Serverless Architectures Security Guide

Re:Serverless Architectures Security Guide by oferzelig on Wednesday January 17, 2018 @04:11PM (#16171866)

The intentions are good, but right now it looks like an incoming traffic source (and since it's on HN's front page, it might have succeeded).

It enumerates the Top 10 Most Critical Security Risks, but doesn't explain what each one really means, gives examples of where and how they're exposed, or how to mitigate them. Things that OWASP does.

Now, you might say that it's just the beginning and they iterate. Fine, but without any detail on these Top 10, this document is not super useful.

It would have been better to wait until it had more "meat".

[ Parent | on HN ]

Re:Serverless Architectures Security Guide by tptacek on Wednesday January 17, 2018 @04:17PM (#16171911)

I agree. This would be market-y even if the actual resource wasn't hidden behind a signup page; most security firms have guidance for lambda security, which makes it odd to see a random firm declare the "top 10".

[ Parent | on HN ]

Re:Serverless Architectures Security Guide by toomuchtodo on Wednesday January 17, 2018 @04:36PM (#16172125)

Any non-commercial canonical resources you'd recommend for serverless security architecture?

[ Parent | on HN ]

Re:Serverless Architectures Security Guide by johnbillow on Wednesday January 17, 2018 @05:17PM (#16172551)

Seems like these guys did a thorough job, and also involved a long list of respectable folks.

[ Parent | on HN ]

Re:Serverless Architectures Security Guide by m3mnoch on Wednesday January 17, 2018 @04:44PM (#16172231)

you have to dig for the pdf meat. https://www.puresec.io/resource-download

[ Parent | on HN ]