How can you manage security risks in serverless computing?

More and more applications are being extended through the use of API's. For example, in healthcare, there exists the idea of a portable healthcare record. It exists in the State of California, as well as within the Federal Government, under CMS. The CMS solution is called the "Blue Button", where using API calls, the application can allow a healthcare member to access and download their medical records. Blue Button has its own API, development and testing requirements. So, extending or expanding the core serverless architecture requires you to understand how these pieces fit together to execute your business logic.

Encryption for all cloud storage is very important to comply for all audits and risk assessment exercises as well. Make this your priority.

I concur with this perspective, but I'd like to emphasise that DevSecOps is not just a methodology; it's also a mindset. Often, organisations face resistance to adopting this mindset due to entrenched beliefs that security is an add-on, rather than an integral value. Developers sometimes perceive security as an obstacle and think, "We have a firewall for protection, so let Security handle it." Conversely, some security teams may block actions without understanding the broader objectives. In my view, DevSecOps represents a balanced mindset crucial for all companies in today's rapidly evolving digital landscape. Accelerating its adoption necessitates proactive leadership in dismantling these barriers visibly and effectively.

The main thing to keep in mind here is the shared responsibility model. Cloud providers promise to cover a certain part of the picture, and with serverless, that extends to the infrastructure you are building on. This is great in some ways, as you won't be dealing with some of the issues onsite brings, such as server patching, selecting and deploying support software like backups; however, access control enforcement, authentication (password management and MFA), any application level issues and principle of least privilege enforcement, will be in the purview of your teams. Make sure they understand how to build for this new environment and take advantage of the features given to them by the cloud providers to the fullest.

This is a not so great article that complete ignore the fact of serverless computing greatly assume the underlying platforms and service providers are secured, and none of the mitigations are discussed.

I would also concur about article not being good, the commenters statements attest point of perspective, maybe go back to the prompting level of your AI, break down each section with actual data relevant to the topic.

Taking a broader perspective, it's essential to grasp that Serverless computing doesn't mean there are no servers involved; it simply means someone else manages them behind the scenes. I echo the views expressed by others and wish to emphasise that, regardless of the chosen cloud provider, the shared responsibility model is just one facet of the relationship. For any company, having a dedicated Technical Account Manager (TAM) and maintaining transparency with their technical support are key dimensions of their relationship with the cloud provider. It's crucial to avoid taking shortcuts when it comes to implementing encryption for data at rest and in transit within the public cloud environment.