[38;5;12m                                                                      [39m[38;2;255;187;0m[1m[4m:lock: awesome-serverless-security [0m[38;5;14m[1m[4m![0m[38;2;255;187;0m[1m[4mAwesome[0m[38;5;14m[1m[4m (https://awesome.re/badge.svg)[0m[38;2;255;187;0m[1m[4m (https://awesome.re)[0m
[38;5;12mA curated list of awesome serverless security resources such as (e)books, articles, whitepapers, blogs and research papers.[39m

[38;2;255;187;0m[4mContents[0m
[38;5;12m- [39m[38;5;14m[1mAWS Lambda Security[0m[38;5;12m (#aws-lambda-security)[39m
[38;5;12m- [39m[38;5;14m[1mSecurity Tools / Solutions[0m[38;5;12m (#security-tools--solutions)[39m
[38;5;12m- [39m[38;5;14m[1mAzure Functions Security[0m[38;5;12m (#azure-functions-security)[39m
[38;5;12m- [39m[38;5;14m[1mGoogle Cloud Functions Security[0m[38;5;12m (#google-cloud-functions-security)[39m
[38;5;12m- [39m[38;5;14m[1mServerless Risks / General[0m[38;5;12m (#serverless-risks--general)[39m
[38;5;12m- [39m[38;5;14m[1mVulnerabilities, Weaknesses, CVEs[0m[38;5;12m (#vulnerabilities-weaknesses-cves)[39m
[38;5;12m- [39m[38;5;14m[1mGeneral Application Security Articles, Books[0m[38;5;12m (#general-application-security-articles-books)[39m
[38;5;12m- [39m[38;5;14m[1mAWS Lambda (General)[0m[38;5;12m (#aws-lambda-general)[39m
[38;5;12m- [39m[38;5;14m[1mOther Interesting Articles / Web Pages[0m[38;5;12m (#other-interesting-articles--web-pages)[39m
[38;2;255;187;0m[4mAWS Lambda Security[0m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAWS[0m[38;5;14m[1m [0m[38;5;14m[1mLambda[0m[38;5;14m[1m [0m[38;5;14m[1mSecurity[0m[38;5;14m[1m [0m[38;5;14m[1mBest-Practices[0m[38;5;14m[1m [0m[38;5;14m[1meBook[0m[38;5;12m [39m[38;5;12m(https://www.puresec.io/aws-lambda-security-best-practices)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mPDF[39m[38;5;12m [39m[38;5;12meBook[39m[38;5;12m [39m[38;5;12mcovering[39m[38;5;12m [39m[38;5;12mall[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mbasics[39m[38;5;12m [39m[38;5;12msuch[39m[38;5;12m [39m[38;5;12mas:[39m[38;5;12m [39m[38;5;12mServerless[39m[38;5;12m [39m[38;5;12mTop[39m[38;5;12m [39m[38;5;12m10,[39m[38;5;12m [39m[38;5;12mIAM[39m[38;5;12m [39m[38;5;12mroles[39m[38;5;12m [39m[38;5;12m&[39m[38;5;12m [39m[38;5;12mpermissions,[39m[38;5;12m [39m[38;5;12mCloudTrail,[39m[38;5;12m [39m[38;5;12mAWS[39m[38;5;12m [39m[38;5;12mConfig,[39m[38;5;12m [39m[38;5;12mAPI[39m[38;5;12m [39m[38;5;12mGateway[39m[38;5;12m [39m
[38;5;12msecurity.[39m[38;5;12m [39m
[38;5;12m- [39m[38;5;14m[1mFoundations of AWS Lambda Security[0m[38;5;12m (https://www.puresec.io/on-demand-foundations-of-aws-lambda-security) - Webinar recording covering AWS Lambda security basics, IAM permissions, Scalability, Governance. [39m
[38;5;12m- [39m[38;5;14m[1mAWS Lambda Security Quick-Start Guide[0m[38;5;12m (https://www.puresec.io/blog/aws-lambda-security-quick-guide) - A quick start guide portraying security strategies for AWS Lambda applications. [39m
[38;5;12m- [39m[38;5;14m[1mAWS Lambda Security - Design for Failure[0m[38;5;12m (https://www.puresec.io/blog/aws-security-best-practices-aws-lambda-security-design-for-failure) - Notes on the importance of IAM permissions for AWS Lambda. [39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAttacking[0m[38;5;14m[1m [0m[38;5;14m[1man[0m[38;5;14m[1m [0m[38;5;14m[1mAWS[0m[38;5;14m[1m [0m[38;5;14m[1mAccount[0m[38;5;14m[1m [0m[38;5;14m[1mvia[0m[38;5;14m[1m [0m[38;5;14m[1ma[0m[38;5;14m[1m [0m[38;5;14m[1mLambda[0m[38;5;14m[1m [0m[38;5;14m[1mFunction[0m[38;5;12m [39m[38;5;12m(https://www.darkreading.com/cloud/securing-serverless-attacking-an-aws-account-via-a-lambda-function/a/d-id/1333047)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mAn[39m[38;5;12m [39m[38;5;12marticle[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12mDarkReading,[39m[38;5;12m [39m[38;5;12mdescribing[39m[38;5;12m [39m[38;5;12mattackers[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mdefenders[39m[38;5;12m [39m
[38;5;12mside[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mreal[39m[38;5;12m [39m[38;5;12mserverless[39m[38;5;12m [39m[38;5;12mbounty[39m[38;5;12m [39m[38;5;12mhunt.[39m[38;5;12m [39m
[38;5;12m- [39m[38;5;14m[1mMinimizing the attack surface in Serverless[0m[38;5;12m (https://www.slideshare.net/avi_shulman/serverless-minimizing-the-attack-surface) - Presentation covering the basics of serverless attack surfaces. [39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mGone[0m[38;5;14m[1m [0m[38;5;14m[1min[0m[38;5;14m[1m [0m[38;5;14m[1m60[0m[38;5;14m[1m [0m[38;5;14m[1mmilliseconds:[0m[38;5;14m[1m [0m[38;5;14m[1mOffensive[0m[38;5;14m[1m [0m[38;5;14m[1msecurity[0m[38;5;14m[1m [0m[38;5;14m[1min[0m[38;5;14m[1m [0m[38;5;14m[1mthe[0m[38;5;14m[1m [0m[38;5;14m[1mserverless[0m[38;5;14m[1m [0m[38;5;14m[1mage[0m[38;5;12m [39m[38;5;12m(https://www.youtube.com/watch?v=byJBR16xUnc)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mA[39m[38;5;12m [39m[38;5;12mpresentation[39m[38;5;12m [39m[38;5;12mvideo[39m[38;5;12m [39m[38;5;12mshowing[39m[38;5;12m [39m[38;5;12mattack[39m[38;5;12m [39m[38;5;12mvectors[39m[38;5;12m [39m[38;5;12musing[39m[38;5;12m [39m[38;5;12mcloud[39m[38;5;12m [39m[38;5;12mevent[39m[38;5;12m [39m[38;5;12msources,[39m[38;5;12m [39m[38;5;12mexploitabilities[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mcommon[39m[38;5;12m [39m[38;5;12mserverless[39m[38;5;12m [39m[38;5;12mpatterns[39m[38;5;12m [39m
[38;5;12mand[39m[38;5;12m [39m[38;5;12mframeworks.[39m[38;5;12m [39m
[38;5;12m- [39m[38;5;14m[1mSecurity Best Practices for Serverless Applications[0m[38;5;12m (https://www.slideshare.net/AmazonWebServices/security-best-practices-for-serverless-applications-july-2017-aws-online-tech-talks) -  Basic best-practices for AWS Lambda. [39m
[38;5;12m- [39m[38;5;14m[1mAWS IAM best practices[0m[38;5;12m (https://www.slideshare.net/AmazonWebServices/sec305-iam-best-practices-aws-reinvent-2014) - Early AWS materials on IAM best practices. [39m
[38;5;12m- [39m[38;5;14m[1mThe Many-Faced Threats to the Serverless World[0m[38;5;12m (https://www.slideshare.net/theburningmonk/security-in-serverless-world-96644428) - An article covering most of the basic security risks.[39m
[38;5;12m- [39m[38;5;14m[1mHow to Encrypt Serverless Environment Variable Secrets with KMS[0m[38;5;12m (https://www.metaltoad.com/blog/how-to-encrypt-serverless-environment-variable-secrets-with-kms) - Fundamentals of secrets handling with AWS KMS. [39m
[38;5;12m- [39m[38;5;14m[1mSharing Secrets with AWS Lambda Using AWS Systems Manager Parameter Store[0m[38;5;12m (https://aws.amazon.com/blogs/compute/sharing-secrets-with-aws-lambda-using-aws-systems-manager-parameter-store/) - How to use parameter store for secrets. [39m
[38;5;12m- [39m[38;5;14m[1mA Serverless Journey: AWS Lambda under the hood[0m[38;5;12m (https://www.youtube.com/watch?v=QdzV04T_kec) - Great talk on how Lambda works, introduction to Firecracker. [39m
[38;5;12m- [39m[38;5;14m[1mSecurity Considerations for AWS Lambda Runtime API and Layers[0m[38;5;12m (https://www.puresec.io/blog/aws-lambda-security-considerations-runtime-api-and-layers) - A blog post on what to keep in mind when developing with Layers & Runtime API. [39m
[38;5;12m- [39m[38;5;14m[1mThe FireCracker Virtual Machine Monitor[0m[38;5;12m (https://lwn.net/Articles/775736/) - An analysis of AWS Firecracker. [39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAWS[0m[38;5;14m[1m [0m[38;5;14m[1mLambda[0m[38;5;14m[1m [0m[38;5;14m[1mServerless[0m[38;5;14m[1m [0m[38;5;14m[1mSecurity[0m[38;5;14m[1m [0m[38;5;14m[1mWorkshop[0m[38;5;12m [39m[38;5;12m(https://github.com/aws-samples/aws-serverless-security-workshop)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mLearn[39m[38;5;12m [39m[38;5;12mtechniques[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12msecure[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mserverless[39m[38;5;12m [39m[38;5;12mapplication[39m[38;5;12m [39m[38;5;12mbuilt[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mAWS[39m[38;5;12m [39m[38;5;12mLambda,[39m[38;5;12m [39m[38;5;12mAmazon[39m[38;5;12m [39m[38;5;12mAPI[39m[38;5;12m [39m[38;5;12mGateway[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mRDS[39m[38;5;12m [39m[38;5;12mAurora[39m[38;5;12m [39m[38;5;12m(Re:Invent[39m[38;5;12m [39m[38;5;12m2018[39m[38;5;12m [39m
[38;5;12mworkshop).[39m
[38;2;255;187;0m[4mSecurity Tools / Solutions[0m
[38;5;12m- [39m[38;5;14m[1mPureSec Serverless Security Platform[0m[38;5;12m (https://www.puresec.io/product) - The world's first and most advanced end-to-end serverless security platform. [39m
[38;5;12m- [39m[38;5;14m[1mPureSec FunctionShield[0m[38;5;12m (https://www.puresec.io/function-shield) - A free AWS Lambda security and Google Cloud Functions library for developers.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAutomated[0m[38;5;14m[1m [0m[38;5;14m[1mSQL[0m[38;5;14m[1m [0m[38;5;14m[1mInjection[0m[38;5;14m[1m [0m[38;5;14m[1mTesting[0m[38;5;14m[1m [0m[38;5;14m[1mof[0m[38;5;14m[1m [0m[38;5;14m[1mServerless[0m[38;5;14m[1m [0m[38;5;14m[1mFunctions[0m[38;5;12m [39m[38;5;12m(https://www.puresec.io/blog/automated-sql-injection-testing-of-serverless-functions-on-a-shoestring-budget-and-some-good-music)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m  [39m[38;5;12mAn[39m[38;5;12m [39m[38;5;12mopen[39m[38;5;12m [39m[38;5;12msource[39m[38;5;12m [39m[38;5;12mproxy[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12musing[39m[38;5;12m [39m[38;5;12mSQLMap[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mtest[39m[38;5;12m [39m
[38;5;12mAWS[39m[38;5;12m [39m[38;5;12mLambda,[39m[38;5;12m [39m[38;5;12mnatively.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAuto-Generate[0m[38;5;14m[1m [0m[38;5;14m[1mLeast[0m[38;5;14m[1m [0m[38;5;14m[1mPrivileged[0m[38;5;14m[1m [0m[38;5;14m[1mIAM[0m[38;5;14m[1m [0m[38;5;14m[1mRoles[0m[38;5;14m[1m [0m[38;5;14m[1mfor[0m[38;5;14m[1m [0m[38;5;14m[1mAWS[0m[38;5;14m[1m [0m[38;5;14m[1mLambda[0m[38;5;12m [39m[38;5;12m(https://www.puresec.io/blog/generating-least-privileged-iam-roles-for-aws-lambda-functions-the-easy-way)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mA[39m[38;5;12m [39m[38;5;12mServerless[39m[38;5;12m [39m[38;5;12mframework[39m[38;5;12m [39m[38;5;12mplugin[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mautomatically[39m[38;5;12m [39m[38;5;12mgenerating[39m[38;5;12m [39m[38;5;12mleast[39m[38;5;12m [39m
[38;5;12mprivileged[39m[38;5;12m [39m[38;5;12mroles[39m[38;5;12m [39m[38;5;12musing[39m[38;5;12m [39m[38;5;12mstatic[39m[38;5;12m [39m[38;5;12manalysis.[39m[38;5;12m [39m
[38;5;12m- [39m[38;5;14m[1mOWASP ServerlessGoat[0m[38;5;12m (https://www.owasp.org/index.php/OWASP_Serverless_Goat) -  A vulnerable AWS Lambda serverless application. [39m
[38;5;12m- [39m[38;5;14m[1mSecure Serverless CI/CD with Codeship, PureSec, and AWS Lambda[0m[38;5;12m (https://blog.codeship.com/secure-serverless-ci-cd-with-codeship-puresec-and-aws-lambda/) - A step by step guide for secure serverless CI/CD.[39m
[38;2;255;187;0m[4mAzure Functions Security[0m
[38;5;12m- [39m[38;5;14m[1mAzure Functions & Serverless Platform Security[0m[38;5;12m (https://gallery.technet.microsoft.com/Azure-Functions-and-c6449f8d) - Some basics on Azure functions security. [39m
[38;5;12m- [39m[38;5;14m[1mRun Your Azure Functions from a Package File[0m[38;5;12m (https://docs.microsoft.com/en-us/azure/azure-functions/run-functions-from-deployment-package) - Deploying immutable Azure functions. [39m
[38;5;12m- [39m[38;5;14m[1mSecurity in Azure App Service & Azure Functions[0m[38;5;12m (https://docs.microsoft.com/en-us/azure/app-service/app-service-security) -  More basic concepts for Azure functions. [39m
[38;5;12m- [39m[38;5;14m[1mIdentity & Secure Resource Access in App Service & Azure Functions[0m[38;5;12m (https://www.youtube.com/watch?v=iFDXDQXRJ8Y) - Explores features in App Service or Azure functions which make working with identities simple (Build Conference). [39m
[38;5;12m- [39m[38;5;14m[1mSecure Azure Functions with JWT access tokens[0m[38;5;12m (https://blog.wille-zone.de/post/secure-azure-functions-with-jwt-token/) - A blog post on how to use JWT access tokens with Azure functions.[39m
[38;2;255;187;0m[4mGoogle Cloud Functions Security[0m
[38;5;12m- [39m[38;5;14m[1mFunction Identity[0m[38;5;12m (https://cloud.google.com/functions/docs/securing/function-identity) -  Documentation for Google Cloud Functions IAM and per-function identity.[39m
[38;2;255;187;0m[4mServerless Risks / General[0m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mCSA:[0m[38;5;14m[1m [0m[38;5;14m[1mThe[0m[38;5;14m[1m [0m[38;5;14m[1m12[0m[38;5;14m[1m [0m[38;5;14m[1mMost[0m[38;5;14m[1m [0m[38;5;14m[1mCritical[0m[38;5;14m[1m [0m[38;5;14m[1mRisks[0m[38;5;14m[1m [0m[38;5;14m[1mfor[0m[38;5;14m[1m [0m[38;5;14m[1mServerless[0m[38;5;14m[1m [0m[38;5;14m[1mApplications[0m[38;5;14m[1m [0m[38;5;14m[1m2019[0m[38;5;12m [39m[38;5;12m(https://www.puresec.io/serverless-security-top-12-csa-puresec)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mThe[39m[38;5;12m [39m[38;5;12mmost[39m[38;5;12m [39m[38;5;12mextensive[39m[38;5;12m [39m[38;5;12mguide[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mtop[39m[38;5;12m [39m[38;5;12mrisks[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mserverless[39m[38;5;12m [39m[38;5;12mapplications[39m[38;5;12m [39m[38;5;12m(Cloud[39m[38;5;12m [39m[38;5;12mSecurity[39m[38;5;12m [39m[38;5;12mAlliance[39m[38;5;12m [39m[38;5;12m&[39m[38;5;12m [39m
[38;5;12mPureSec).[39m
[38;5;12m- [39m[38;5;14m[1mSecuring serverless blog series[0m[38;5;12m (https://www.puresec.io/blog/tag/securing-serverless-blog-series) - Blog series covering the main differences between security traditional applications and serverless. [39m
[38;5;12m- [39m[38;5;14m[1mSecuring Serverless: A Newbie's Guide[0m[38;5;12m (https://www.jeremydaly.com/securing-serverless-a-newbies-guide/) - A terrific newbie's guide by Jeremy Daly. [39m
[38;5;12m- [39m[38;5;14m[1mServerless Security: What are we up against[0m[38;5;12m (https://www.youtube.com/watch?v=M7wUanfWs1c&t=2s) - A conference talk from ServerlessDays covering serverless security basics. [39m
[38;5;12m- [39m[38;5;14m[1mHacking Serverless Runtimes[0m[38;5;12m (https://www.blackhat.com/docs/us-17/wednesday/us-17-Krug-Hacking-Severless-Runtimes.pdf) - Good early insights presentation from BlackHat conference 2017.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mServerless[0m[38;5;14m[1m [0m[38;5;14m[1mSecurity[0m[38;5;14m[1m [0m[38;5;14m[1mand[0m[38;5;14m[1m [0m[38;5;14m[1mThings[0m[38;5;14m[1m [0m[38;5;14m[1mthat[0m[38;5;14m[1m [0m[38;5;14m[1mGo[0m[38;5;14m[1m [0m[38;5;14m[1mBump[0m[38;5;14m[1m [0m[38;5;14m[1min[0m[38;5;14m[1m [0m[38;5;14m[1mthe[0m[38;5;14m[1m [0m[38;5;14m[1mNight[0m[38;5;12m [39m[38;5;12m(https://qconnewyork.com/ny2017/system/files/presentation-slides/serverless_security_and_things_that_go_bump_in_the_night_-_qcon_nyc_2017.pdf)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m  [39m[38;5;12mQCon[39m[38;5;12m [39m[38;5;12mNYC[39m[38;5;12m [39m[38;5;12mpresentation[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m
[38;5;12mSilvexis[39m[38;5;12m [39m[38;5;12mcovering[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mbasics[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mserverless.[39m
[38;5;12m- [39m[38;5;14m[1mSecuring Cloud via Serverless Design Patterns[0m[38;5;12m (https://www.usenix.org/system/files/conference/hotcloud18/hotcloud18-paper-hong.pdf) - Six serverless design patterns to build security services in the cloud. [39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mPeeking[0m[38;5;14m[1m [0m[38;5;14m[1mBehind[0m[38;5;14m[1m [0m[38;5;14m[1mthe[0m[38;5;14m[1m [0m[38;5;14m[1mCurtains[0m[38;5;14m[1m [0m[38;5;14m[1mof[0m[38;5;14m[1m [0m[38;5;14m[1mServerless[0m[38;5;14m[1m [0m[38;5;14m[1mPlatforms[0m[38;5;12m [39m[38;5;12m(https://www.usenix.org/system/files/conference/atc18/atc18-wang-liang.pdf)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m  [39m[38;5;12mProvides[39m[38;5;12m [39m[38;5;12minsights[39m[38;5;12m [39m[38;5;12minto[39m[38;5;12m [39m[38;5;12marchitectures,[39m[38;5;12m [39m[38;5;12mresource[39m[38;5;12m [39m[38;5;12mutilization,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mperformance[39m[38;5;12m [39m[38;5;12misolation[39m[38;5;12m [39m[38;5;12mefficiency[39m[38;5;12m [39m[38;5;12mof[39m
[38;5;12mAWS[39m[38;5;12m [39m[38;5;12mLambda,[39m[38;5;12m [39m[38;5;12mGCF[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mAzure[39m[38;5;12m [39m[38;5;12mFunctions.[39m
[38;5;12m- [39m[38;5;14m[1mServerless Architectures[0m[38;5;12m (https://martinfowler.com/articles/serverless.html) - The best overview on serverless architectures. This article provides an in-depth look at serverless architectures. [39m
[38;2;255;187;0m[4mVulnerabilities, Weaknesses, CVEs[0m
[38;5;12m- [39m[38;5;14m[1mReDoS in NPM package aws-lambda-multipart-parser[0m[38;5;12m (https://www.puresec.io/blog/redos-vulnerability-in-aws-lambda-multipart-parser-node-package) - A ReDoS in an NPM package for AWS Lambda functions. [39m
[38;5;12m- [39m[38;5;14m[1mApache OpenWhisk Action Mutability Weakness[0m[38;5;12m (https://www.puresec.io/blog/apache_openwhisk_mutability_weakness) - Two vulnerabilities discovered in Apache OpenWhisk.[39m
[38;5;12m- [39m[38;5;14m[1mServerless Cypto-Mining[0m[38;5;12m (https://www.puresec.io/blog/new-attack-vector-serverless-crypto-mining) - Exploiting app layer vulnerabilities in serverless functions to abuse AWS Lambda for crypto-mining.[39m
[38;2;255;187;0m[4mGeneral Application Security Articles, Books[0m
[38;5;12m- [39m[38;5;14m[1mThe Web Application Hacker’s Handbook[0m[38;5;12m (https://www.amazon.com/Web-Application-Hackers-Handbook-Exploiting/dp/1118026470/) - A classic book on web application security.[39m
[38;5;12m- [39m[38;5;14m[1mWeb Application Defender’s Cookbook[0m[38;5;12m (https://www.amazon.com/Web-Application-Defenders-Cookbook-Protecting/dp/1118362187/) - Another classic, covering ModSecurity protections. [39m
[38;5;12m- [39m[38;5;14m[1mXSS (Cross Site Scripting) Attacks, Exploits & Defense[0m[38;5;12m (https://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense/dp/1597491543/) - The XSS bible covering all aspects of XSS attacks and protections.[39m
[38;5;12m- [39m[38;5;14m[1mHacking Exposed - Web Applications[0m[38;5;12m (https://www.amazon.com/Hacking-Exposed-Web-Applications-Third/dp/0071740643) - Another classic book on web application security.[39m
[38;5;12m- [39m[38;5;14m[1mSecuring DevOps[0m[38;5;12m (https://www.manning.com/books/securing-devops?a_aid=securingdevops&a_bid=1353bcd8) -  Tons of real world examples on DevOps and security.[39m
[38;2;255;187;0m[4mAWS Lambda (General)[0m
[38;5;12m- [39m[38;5;14m[1mServerless Architectures on AWS[0m[38;5;12m (https://www.amazon.com/Serverless-Architectures-AWS-examples-Lambda/dp/1617293822/) - This book teaches you how to build, secure and manage serverless architectures.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mTips[0m[38;5;14m[1m [0m[38;5;14m[1m&[0m[38;5;14m[1m [0m[38;5;14m[1mTricks[0m[38;5;14m[1m [0m[38;5;14m[1mfor[0m[38;5;14m[1m [0m[38;5;14m[1mlogging[0m[38;5;14m[1m [0m[38;5;14m[1mand[0m[38;5;14m[1m [0m[38;5;14m[1mmonitoring[0m[38;5;14m[1m [0m[38;5;14m[1mAWS[0m[38;5;14m[1m [0m[38;5;14m[1mLambda[0m[38;5;14m[1m [0m[38;5;14m[1mFunctions[0m[38;5;12m [39m[38;5;12m(https://hackernoon.com/tips-and-tricks-for-logging-and-monitoring-aws-lambda-functions-885af6da29a5)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mTips[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mhelp[39m[38;5;12m [39m[38;5;12myou[39m[38;5;12m [39m[38;5;12mget[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mmost[39m[38;5;12m [39m[38;5;12mout[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mlogging[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mmonitoring[39m[38;5;12m [39m
[38;5;12minfrastructure[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mfunctions[39m[38;5;12m [39m[38;5;12m.[39m
[38;2;255;187;0m[4mOther Interesting Articles / Web Pages[0m
[38;5;12m- [39m[38;5;14m[1mGoogle gVisor[0m[38;5;12m (https://github.com/google/gvisor) -  GitHub repo for Google gVisor project. [39m
[38;5;12m- [39m[38;5;14m[1mGoogle gVisor & Google Cloud Functions[0m[38;5;12m (https://cloudplatform.googleblog.com/2018/05/Open-sourcing-gVisor-a-sandboxed-container-runtime.html) - A blog post covering Google gVisor and how it is used with Google Cloud Functions.[39m
[38;5;12m- [39m[38;5;14m[1mIBM Cloud Functions - Platform Architecture[0m[38;5;12m (https://console.bluemix.net/docs/openwhisk/openwhisk_about.html#openwhisk_about) - OpenWhisk & IBM Cloud Functions overview. [39m
[38;2;255;187;0m[4mLicense[0m
[38;5;14m[1m![0m[38;5;12mCC0[39m[38;5;14m[1m (http://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)[0m[38;5;12m (https://creativecommons.org/publicdomain/zero/1.0/)[39m
[38;5;12mTo the extent possible under law, [39m[38;5;14m[1mPureSec[0m[38;5;12m (https://www.puresec.io) has waived all copyright and related or neighboring rights to this work.[39m
