Article Per Year (5 Year)
p-Index From 2021 - 2026
0.23
P-Index
This Author published in this journals
All Journal Journal of Applied Computer and Information Technology
Norsyazwani Mohd Puad
Kolej Komuniti Padang Terap

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
Security challenges in serverless architectures: Vulnerabilities and penetration testing approaches for AWS Lambda and Google Cloud Functions Norsyazwani Mohd Puad; Paiwand Hadi Hama Saeed; Braw Araz Mohammed; Mohamad Fadli Zolkipli
Journal of Applied Computer and Information Technology Vol. 1 No. 2 (2026): Journal of Applied Computer and Information Technology (JACoIT)
Publisher : Global Research Innovation

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.67131/jacoit.v1i2.27

Abstract

This study examines the evolving security landscape of serverless computing, specifically focusing on AWS Lambda and Google Cloud Functions. While serverless architectures offer significant scalability and cost advantages, their event-driven nature introduces unique vulnerabilities that traditional infrastructure-based security measures often fail to address. To identify these risks, a multi-methodological approach was employed, involving systematic literature mapping, platform benchmarking, and threat modeling using the STRIDE framework. The research specifically analyzed the "blast radius" of compromised functions and the efficacy of current penetration testing methodologies. Results indicate that Identity and Access Management (IAM) misconfigurations are the primary driver of cloud breaches, accounting for 42% of critical vulnerabilities, while traditional network scanning yielded zero actionable detection data. Furthermore, simulation data revealed that unthrottled "Denial-of-Wallet" attacks can cause catastrophic financial loss within minutes. Based on these findings, a five-layer defense-in-depth framework is proposed, integrating secure secret management, automated dependency scanning, and identity-centric governance. The study concludes that securing serverless environments requires a paradigm shift from network-level protection to granular application logic validation and continuous observability. These measures are essential for maintaining data integrity in decentralized cloud-native environments.
Co-Authors Braw Araz Mohammed Mohamad Fadli Zolkipli Paiwand Hadi Hama Saeed