Serverless Security: Functions-as-a-Service (FaaS) - Challenges and Best Practices
Explore serverless security and Functions-as-a-Service (FaaS) in this 34-minute OWASP Foundation talk by Niels Tanis. Delve into the security benefits and challenges of serverless architectures, including Azure Functions, AWS Lambda, and Google Cloud Functions. Learn about the reduced infrastructure management, increased resilience to DoS attacks, and potential vulnerabilities in serverless applications. Examine the complex architecture and attack surface of FaaS, software supply chain concerns, and the importance of patching for vulnerabilities. Discover key security areas to focus on when developing serverless applications, including third-party library management, secret storage, data encryption, least privilege principles, and software supply chain automation. Gain insights into threat modeling, monitoring, and logging for serverless environments, and understand the balance between ease of creation and complexity in maintaining secure serverless applications.