Microservice Security Metrics for Secure Communication, Identity Management, and Observability

Abstract

Microservice architectures are increasingly being used to develop application systems. Despite many guidelines and best practices being published, architecting microservice systems for security is challenging. Reasons are the size and complexity of microservice systems, their polyglot nature, and the demand for the continuous evolution of these systems. In this context, to manually validate that security architecture tactics are employed as intended throughout the system is a time-consuming and error-prone task. In this article, we present an approach to avoid such manual validation before each continuous evolution step in a microservice system, which we demonstrate using three widely used categories of security tactics: secure communication, identity management, and observability. Our approach is based on a review of existing security guidelines, the gray literature, and the scientific literature, from which we derived Architectural Design Decisions (ADDs) with the found security tactics as decision options. In our approach, we propose novel detectors to detect these decision options automatically and formally defined metrics to measure the conformance of a system to the different options of the ADDs. We apply the approach to a case study data set of 10 open source microservice systems, plus another 20 variants of these systems, for which we manually inspected the source code for security tactics. We demonstrate and assess the validity and appropriateness of our metrics by performing an assessment of their conformance to the ADDs in our systems’ dataset through statistical methods.

Static-Analysis-Based Solutions to Security Challenges in Cloud-Native Systems: Systematic Mapping Study

“…Considering the development stages, architectural design decisions (ADDs) tend to be novel. Zdun et al [ 14 ] introduced techniques to detect those secure tactics of ADDs to provide secure communication, identity management, and observability in microservice systems. Tuma et al [ 18 ] presented a dataset for the security design model, which they utilized to detect security design flaws with five model inspections.…”

A Systematic Literature Review of Inter-Service Security Threats and Mitigation Strategies in Microservice Architectures

“…Furthermore, microservices applications are frequently deployed in the cloud using virtualization technology, automated pipelines, and various third-party software, which further expands the attack surface. In discussing security within the context of microservices, it is essential to address several important aspects, such as the authentication and authorization [13] of both users and between services and applications.…”

“…It covers authentication, e.g., using Mutual Transport Layer Security (mTLS) and authorization, secure communication between services, e.g., using encrypted channels, and other securityrelated topics like service discovery, communication within a Service Mesh, the Sidecar Pattern [18], network segmentation and firewalls, and intrusion detection. The use of orchestration and container technologies, such as Kubernetes [19] and Docker [20], can increase the complexity of managing microservices and extend the range of potential attacks to include third-party vulnerabilities and other related issues [13,21,22]. The implementation of dedicated patterns, such as the Token Pattern [11], the API Gateway Pattern, and the use of a Service Mesh, are particularly effective in enforcing security measures within microservices [1,2].…”

Efficient Resource Utilization in IoT and Cloud Computing

“…Performance Efficiency [34,34,36,37,[37][38][39][40][41][42][43][44][45][46] Reliability [47][48][49][50][50][51][52][53][54][55][56][57] Security [58][59][60][61][62][63][64][65][66][67][68][69][70][71][72][73] Operational Policy-Based Functions [74][75][76][77][78][79][80][81][82][83]…”