{"id":"https://openalex.org/W7212136632","doi":"https://doi.org/10.31891/2219-9365-2026-87-32","title":"LAMBDA ENVIRONMENT VARIABLE SECURITY: INCIDENT INVESTIGATION, MASS CREDENTIAL ANALYSIS, AND ROTATION METHODOLOGY IN AWS CLOUD ENVIRONMENTS","display_name":"LAMBDA ENVIRONMENT VARIABLE SECURITY: INCIDENT INVESTIGATION, MASS CREDENTIAL ANALYSIS, AND ROTATION METHODOLOGY IN AWS CLOUD ENVIRONMENTS","publication_year":2026,"publication_date":"2026-09-10","ids":{"openalex":"https://openalex.org/W7212136632","doi":"https://doi.org/10.31891/2219-9365-2026-87-32"},"language":"en","primary_location":{"id":"doi:10.31891/2219-9365-2026-87-32","doi":"https://doi.org/10.31891/2219-9365-2026-87-32","is_oa":true,"landing_page_url":"https://doi.org/10.31891/2219-9365-2026-87-32","pdf_url":"https://vottp.khmnu.edu.ua/index.php/vottp/article/download/964/906","source":{"id":"https://openalex.org/S4210209235","display_name":"Measuring and computing devices in technological processes","issn_l":"2219-9365","issn":["2219-9365"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I164756455","host_organization_name":"Khmelnytskyi National University","host_organization_lineage":["https://openalex.org/I164756455"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"\u0412\u0418\u041c\u0406\u0420\u042e\u0412\u0410\u041b\u042c\u041d\u0410 \u0422\u0410 \u041e\u0411\u0427\u0418\u0421\u041b\u042e\u0412\u0410\u041b\u042c\u041d\u0410 \u0422\u0415\u0425\u041d\u0406\u041a\u0410 \u0412 \u0422\u0415\u0425\u041d\u041e\u041b\u041e\u0413\u0406\u0427\u041d\u0418\u0425 \u041f\u0420\u041e\u0426\u0415\u0421\u0410\u0425","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://vottp.khmnu.edu.ua/index.php/vottp/article/download/964/906","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059434958","display_name":"Dmytro Mukha","orcid":"https://orcid.org/0009-0002-2155-2739","observed_orcids":["https://orcid.org/0009-0002-2155-2739"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Dmytro MUKHA","raw_affiliation_strings":["DarkCloud, Lead Product Security & DevSecOps Engineer"],"raw_orcid":"https://orcid.org/0009-0002-2155-2739","affiliations":[{"raw_affiliation_string":"DarkCloud, Lead Product Security & DevSecOps Engineer","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5059434958"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.63841451,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":"3","first_page":"274","last_page":"280"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.8833000063896179,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.8833000063896179,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.031199999153614044,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.025100000202655792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/aws-lambda","display_name":"AWS Lambda","score":0.9900000095367432},{"id":"https://openalex.org/keywords/environment-variables","display_name":"environment variables","score":0.8330000042915344},{"id":"https://openalex.org/keywords/credential-exposure","display_name":"credential exposure","score":0.8759999871253967},{"id":"https://openalex.org/keywords/incident-investigation","display_name":"incident investigation","score":0.640999972820282},{"id":"https://openalex.org/keywords/forensic-reconstruction","display_name":"forensic reconstruction","score":0.7300000190734863}],"concepts":[{"id":"https://openalex.org/C2777810591","wikidata":"https://www.wikidata.org/wiki/Q16861606","display_name":"Credential","level":2,"score":0.8784999847412109},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6215000152587891},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5956000089645386},{"id":"https://openalex.org/C2778113609","wikidata":"https://www.wikidata.org/wiki/Q10897","display_name":"Lambda","level":2,"score":0.5410000085830688},{"id":"https://openalex.org/C182365436","wikidata":"https://www.wikidata.org/wiki/Q50701","display_name":"Variable (mathematics)","level":2,"score":0.5392000079154968},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4706000089645386},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4611999988555908},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.41100001335144043},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.39879998564720154},{"id":"https://openalex.org/C74050887","wikidata":"https://www.wikidata.org/wiki/Q848368","display_name":"Rotation (mathematics)","level":2,"score":0.3402000069618225},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.31349998712539673},{"id":"https://openalex.org/C92717368","wikidata":"https://www.wikidata.org/wiki/Q1162538","display_name":"Plaintext","level":3,"score":0.27810001373291016},{"id":"https://openalex.org/C2778565505","wikidata":"https://www.wikidata.org/wiki/Q2207566","display_name":"Spec#","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C178009071","wikidata":"https://www.wikidata.org/wiki/Q93344","display_name":"Trigonometric functions","level":2,"score":0.25850000977516174}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.31891/2219-9365-2026-87-32","doi":"https://doi.org/10.31891/2219-9365-2026-87-32","is_oa":true,"landing_page_url":"https://doi.org/10.31891/2219-9365-2026-87-32","pdf_url":"https://vottp.khmnu.edu.ua/index.php/vottp/article/download/964/906","source":{"id":"https://openalex.org/S4210209235","display_name":"Measuring and computing devices in technological processes","issn_l":"2219-9365","issn":["2219-9365"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I164756455","host_organization_name":"Khmelnytskyi National University","host_organization_lineage":["https://openalex.org/I164756455"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"\u0412\u0418\u041c\u0406\u0420\u042e\u0412\u0410\u041b\u042c\u041d\u0410 \u0422\u0410 \u041e\u0411\u0427\u0418\u0421\u041b\u042e\u0412\u0410\u041b\u042c\u041d\u0410 \u0422\u0415\u0425\u041d\u0406\u041a\u0410 \u0412 \u0422\u0415\u0425\u041d\u041e\u041b\u041e\u0413\u0406\u0427\u041d\u0418\u0425 \u041f\u0420\u041e\u0426\u0415\u0421\u0410\u0425","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.31891/2219-9365-2026-87-32","doi":"https://doi.org/10.31891/2219-9365-2026-87-32","is_oa":true,"landing_page_url":"https://doi.org/10.31891/2219-9365-2026-87-32","pdf_url":"https://vottp.khmnu.edu.ua/index.php/vottp/article/download/964/906","source":{"id":"https://openalex.org/S4210209235","display_name":"Measuring and computing devices in technological processes","issn_l":"2219-9365","issn":["2219-9365"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I164756455","host_organization_name":"Khmelnytskyi National University","host_organization_lineage":["https://openalex.org/I164756455"],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"\u0412\u0418\u041c\u0406\u0420\u042e\u0412\u0410\u041b\u042c\u041d\u0410 \u0422\u0410 \u041e\u0411\u0427\u0418\u0421\u041b\u042e\u0412\u0410\u041b\u042c\u041d\u0410 \u0422\u0415\u0425\u041d\u0406\u041a\u0410 \u0412 \u0422\u0415\u0425\u041d\u041e\u041b\u041e\u0413\u0406\u0427\u041d\u0418\u0425 \u041f\u0420\u041e\u0426\u0415\u0421\u0410\u0425","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7212136632.pdf","grobid_xml":"https://content.openalex.org/works/W7212136632.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7042688748","https://openalex.org/W3123059737","https://openalex.org/W4401247868","https://openalex.org/W7214159199","https://openalex.org/W7168024271","https://openalex.org/W7131451212","https://openalex.org/W6996499140","https://openalex.org/W7206439143","https://openalex.org/W7203943305","https://openalex.org/W7127591191"],"abstract_inverted_index":{"AWS":[0,41,113],"Lambda":[1,33,51,85,125],"is":[2],"the":[3,32,79],"dominant":[4],"serverless":[5],"compute":[6],"platform,":[7],"executing":[8],"over":[9],"one":[10],"trillion":[11],"function":[12],"invocations":[13],"per":[14],"month":[15],"across":[16,48],"enterprise":[17],"cloud":[18],"environments.":[19],"This":[20,61],"paper":[21,62],"investigates":[22],"a":[23,57,64,68,73,92,105,127],"critical,":[24],"underexplored":[25],"attack":[26],"surface:":[27],"plaintext":[28],"credential":[29,101,137],"exposure":[30],"through":[31],"GetFunction":[34],"API.":[35],"When":[36],"an":[37],"attacker":[38],"obtains":[39],"high-privilege":[40],"credentials,":[42],"every":[43],"environment":[44,121],"variable":[45,122],"stored":[46],"inline":[47],"all":[49],"deployed":[50],"functions":[52,86],"becomes":[53],"immediately":[54],"accessible":[55],"in":[56,71,124],"single":[58],"automated":[59],"sweep.":[60],"presents":[63],"forensic":[65],"reconstruction":[66],"of":[67,81],"real-world":[69],"incident":[70],"which":[72],"compromised":[74],"root":[75],"access":[76],"key":[77],"enabled":[78],"exfiltration":[80],"credentials":[82],"from":[83],"~1000":[84],"within":[87],"50":[88],"minutes.":[89],"We":[90],"describe":[91],"structured":[93],"investigation":[94],"methodology,":[95],"present":[96],"open-source":[97],"tooling":[98],"for":[99],"mass":[100],"classification,":[102],"and":[103,108],"propose":[104],"prioritised":[106],"rotation":[107],"migration":[109],"framework":[110],"based":[111],"on":[112],"Security":[114],"Best":[115],"Practices.":[116],"Our":[117],"findings":[118],"demonstrate":[119],"that":[120,131],"storage":[123],"constitutes":[126],"systemic":[128],"architectural":[129],"vulnerability":[130],"requires":[132],"organisational":[133],"remediation":[134],"beyond":[135],"individual":[136],"rotation.":[138]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-09-11T00:00:00"}