OWASP Top 10 2017
Serverless

●
● IT
● SE
●
○ SE→ SE→ → SE
●
●
○

OWASP Top 10

OWASP Top 10
OWASP Serverless Top 10
●
● OWASP Serverless Top 10
●
●

OWASP Top 10 (1)
● Web
●
●
○ OWASP
■ OWASP Proactive Controls
■ OWASP ASVS
■ OWASP Testing Guide
■ OWASP Cheat Sheet
■ OWASP Automated Threats
○
■ CWE
■ NIST

OWASP Top 10 (2)
1. A1:2017-
2. A2:2017-
3. A3:2017-
4. A4:2017-XML XXE
5. A5:2017-
6. A6:2017-
7. A7:2017- XSS
8. A8:2017-
9. A9:2017-
10. A10:2017-

OWASP Top 10 (3)
●
○ X: Denial of Service (DoS)
○ X: Denial of Wallet (DoW)
○ X: Insecure Secret Management
○ X: Insecure Shared Space
○ X: Business Logic / Flow manipulation

OWASP Top 10
FaaS AWS Lambda Google Cloud Functions

A1:2017
◆
●
● Function
○
○
○
○
○
◆
●
●

A1:2017
FaaS Function

A2:2017
◆
● Function
Function
● Faas
◆
● API

A2:2017
PullRequest
SES Lambda

A3:2017
◆
●
Function
● FaaS
Function
◆
●
●
● /tmp

A4:2017 XML
◆
● VPC
● Function
DoS
◆
● XML
XML

A5:2017
◆
●
FaaS Function
root/admin
● Function
◆
● Function

A6:2017
◆
●
FaaS
● Function
○ Function
○
◆
●
● …
○ github
○
○ Function

A7:2017
◆
● XSS
◆
●

A8:2017
◆
● Function
◆
●
●
●

A9:2017
◆
●

A10:2017
◆
● FaaS
○
○
○ Function
○
◆
●
● FaaS

●
●
● FaaS