5 critical components of a microservices security plan

Adopt service mesh

Developers find some of the biggest changes in a container system within the network layer. Unlike the simple client-server requests found in monolithic apps, microservices route requests across the network. Communication travels internally instead of externally, so application-to-host communication is no longer the bulk of network requests. Instead, the communication among various services at the application layer comprises the bulk of communications. Microservices change communications from a one-to-one model to a many-to-many model.

Numerous tools, including Istio, Linkerd and Flannel, are available to help teams adopt the service mesh approach that's typically characteristic of a microservices system. Tools built to handle a complex network will ultimately bolster microservices security by resolving visibility and management concerns.

Think about monitoring, logging and tracing

To gain greater visibility across the network, your security efforts need a combination of metrics, logs and tracing. Performance metrics during runtime are essential in order to keep an eye on every layer of the stack. Prometheus is the leading monitoring tool for Kubernetes and provides vital performance data. To dig a bit deeper, a logging tool, like ELK (Elasticsearch, Logstash and Kibana) Stack or Sumo Logic, gives you the necessary granular details when you investigate a security breach.

Distributed tracing provides a visual picture of latency across the lifecycle of a request or process. Visual monitoring can save time and help admins respond to attacks faster. Tools like Jaeger and Zipkin take an open and distributed approach to tracing.

Fortify data security

Data security is also critical. In a microservices system, data resides in multiple locations, moves around frequently and is accessed by numerous parts of the system. Therefore, you need to secure it both in transit and at rest.

Depending on which management platform you use, there are a few different ways to implement data security. For example, Google Cloud uses a combination of encryption methods, such as Transport Layer Security (TLS), BoringSSL and certificate authority (CA). TLS and Secure Sockets Layer (SSL) are industry standards for network security, and Google extends these open standards to work more efficiently with its cloud platform. Google also uses CA to authenticate communication between services.

Manage access thoroughly

It's critical within microservices to properly manage sensitive information like passwords, tokens and access keys. It isn't safe to hardcode this sensitive information into the application. Thus, container management systems developed exclusive features that allow access to credentials on an as-needed basis. These features use the principle of least privilege and give out unique access keys that are only active for a short time. As a result, security information stays current, and even if you compromise one part of the system, you can contain damage because the rest of the system is dynamic and not easy to access with a single password or compromised user.

Implement threat detection in production

In a production setting, your business can't manually enforce rules for security. In these scenarios, tools like Project Calico take a policy-based approach to network security. Calico lets developers define their intent with resources and automates a large part of the introduction of those intentions. As new instances are added or removed and as communication occurs, Calico screens them and ensures they stay within the bounds of the developer's intent. By further enabling microfirewalls around each instance, Calico enables a distributed security system specific to microservices applications. Rather than using a single peripheral firewall, Calico enables the management of numerous, granular and independent firewalls. This capability provides great isolation in the event of an attack.

Despite all these measures, there are still unknowns when it comes to microservices security. These conundrums can prove fatal if there are no measures in place to handle them. A mature container ecosystem should include a collection of security tools that use machine learning to discover and address new security issues. These tools usually integrate well with others and provide a holistic view of security in microservices applications. Furthermore, they pre-emptively block attacks by automatically analyzing data at a large scale and identifying suspicious patterns. Machine learning security tools, like Twistlock and Aqua Security, cover the last mile in security for microservices applications.

As you plan for microservices security, there are many factors to consider, including the network, the container platform chosen and where data resides. Build a much more secure microservices app by understanding how these factors uniquely affect application security and by managing them successfully.