31 Free Serverless Security Ebooks, Articles and Resources

Serverless computing is becoming more popular as systems administrators look for new ways to build and run applications. These applications are easier to build, scalable and require less overhead than their server-based counterparts. But they can still be vulnerable to common attack vectors, so it is important to secure the application. Let’s take a look at how to evaluate these applications for vulnerability, create use cases to determine the best security measures to ensure your applications are secure, and what kind of problems to look out for.

Serverless computing demands a different mindset but secure serverless apps are at least as secure as their server-based counterparts. According to new research, the top two security concerns of companies implementing or using serverless platforms include compliance and how to handle data security. Below, you’ll find a curated list of awesome serverless security resources such as ebooks, articles, whitepapers, blogs and research papers.

AWS Lambda Security

1. AWS Lambda Security Best-Practices eBook
   PDF eBook covering all the basics such as: Serverless Top 10, IAM roles & permissions, CloudTrail, AWS Config, API Gateway security.
2. Foundations of AWS Lambda Security
   Webinar recording covering AWS Lambda security basics, IAM permissions, Scalability, Governance.
3. AWS Lambda Security Quick-Start Guide
   A quick start guide portraying security strategies for AWS Lambda applications.
4. AWS Lambda Security – Design for Failure
   Notes on the importance of IAM permissions for AWS Lambda.
5. Attacking an AWS Account via a Lambda Function
   An article from DarkReading, describing attackers and defenders side of a real serverless bounty hunt.
6. Minimizing the attack surface in Serverless
   Presentation covering the basics of serverless attack surfaces.
7. Gone in 60 milliseconds: Offensive security in the serverless age
   A presentation video showing attack vectors using cloud event sources, exploitabilities in common serverless patterns and frameworks.
8. Security Best Practices for Serverless Applications
   Basic best-practices for AWS Lambda.
9. AWS IAM best practices
   Early AWS materials on IAM best practices.
10. The Many-Faced Threats to the Serverless World
    An article covering most of the basic security risks.
11. How to Encrypt Serverless Environment Variable Secrets with KMS
    Fundamentals of secrets handling with AWS KMS.
12. Sharing Secrets with AWS Lambda Using AWS Systems Manager Parameter Store
    How to use parameter store for secrets.
13. A Serverless Journey: AWS Lambda under the hood
    Great talk on how Lambda works, introduction to Firecracker.
14. The FireCracker Virtual Machine Monitor
    An analysis of AWS Firecracker.
15. AWS Lambda Serverless Security Workshop
    Learn techniques to secure a serverless application built with AWS Lambda, Amazon API Gateway and RDS Aurora (Re:Invent 2018 workshop).

Security Tools / Solutions

1. Secure Serverless CI/CD with Codeship, PureSec, and AWS Lambda
   A step by step guide for secure serverless CI/CD.