Exploring Serverless Security: Identifying Security Risks and Implementing Best Practices

FaaS or Serverless computing extends the existing cloud computing by removing or abstracting the notion of a server and the need to scale up and down on demand. This paper seeks to discuss the security issues that are associated with serverless architecture, with special focus on authentication, data encryption, compliance issues and those risks that are unique to different vendors. It compares existing security architectures and measures and current industry benchmarks originating from premier cloud platforms such as AWS Lambda, Azure Functions, Google Cloud Functions. Some of the critical risks including injection attacks, insecure deployments, and operational monitoring have similar threat proneness models accompanied by secure coding, IAM integration, DevOps rules, and recommendations.