This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Serverless Top 10 Project"
| Line 31: | Line 31: | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" | | | valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" | | ||
| Line 85: | Line 78: | ||
= Acknowledgments = | = Acknowledgments = | ||
| + | |||
| + | ==Project Sponsors== | ||
| + | The OWASP Serverless Top 10 project is sponsored by | ||
| + | |||
| + | {{MemberLinks|link=https://www.protego.io|logo=Protego logo 300x75.png}} | ||
| + | |||
| + | and | ||
| + | |||
| + | [[File:PureSec-Logo.png|frameless|link=https://www.puresec.io/]] | ||
| + | |||
| + | ==First Report Reviewers== | ||
Assaf Hefetz, Snyk | Assaf Hefetz, Snyk | ||
| − | |||
Erez Metula, AppSec Labs | Erez Metula, AppSec Labs | ||
| − | |||
Erez Yalon, Checkmarx | Erez Yalon, Checkmarx | ||
| − | |||
Frank M. Catucci, OWASP | Frank M. Catucci, OWASP | ||
| − | |||
Guy Bernhart-Magen, Intel | Guy Bernhart-Magen, Intel | ||
| − | |||
Hemed Gur Ary, OWASP | Hemed Gur Ary, OWASP | ||
| − | |||
Jeff Williams, Contrast Security | Jeff Williams, Contrast Security | ||
| − | |||
Jim DelGrosso, Synopsys | Jim DelGrosso, Synopsys | ||
| − | |||
Jochanan Sommerfeld, RDuck | Jochanan Sommerfeld, RDuck | ||
| − | |||
Kobi Lechner, INFINIDAT | Kobi Lechner, INFINIDAT | ||
| − | |||
Limor Sylvie Kessem, IBM | Limor Sylvie Kessem, IBM | ||
| − | |||
Marcin Hoppe, Auth0 | Marcin Hoppe, Auth0 | ||
| − | |||
Mark Johnston, Google | Mark Johnston, Google | ||
| − | |||
Martin Knobloch, OWASP | Martin Knobloch, OWASP | ||
| − | |||
Matthew Henderson, Microsoft | Matthew Henderson, Microsoft | ||
| − | |||
Matteo Meucci, Minded Security | Matteo Meucci, Minded Security | ||
| − | |||
Owen Pendlebury, OWASP | Owen Pendlebury, OWASP | ||
| − | |||
Paco Hope, AWS | Paco Hope, AWS | ||
| − | |||
Patrick Laverty, Rapid7 | Patrick Laverty, Rapid7 | ||
| − | |||
Rupack Ganguly, Serverless Inc. | Rupack Ganguly, Serverless Inc. | ||
| − | |||
Tanya Janca, Microsoft | Tanya Janca, Microsoft | ||
| − | |||
Tash Norris, Capital One | Tash Norris, Capital One | ||
| − | |||
Tom Brennan, IOActive | Tom Brennan, IOActive | ||
| − | |||
Yan Cui, DAZN | Yan Cui, DAZN | ||
| − | |||
Youssef Elmalty, AWS | Youssef Elmalty, AWS | ||
Revision as of 15:02, 19 November 2018
OWASP Serverless Top 10 - First ReleasedThe OWASP Top 10: Serverless Interpretation is now available. IntroductionWhen adopting serverless technology, we eliminate the need to develop a server to manage our application. By doing so, we also pass some of the security threats to the infrastructure provider such as AWS, Azure and Google Cloud. In addition to the many advantages of serverless application development, such as cost and scalability, some security aspects are also handed to our service provider. Serverless services run code without provisioning or managing servers and the code is executed only when needed. However, even if these applications are running without a managed server, they still execute code. If this code is written in an insecure manner, it can still be vulnerable to application-level attacks. The first report will examine the differences in attack vectors, security weaknesses, and the business impact of application attacks on in the serverless world, and, most importantly, the report will suggest ways to to prevent them. As we will be able to see in the report, attack and defense techniques are different from what we used to in the traditional application world. After that, an open-call will be established to collect data in the wild and establishing the official Serverless Top 10 Report.
PurposeOWASP Serverless Top 10 aims at educating practitioners and organizations about the consequences of the most common serverless application security vulnerabilities, as well as providing basic techniques to identify and protect against them.
LicensingThe OWASP Serverless Top 10 is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 4.0 license (CC BY-SA 4.0).
|
Quick DownloadsOWASP Top 10: Serverless Interpretation PresentationSoon!
News & Events
Project LeaderRelated Projects
Classifications
| |||||||
