The document outlines a comprehensive serverless security checklist focusing on function management, cyber threat assessment, identity and access management, and encryption practices. Key recommendations include robust governance, continuous vulnerability management, strict authentication protocols, and independent security testing for each function. It emphasizes the importance of encryption for data in transit and at rest, as well as proper handling of encryption keys.

1. Serverless Security
Checklist
Miscellaneous
Encryption
Function Management
Cyber Threat
Identity & Access
Management

2. 1. Function Management
1
Review organisational strategy, roles, responsibilities,
insurance and governance tasks. Address issues instantly
based on the roles and responsibilities of security
governance.
Perform an in-depth function data flow and privacy
assessment by reviewing the data life cycle. Is it vulnerable
anywhere?
Review shared environments for data segregation, logical
separation and security in a multi-latency environment.
Monitor which functions are accessing which data. Monitor
both individual function and full flows.
Standardize input processing to include sanitization.
Make API Gateway models as strict as possible. Limit
functionality to what you actually need. Minimize
permissions upfront.
2. Cyber Threat
What are your patch and vulnerability management
program practices?
What is your vulnerability remediation process?
Vulnerability management: patch vulnerabilities in virtual
machines templates and offline virtual machines
Discuss how serverless provider handles secure intra-host
communications among multiple serverless components?
System security: Review where there may be vulnerable
end-user systems interacting with cloud based applications.

3. 2
Review demonstrations and frequency of application and
penetration scans as part of the certification controls, as
well as continuous monitoring and scans when changes
occur or new functions are added for the serverless
applications.
Remove unnecessary dependencies, unused features,
components, files and documentation. On client and server-
side both, continuously monitor version of frameworks,
libraries and their dependencies.
Components should be obtained from official sources with
signed packages to reduce chances of malicious
components.
3. Identity & Access Management
Review information regarding authentication, restriction of
access, or implementation of segregation of duties (SOD)
for the development team.
Review the types of access available: single-sign-on (SSO),
authentication using the user identity management
software, or two-factor authentication.
Minimize functions that can access each data store
Use separate DB credentials per functions and control what
these credentials should do.
4. Encryption
Understand the environment for the APIs, including the
connection points to and from the data with encryption
utilized for data in transit, data at rest, and the type of
encryption.

4. 3
Encrypt all sensitive persistent data and sensitive off-box
state data.
Who controls encryption keys? How are the encryption keys
monitored? What is their storage and backup locations?
Review encryption certifications and determine what they
apply to, and test them.
SSL should provide a minimum of 128-bit, 256-bit optimum,
encryption based on the 2048-bit global root. Determine the
type of encryption.
Is there any encryption utilized for data at rest? For data in
storage, how are encryption keys stored? For data backups
that are data encrypted in transit or at rest? How are keys
managed?
Store password hashes using Bcrypt (no salt necessary -
Bcrypt does it for you).
5. Miscellaneous
Secure each function independently. Test every function for
the security flaws. Don’t rely on limiting access to a function.
Use shared input/output processing libraries.
Use separate networks/accounts for group of functions.
Destroy the session identifier after logout. Destroy the
session identifier after logout. No open redirects after
successful login or in any other intermediate redirects.
Check for randomness of reset password token in the
emailed link or SMS.
API calls intended to be done server to server should not be
done from the app.

5. 4
Keep your data separate from commands and queries.
How long are function logs kept?
Authenticate every endpoint against every request.
If authentication is not an option, use secure API keys and
SAML assertions.