Secure Containers and Microservices Series

Last updated: May 9, 2024

CSA’s Secure Containers and Microservices Series

Application containers and a microservices architecture, as defined in NIST SP 800-180, are being used to design, develop and deploy applications leveraging agile software development approaches such as Development Operations. Security of application components needs to be considered throughout the software development life cycle (SDLC). NIST 800-160, Systems Security Engineering, defines the need for trustworthy secure systems based on a wide variety of stakeholder needs. Over the past several years, the CSA has released a series of documents which outline the best practices for implementing security containers and microservices.

The first document in the series “Challenges in Securing Application Containers and Microservices” presents the challenges Architects, Developers and Operators will encounter when designing, deploying and operating secure application containers and microservices. Two companion documents were released outlining the best practices that should be followed to address the challenges outlined. One document specifically addresses containers (“Best Practices for Implementing a Secure Application Container Architecture”) and the other addresses microservices (“Best Practices in Implementing a Secure Microservices Architecture”). These recommendations and best practices were intended for Developer, Operator and Architect audiences.

The final document in this series is a companion to the aforementioned “Best Practices in Implementing a Secure Microservices Architecture.” Readers of that document were presented with guidance about the engineering of trustworthy secure systems, with the last chapter focused through the lens of the Developer, the Operator, and the Architect, while the Microservices Architecture Pattern (MAP) document serves to propose a repeatable approach to architecting, developing and deploying Microservices as a MAP. This paper describes the key elements of the MAP, how they should be designed and deployed, and shifting security and compliance left via a continuous compliance-as-code approach.

Documents in the Series