Software Development Activities for Secure Microservices

The decomposition of an application into a set of distributed and collaborating microservices using microservices architecture principles, increases an application’s attack surface. A preliminary risk analysis can provide an understanding of security threats from a hypothetical attacker’s point of view. Identified security threats equip software engineers of microservices compositions with knowledge of assets most likely to be targeted, the most likely attack vectors, and the potential attacker’s profile. The knowledge is useful to ensure that microservices compositions are designed to avoid vulnerabilities and to withstand any attack, and in the event of an attack to ensure that adverse consequences of an attack are minimized. In this regard, this paper aims to identify security threats that could arise as a result of flaws in the design of microservices compositions and harm that may arise from misuse of a microservices composition by malicious users. The preliminary risk analysis leads to a list of security requirements to be met by this research to be able to develop secure microservices compositions. The contribution of this review is a list of development activities for secure microservices.