Microservices

As an implementation of service-oriented architecture (SOA) for cloud systems, microservices use lightweight protocols to provide a highly isolated messaging vehicle to pass information between applications. Converting an application to a microservices architecture involves breaking up larger programs into objects, which can be managed by the system as separate execution threads. The refactored application thus performs the same complex tasks while providing greater resilience. Developing a service to "do one thing and do it well" is a core tenet of the microservices approach.

This modularization of the code base has several advantages. Maintenance is simplified, as a single service has a more limited scope to maintain than a monolithic program that accomplishes a more extensive set of related tasks. Converting or refactoring large, complex batch processing into realtime processing can be done without wholesale redesign and recoding of those applications, if they can easily be converted to use microservices instead. Microservice architectures can quickly scale up or down to meet demand due to their individual microservices running as independent processing threads. Dynamic scaling and load balancing can be much more difficult to achieve with legacy (non-microservice) systems and architectures.

Vulnerabilities

Vulnerabilities inherent to microservices include the following:

• Authorization. Improperly developed microservices will often be run at high privilege for the convenience of the service. If the microservice is compromised, the attacker could leverage the service for other attacks.
• Quality of service. Poorly structured microservices consume more resources to support the microservice than legacy applications. For example, spawning a virtual machine (VM) to deploy a short-lived microservice requires the loading of the entire VM, whether the capabilities are needed or not.
• Denial of service. To communicate, microservices rely on lightweight protocols (i.e., REST, short for Representational State Transfer). Any weakness in the protocol itself opens the service to compromise.

Mitigations

Mitigations for microservices include the following:

• Use authentication and authorization services. Implement efficient identity and access management (IAM) protocols, such as Auth 2.0 or services based on Security Assertion Markup Language (SAML), and enforce least privilege against service accounts.
• Where possible, implement microservices in containers or within serverless environments. This can reduce the resource impact of the microservice and improve performance.
• Leverage application programming interface (API) gateways to protect microservices from inappropriate access. This provides a mechanism to direct service requests appropriately, mediate authentication and authorization between the requester and the service, and standardize the implementation of APls across the infrastructure.