This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Serverless Top 10 Project"

From OWASP
Jump to: navigation, search
(test1)
(desc)
Line 7: Line 7:
 
== About ==
 
== About ==
  
−
<TDB>
+
When adopting serverless technology, we eliminate the need to develop a server to manage our application. By doing so, we also pass some of the security threats to the infrastructure provider such as AWS, Azure or Google Cloud. In addition to the many advantages of serverless application development, such as cost and scalability, some security aspects are also handed to our service provider, which can usually be trusted. Serverless services, like AWS Lambda, Azure Functions, Google Cloud Functions and IBM Cloud Functions, run code without provisioning or managing servers and the code is executed only when needed.
 +
 
 +
However, even if these applications are running without a managed server, they still execute code. If this code is written in an insecure manner, it can still be vulnerable to application-level attacks.
 +
 
 +
The OWASP Serverless Top 10 report will examine the differences in attack vectors, security weaknesses, and the business impact of application attacks on  in the serverless world, and, most importantly, the report will suggest ways to to prevent them. As we will be able to see in the report, attack and defense techniques are different from what we used to in the traditional application world.
 +
 
 +
 
  
 
==Purpose==
 
==Purpose==
−
 
+
OWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.
−
<TDB>
 
  
 
{{Template:PutInCategory}}
 
{{Template:PutInCategory}}
Line 117: Line 122:
 
= Get involved =
 
= Get involved =
  
−
There are many ways of getting involved in an OWASP Documentation projects.
+
Get involved in <strong> OWASP Serverless Top 10</strong>!
  
−
The first step would be to establish contact with the project leaders and/or the entire team. This can be done using a direct and private message, or by joining the public mailing list to say hello.
+
You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.
  
−
When it comes to participating in project activities, everything depends on the time you are willing and able to invest. It is however very important to not jump into too many things at the beginning, later having to back out or to let unfinished things behind you. It is much better to start with small tasks, increasing intensity and investment over time.  
+
Possible ways to get contribute:
 +
* We are actively looking for organizations and individuals that will provide vulnerability prevalence data.  
 +
* Translation efforts (later stages)
 +
* Assisting in the development of related tools (e.g. DVSA)
  
−
Please also be patient with expecting the "merge" of your work into the existing project pages and code. As everywhere in live, trust has to be built-up.
+
Individuals and organizations that will contribute to the project will listed on the acknowledgments page.
−
 
 
−
Most projects have multiple tasks open, which can be found on the specific project pages. Not all tasks require a wiki account. Please take something you are interested in and start participating.
 
−
 
 
−
Work load is not the only outcome when participating in open projects. You are getting a lot of things back: recognition, satisfaction, knowledge and contacts, sometime friends.
 
−
 
 
−
Sounds cool? Then jump in...
 
  
 +
Also, join our [https://lists.owasp.org/mailman/listinfo/owasp-serverless-top-10-project mailing list]
  
  
Line 188: Line 191:
 
{{MemberLinks|link=https://www.protego.io|logo=Protego_logo_black.png}}
 
{{MemberLinks|link=https://www.protego.io|logo=Protego_logo_black.png}}
  
−
 
−
 
−
==Getting Involved==
 
−
Get involved in <strong> OWASP Serverless Top 10</strong>!
 
−
 
−
You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.
 
−
 
−
Possible ways to get contribute:
 
−
* We are actively looking for organizations and individuals that will provide vulnerability prevalence data.
 
−
* Translation efforts (later stages)
 
−
* Assisting in the development of related tools (e.g. DVSA)
 
−
 
−
Individuals and organizations that will contribute to the project will listed on the acknowledgments page.
 
−
 
−
Also, join our [https://lists.owasp.org/mailman/listinfo/owasp-serverless-top-10-project mailing list]
 
  
 
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

Revision as of 19:55, 30 August 2018

OWASP Project Header.jpg

About

When adopting serverless technology, we eliminate the need to develop a server to manage our application. By doing so, we also pass some of the security threats to the infrastructure provider such as AWS, Azure or Google Cloud. In addition to the many advantages of serverless application development, such as cost and scalability, some security aspects are also handed to our service provider, which can usually be trusted. Serverless services, like AWS Lambda, Azure Functions, Google Cloud Functions and IBM Cloud Functions, run code without provisioning or managing servers and the code is executed only when needed.

However, even if these applications are running without a managed server, they still execute code. If this code is written in an insecure manner, it can still be vulnerable to application-level attacks.

The OWASP Serverless Top 10 report will examine the differences in attack vectors, security weaknesses, and the business impact of application attacks on in the serverless world, and, most importantly, the report will suggest ways to to prevent them. As we will be able to see in the report, attack and defense techniques are different from what we used to in the traditional application world.


Purpose

OWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.

How to add a new OWASP Serverless Top 10 Project article

You can follow the instructions to make a new OWASP Serverless Top 10 Project article. Please use the appropriate structure and follow the Tutorial. Be sure to paste the following at the end of your article to make it show up in the OWASP Serverless Top 10 Project category: 

[[Category:OWASP Serverless Top 10 Project]]

Licensing

The Documentation Project is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Team

The OWASP Team


Meta

Last Update: 12/2015


Other Resources

GitHub (OWASP)



Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg






<TBD>


Related Project Resources

<TDB>




Ongoing Operations

None.


Upcoming Operations

None.


Archived Operations

None at the moment.






Get involved in OWASP Serverless Top 10!

You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.

Possible ways to get contribute:

  • We are actively looking for organizations and individuals that will provide vulnerability prevalence data.
  • Translation efforts (later stages)
  • Assisting in the development of related tools (e.g. DVSA)

Individuals and organizations that will contribute to the project will listed on the acknowledgments page.

Also, join our mailing list





PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Serverless Top 10
Purpose: OWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.
License: CC BY-SA 4.0
who is working on this project?
Project Leader(s):
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases




OWASP Project Header.jpg

Project About

PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Serverless Top 10
Purpose: OWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.
License: CC BY-SA 4.0
who is working on this project?
Project Leader(s):
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases


Description

OWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.


Licensing

The OWASP Serverless Top 10 is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 4.0 license (CC BY-SA 4.0).


Roadmap

  • 30-SEP-2018: First draft is sent to reviewers
  • 25-OCT-2018: Initial report released
  • 01-APR-2019: Call for data opened
  • 31-JUL-2019: Processing data collected
  • 01-SEP-2019: Release Candidate is sent for review
  • 01-OCT-2019: Official release

We will need help along the way. Please contact Project Leaders to get involved.


Project Sponsors

The OWASP Serverless Top 10 project is sponsored by

Protego_logo_black.png       


Project Resources

Source Code

What's New (Revision History)

Documentation

Issue Tracker

Mailing List

Slide Presentation

Project Leader

Tal Melamed

Related Projects

OWASP Top 10 Project

Classifications

Project Type Files DOC.jpg
Incubator Project Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png


Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Serverless_Top_10_Project&oldid=243028"