Owasp top 10 serverless

•

1 gefällt mir•745 views

隆博田中

OWASP Nagoya Chapter 9 2019/2/8 発表資料

Technologie

OWASP Top 10
OWASP Serverless Top 10
●
● OWASP Serverless Top 10
●
●

OWASP Top 10 (1)
● Web
●
●
○ OWASP
■ OWASP Proactive Controls
■ OWASP ASVS
■ OWASP Testing Guide
■ OWASP Cheat Sheet
■ OWASP Automated Threats
○
■ CWE
■ NIST

OWASP Top 10 (2)
1. A1:2017-
2. A2:2017-
3. A3:2017-
4. A4:2017-XML XXE
5. A5:2017-
6. A6:2017-
7. A7:2017- XSS
8. A8:2017-
9. A9:2017-
10. A10:2017-

OWASP Top 10 (3)
●
○ X: Denial of Service (DoS)
○ X: Denial of Wallet (DoW)
○ X: Insecure Secret Management
○ X: Insecure Shared Space
○ X: Business Logic / Flow manipulation

OWASP Top 10
FaaS AWS Lambda Google Cloud Functions

A2:2017
◆
● Function
Function
● Faas
◆
● API

A3:2017
◆
●
Function
● FaaS
Function
◆
●
●
● /tmp

A4:2017 XML
◆
● VPC
● Function
DoS
◆
● XML
XML

A5:2017
◆
●
FaaS Function
root/admin
● Function
◆
● Function

A6:2017
◆
●
FaaS
● Function
○ Function
○
◆
●
● …
○ github
○
○ Function

A10:2017
◆
● FaaS
○
○
○ Function
○
◆
●
● FaaS

Empfohlen

2017대선 빅데이터 분석지승 한

사진형SNS 인스플지승 한

Intro to ES6 / ES2015Jamal Sinclair O'Garro

OWASP top10 2017, Montpellier JUG de NoelHubert Gregoire

What's New in MySQL 8.0 @ HKOSC 2017Ivan Ma

MySQL no Paypal Tesla e UberMySQL Brasil

SAP on AWS: SAPPHIRE NOW 2018 RecapAmazon Web Services

Migrating Your SQL Server Databases to Amazon RDS - DAT312 - re:Invent 2017Amazon Web Services

Empfohlen

2017대선 빅데이터 분석지승 한

사진형SNS 인스플지승 한

Intro to ES6 / ES2015Jamal Sinclair O'Garro

OWASP top10 2017, Montpellier JUG de NoelHubert Gregoire

What's New in MySQL 8.0 @ HKOSC 2017Ivan Ma

MySQL no Paypal Tesla e UberMySQL Brasil

SAP on AWS: SAPPHIRE NOW 2018 RecapAmazon Web Services

Migrating Your SQL Server Databases to Amazon RDS - DAT312 - re:Invent 2017Amazon Web Services

Azure App Gateway and Log Analytics under Penetration TestsRoy Kim

OSV operating systemEmad Soltani

SAP on AWS 이관사례로 알아보는 SAP 혁신 전략 - 이진욱, AWS SAP on AWS Solutions ArchitectAmazon Web Services Korea

Deployment of SAP Solutions on AWS (Level 200)Amazon Web Services

Migrando aplicaciones SAP a AWSAmazon Web Services LATAM

Bentobox ExerciseEster Kais

Building prediction models with Amazon Redshift and Amazon MLJulien SIMON

NodeJS Serverless backends for your frontendsCarlos Santana

Monitoring Big Data Systems Done "The Simple Way" - Codemotion Milan 2017 - D...Demi Ben-Ari

Demi Ben-Ari - Monitoring Big Data Systems Done "The Simple Way" - Codemotion...Codemotion

SRV315_How We Built a Mission-Critical, Serverless File Processing Pipeline f...Amazon Web Services

AWS re:Invent 2016 Fast ForwardShuen-Huei Guan

GPSWKS401_Designing a Cloud Enterprise Data WarehouseAmazon Web Services

Cloud Native Applications on OpenShiftSerhat Dirik

OSOM Operations in the Cloudmstuparu

OSOM - Operations in the CloudMarcela Oniga

Monitoring with Icinga2 at AdobeIcinga

Addressing Issues of Risk & Governance in OpenStack without sacrificing Agili...OpenStack

MySQL8.0 in COSCUP2017Shinya Sugiyama

SAP portal: breaking and forensicating ERPScan

WhatsTheCedar.pptx隆博田中

SecurityGroup_AboutTrackedUntracked.pptx隆博田中

Weitere ähnliche Inhalte

Ähnlich wie Owasp top 10 serverless

Azure App Gateway and Log Analytics under Penetration TestsRoy Kim

OSV operating systemEmad Soltani

SAP on AWS 이관사례로 알아보는 SAP 혁신 전략 - 이진욱, AWS SAP on AWS Solutions ArchitectAmazon Web Services Korea

Deployment of SAP Solutions on AWS (Level 200)Amazon Web Services

Migrando aplicaciones SAP a AWSAmazon Web Services LATAM

Bentobox ExerciseEster Kais

Building prediction models with Amazon Redshift and Amazon MLJulien SIMON

NodeJS Serverless backends for your frontendsCarlos Santana

Monitoring Big Data Systems Done "The Simple Way" - Codemotion Milan 2017 - D...Demi Ben-Ari

Demi Ben-Ari - Monitoring Big Data Systems Done "The Simple Way" - Codemotion...Codemotion

SRV315_How We Built a Mission-Critical, Serverless File Processing Pipeline f...Amazon Web Services

AWS re:Invent 2016 Fast ForwardShuen-Huei Guan

GPSWKS401_Designing a Cloud Enterprise Data WarehouseAmazon Web Services

Cloud Native Applications on OpenShiftSerhat Dirik

OSOM Operations in the Cloudmstuparu

OSOM - Operations in the CloudMarcela Oniga

Monitoring with Icinga2 at AdobeIcinga

Addressing Issues of Risk & Governance in OpenStack without sacrificing Agili...OpenStack

MySQL8.0 in COSCUP2017Shinya Sugiyama

SAP portal: breaking and forensicating ERPScan

Ähnlich wie Owasp top 10 serverless (20)

Azure App Gateway and Log Analytics under Penetration Tests

OSV operating system

SAP on AWS 이관사례로 알아보는 SAP 혁신 전략 - 이진욱, AWS SAP on AWS Solutions Architect

Deployment of SAP Solutions on AWS (Level 200)

Migrando aplicaciones SAP a AWS

Bentobox Exercise

Building prediction models with Amazon Redshift and Amazon ML

NodeJS Serverless backends for your frontends

Monitoring Big Data Systems Done "The Simple Way" - Codemotion Milan 2017 - D...

Demi Ben-Ari - Monitoring Big Data Systems Done "The Simple Way" - Codemotion...

SRV315_How We Built a Mission-Critical, Serverless File Processing Pipeline f...

AWS re:Invent 2016 Fast Forward

GPSWKS401_Designing a Cloud Enterprise Data Warehouse

Cloud Native Applications on OpenShift

OSOM Operations in the Cloud

OSOM - Operations in the Cloud

Monitoring with Icinga2 at Adobe

Addressing Issues of Risk & Governance in OpenStack without sacrificing Agili...

MySQL8.0 in COSCUP2017

SAP portal: breaking and forensicating

Mehr von 隆博田中

WhatsTheCedar.pptx隆博田中

SecurityGroup_AboutTrackedUntracked.pptx隆博田中

Create ECS Cluster (Fargate)隆博田中

Aws security ssrf_update隆博田中

Aws security ssrf隆博田中

Aws first step_ec2_vpc隆博田中

Aws security part1隆博田中

Well architected framework_first_step隆博田中

Mehr von 隆博田中 (8)

WhatsTheCedar.pptx

SecurityGroup_AboutTrackedUntracked.pptx

Create ECS Cluster (Fargate)

Aws security ssrf_update

Aws security ssrf

Aws first step_ec2_vpc

Aws security part1

Well architected framework_first_step

Kürzlich hochgeladen

Gen AI in Business - Global Trends Report 2024.pdfAddepto

CloudStudio User manual (basic edition):comworks

Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3

DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy

TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc

WordPress Websites for Engineers: Elevate Your Brandgvaughan

Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays

How to write a Business Continuity PlanDatabarracks

Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren

The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage CostZilliz

Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm

Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity

Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited

Story boards and shot lists for my a level piececharlottematthew16

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxnull - The Open Security Community

H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DaySri Ambati

Kürzlich hochgeladen (20)

Gen AI in Business - Global Trends Report 2024.pdf

CloudStudio User manual (basic edition):

Nell’iperspazio con Rocket: il Framework Web di Rust!

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx

DevoxxFR 2024 Reproducible Builds with Apache Maven

TrustArc Webinar - How to Build Consumer Trust Through Data Privacy

WordPress Websites for Engineers: Elevate Your Brand

Designing IA for AI - Information Architecture Conference 2024

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024

"Debugging python applications inside k8s environment", Andrii Soldatenko

How to write a Business Continuity Plan

Advanced Test Driven-Development @ php[tek] 2024

The Ultimate Guide to Choosing WordPress Pros and Cons

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage Cost

Streamlining Python Development: A Guide to a Modern Project Setup

Dev Dives: Streamline document processing with UiPath Studio Web

Ensuring Technical Readiness For Copilot in Microsoft 365

Story boards and shot lists for my a level piece

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx

H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day

Owasp top 10 serverless

1. OWASP Top 10 2017 Serverless

2. ● ● IT ● SE ● ○ SE→ SE→ → SE ● ● ○

3. OWASP Top 10

4. OWASP Top 10 OWASP Serverless Top 10 ● ● OWASP Serverless Top 10 ● ●

5. OWASP Top 10 (1) ● Web ● ● ○ OWASP ■ OWASP Proactive Controls ■ OWASP ASVS ■ OWASP Testing Guide ■ OWASP Cheat Sheet ■ OWASP Automated Threats ○ ■ CWE ■ NIST

6. OWASP Top 10 (2) 1. A1:2017- 2. A2:2017- 3. A3:2017- 4. A4:2017-XML XXE 5. A5:2017- 6. A6:2017- 7. A7:2017- XSS 8. A8:2017- 9. A9:2017- 10. A10:2017-

7. OWASP Top 10 (3) ● ○ X: Denial of Service (DoS) ○ X: Denial of Wallet (DoW) ○ X: Insecure Secret Management ○ X: Insecure Shared Space ○ X: Business Logic / Flow manipulation

8. OWASP Top 10 FaaS AWS Lambda Google Cloud Functions

9. A1:2017 ◆ ● ● Function ○ ○ ○ ○ ○ ◆ ● ●

10. A1:2017 FaaS Function

11. A2:2017 ◆ ● Function Function ● Faas ◆ ● API

12. A2:2017 PullRequest SES Lambda

13. A3:2017 ◆ ● Function ● FaaS Function ◆ ● ● ● /tmp

14. A4:2017 XML ◆ ● VPC ● Function DoS ◆ ● XML XML

15. A5:2017 ◆ ● FaaS Function root/admin ● Function ◆ ● Function

16. A6:2017 ◆ ● FaaS ● Function ○ Function ○ ◆ ● ● … ○ github ○ ○ Function

17. A7:2017 ◆ ● XSS ◆ ●

18. A8:2017 ◆ ● Function ◆ ● ● ●

19. A9:2017 ◆ ●