View source for OWASP Serverless Top 10 Project

<div style="width:100%;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
= Main =

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |

== Introduction ==

When adopting serverless technology, we eliminate the need to develop a server to manage our application. By doing so, we also pass some of the security threats to the infrastructure provider such as [https://aws.amazon.com/serverless/ AWS], [https://azure.microsoft.com/en-us/services/functions/ Azure] and [https://cloud.google.com/functions/ Google Cloud]. In addition to the many advantages of serverless application development, such as cost and scalability, some security aspects are also handed to our service provider. Serverless services run code without provisioning or managing servers and the code is executed only when needed.

However, even if these applications are running without a managed server, they still execute code. If this code is written in an insecure manner, it can still be vulnerable to application-level attacks. 

The first report will examine the differences in attack vectors, security weaknesses, and the business impact of application attacks on in the serverless world, and, most importantly, the report will suggest ways to to prevent them. As we will be able to see in the report, attack and defense techniques are different from what we used to in the traditional application world.

After that, an open-call will be established to collect data in the wild and establishing the official Serverless Top 10 Report.



==Purpose==

OWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.


== Licensing ==

The OWASP Serverless Top 10 is free to use. It is licensed under the [http://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 license] (CC BY-SA 4.0).



==Project Sponsors==
The OWASP Serverless Top 10 project is sponsored by

{{MemberLinks|link=https://www.protego.io|logo=Protego logo 300x75.png}}
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== Quick Downloads ==
[https://www.owasp.org/images/7/79/OWASP-Top-10-Serverless-Interpretation_%28en%29.pdf| OWASP Top 10: Serverless Interpretation]

== Presentation ==
Soon!


== News & Events ==
* [1 Sep 2018]: Hello World!
* [18 Sep 2018]: Join our [https://join.slack.com/t/owasp/shared_invite/enQtNDI5MzgxMDQ2MTAwLTEyNzIzYWQ2NDZiMGIwNmJhYzYxZDJiNTM0ZmZiZmJlY2EwZmMwYjAyNmJjNzQxNzMyMWY4OTk3ZTQ0MzFhMDY Slack-channel].
* [22 Sep 2018]: Follow our [https://github.com/OWASP/Serverless-Top-10-Project/ Git Repo].
* [25 Oct 2018]: [https://www.owasp.org/images/7/79/OWASP-Top-10-Serverless-Interpretation_%28en%29.pdf%7C '''First Release!''']

== Project Leader ==
[[User:Tal Mel|Tal Melamed]]

[[Coming soon!]]

[[Coming soon!]]

== Related Projects ==
[[:Category:OWASP Top Ten Project|OWASP Top 10 Project]]


==Classifications==

   {| width="300" cellpadding="2"
   |-
   | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
   | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]  
   |-
   | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=Defenders]]
   |-
   | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] 
   |-
   | colspan="2" align="center"  | [[File:Project_Type_Files_DOC.jpg|link=]]   
   |}

|}



= Acknowledgments =
Assaf Hefetz, Snyk

Erez Metula, AppSec Labs

Erez Yalon, Checkmarx

Frank M. Catucci, OWASP

Guy Bernhart-Magen, Intel

Hemed Gur Ary, OWASP

Jeff Williams, Contrast Security

Jim DelGrosso, Synopsys

Jochanan Sommerfeld, RDuck

Kobi Lechner, INFINIDAT

Limor Sylvie Kessem, IBM

Marcin Hoppe, Auth0

Mark Johnston, Google

Martin Knobloch, OWASP

Matthew Henderson, Microsoft

Matteo Meucci, Minded Security

Owen Pendlebury, OWASP

Paco Hope, AWS

Patrick Laverty, Rapid7

Rupack Ganguly, Serverless Inc.

Tanya Janca, Microsoft

Tash Norris, Capital One

Tom Brennan, IOActive

Yan Cui, DAZN 

Youssef Elmalty, AWS




= Project Resources =
== OWASP Serverless Top 10 - First Released ==
The [https://www.owasp.org/images/7/79/OWASP-Top-10-Serverless-Interpretation_%28en%29.pdf| OWASP Top 10: Serverless Interpretation] is now available.

[https://github.com/OWASP/Serverless-Top-10-Project/ GitHub repository]

= Roadmap =
{{:Projects/OWASP_Serverless_Top_10_Project/Roadmap}}







= Get involved =

Get involved in <strong> OWASP Serverless Top 10</strong>!

You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.

Possible ways to get contribute:
* We are actively looking for organizations and individuals that will provide vulnerability prevalence data. 
* Translation efforts (later stages)
* Assisting in the development of related tools (e.g. DVSA)

Individuals and organizations that will contribute to the project will listed on the acknowledgments page.

Also, join our [https://lists.owasp.org/mailman/listinfo/owasp-serverless-top-10-project mailing list] 

Slack Channel [https://join.slack.com/t/owasp/shared_invite/enQtNDI5MzgxMDQ2MTAwLTEyNzIzYWQ2NDZiMGIwNmJhYzYxZDJiNTM0ZmZiZmJlY2EwZmMwYjAyNmJjNzQxNzMyMWY4OTk3ZTQ0MzFhMDY invite]

GitHub [https://github.com/OWASP/Serverless-Top-10-Project/ project page]




=About=
<span style="color:#ff0000">
{{:OWASP_Serverless_Top_10_Project_About}}




__NOTOC__
<headertabs /> 

<br/>






[[Category:OWASP Project]]  
[[Category:OWASP_Builders]] 
[[Category:OWASP_Defenders]]  
[[Category:OWASP_Document]]