search

OWASP / Serverless-Top-10-Project

OWASP Serverless Top 10
https://owasp.org/www-project-serverless-top-10/
Other
212 stars 40 forks source link

A new version #21

Open cesarkohl opened 1 year ago

cesarkohl commented 1 year ago

Hey @MarcinHoppe and team,

I'm Cesar, nice to meet you! I really like the Serverless Top 10 Project. I've been thinking about creating a PR with a new version corresponding to the OWASP 2021, but I'd like to know what would be your reaction beforehand.

Following OWASP Top 10 changes from 2017 to 2021, most changes would be related with reorganizing the documentation and a few parts would be created from scratch.

Additionally, I'd like to get your opinion on how relevant is this project nowadays in terms of market and for you. I wouldn't like to work onto something that is not needed anymore.

Best, Cesar

MarcinHoppe commented 1 year ago

I think the project is in need of ongoing maintenance and updating it to keep it up to date. Reconciling the current content with the OWASP Top 10 2021 is a good next step.

That said, I think currently the project is in a bit of a limbo state and could use more contributors and perhaps even new maintainers.

@4ppsec Would love to know what your take is.

happyhacking-k commented 9 months ago

Hi @MarcinHoppe , have you considered publish the top 10 vulnerabilities belong to serverless applications alone? The cloud native attributes and unique architecture attributes of serverless determine the top 10 vulnerability types, which may not necessarily correspond to the top 10 vulnerabilities of OWASP. I think the security attributes of serverless applications have their own unique security risks.