application security TL;DR on AWS Lambda Security Model AWS recently released a whitepaper on the Security Overview of Lambda. This document is meant to be an in-depth look at Lambda Security. Its definitely a worthwhile read. However, I
automation Look Ma! No Swagger! An approach to automated doc generation for Serverless Apps All of this started with this question #lazyweb is there an easier way to doc APIs other than Swagger/OpenAPI? Looking for some options. — Abhay Bhargav (@abhaybhargav) October 1,
application security Stale-State Serverless Security Flaws I'd like to introduce a possibly new class of serverless security flaws with a story. For our training business at we45, we orchestrate servers. A lot of servers. These servers
kubernetes 5 Must-Have Kubernetes Security Tools My entire months of June and July have been consumed by Kubernetes. All, largely owing to the Kubernetes Security Masterclass Training that are we are bringing to BlackHat USA 2020
application security AppSec Predictions for 2020 A Customary Blogpost I am going to NOT encompass "InfoSec Predictions" in this because "InfoSec" is a HUGE area and I am not nearly qualified enough to be making predictions
serverless TDD for Serverless - My Setup I have been building serverless over the last 10 months now. I am currently working on a "not-small" project that spans nearly a 100 functions in Python 3.7. I
application security Secrets of Secrets Secrets Management is important. Now, more than ever. Yet, I see very little attention being paid to it by Developers, DevOps teams and surprisingly, even security teams. Secrets are not
application security Holy s**t! We're really behind! Have been doing a lot of work with, the Cloud, Kubernetes, Serverless and Containers over the last 2 years, and I realize that we have very little by way of
cloud Notes on Open Policy Agent and Docker Security I am starting to work with Open Policy Agent (OPA) for Kubernetes. OPA is largely known for its ability to behave as a powerful Admission Controller for Kubernetes. However, I
serverless Winning with Serverless DevSecOps Pipelines There's little doubt that Serverless Technologies are being adopted at a rapid pace [1]. I have personally seen typically stodgy, old-school enterprises take to building out serverless (especially FaaS) projects
serverless So you wanna build a Production-ready Serverless App? I've been exploring serverless security for around a year now. Commonly, as a security pro, one typically looks at the offensive angle to any technology. While this can be very
graphql The Hard Way: Security Learnings from Real-world GraphQL This article comes (relatively) close on the heels of my talk at AppSec California. The talk was: "An Attacker's Perspective of Serverless and GraphQL Applications"The slides for that talk
