OWASP Serverless Top 10

on YouTube ↗28m

" summary

Claims OWASP Serverless Top Ten is the industry reference that must be refreshed: the current list dates from 2017 and the project runs a ~12‑month V2 process starting with issue solicitation in October and aiming for V2 launch OAS 2025. Demonstrations include a real Lambda example causing tenant data leakage when timeouts leave temp files behind. Tooling gaps surface — SCA, CSPM and IAM checks exist but insufficient logging and monitoring and few dedicated serverless scanners remain unsolved.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 1:31Serverless security myths
3. 4:39Why serverless needs Top 10
4. 7:50OWASP Serverless Top 10 overview
5. 12:45Shared responsibility model
6. 16:33Refreshing the Serverless Top 10
7. 22:23Q&A

" related talks

• 46mOWASP SERVERLESS TOP 10Tal Melamed · Global AppSec Dublin 2023
• 30mServerless Security Top 10Tal Melamed · Conf42 Cloud Native 2022
• 28mDefending Your Cloud Apps Against the Serverless Top 10Shlomi Kushchi · Conf42 Cloud Native 2023
• 33mServerless Security: New Risks Require New ApproachesItay Rozenman · GOTO Copenhagen 2021
• 22mAre you safe from OWASP #11?Matt Tesauro · Global AppSec US 2021 Virtual
• 50m15 years of OWASP Top 10 - Has the Cloud Made a Difference?Shira Shamban · OWASP 2022 Global AppSec Europe Virtual Event
• 01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVSJim Manico · NDC London 2020
• 47mOWASP Top 10Andrew van der Stock · OWASP AppSec California 2018