Application Containers and Microservices

Application containers and microservices architecture, as defined in NIST SP 800-180, are being used to design, develop and deploy applications leveraging agile software development approaches such as DevOps. The security of application components needs to be considered throughout the Software Development Life Cycle. The use of containers and microservices have been increasingly implemented in organizations. This increase in popularity can be attributed to the ease with which they move through a lifecycle allowing for efficient restart, scale-up, or scale-out of applications across clouds. However, these unique characteristics also mean there are distinct security ramifications which must be considered.

The next evolution of the application architecture is the “service-oriented architecture” (SOA). In SOA, the entire gamut of solutions (e.g. supporting a business process) is broken up into multiple parts or components called services. The design of a microservices architecture is intended to address the limitations of SOA by enabling the individual microservices to communicate with each other using lightweight protocols such as Representational State Transfer (REST). Furthermore, the individual microservices can be developed in platforms best suited for them, allowing for heterogeneity in addition to independent scalability and deployment due to loose coupling between individual microservices. 

This new approach presents new security challenges such as an increased attack surface due to an increase in the number of components and secure service discovery as a result of the dynamic nature of service instances due to location changes.

This group assumes that readers have some knowledge of operating systems, networking, and security expertise, as well as expertise with application containers, microservices, and agile application development approaches such as DevOps. 

Please note that this project is a subgroup of the DevSecOps working group. To participate you can join our DevSecOps community and let the leaders know you are interested in this particular area of DevSecOps.