Security Assessment Framework for Microservices-Based Applications Using Automated Penetration Testing
Main Article Content
Abstract
Applications that employ microservices have become very popular following their scalability, modularity, flexibility and continuous delivery of software. Nonetheless, the complexity of their distributed nature brings about complex security issues such as the relatively vulnerable service interfaces, insecure inter-service communications, and vulnerabilities in authentication, weak authorization policies, and augmented attack surfaces. Conventionally used security assessment methods tend to rely on manual penetration testing which is time-consuming, inconsistent and is hard to scale in a dynamically changing microservices environment. In an endeavor to identify, analyze and prioritize the security weaknesses in a systematic way across the distributed service architectures, this study has introduced a Security Assessment Framework of Microservices-Based Applications using Automated Penetration Testing. The proposed framework is a combination of automated reconnaissance, service discovery, the identification of vulnerabilities, the analysis of the attack-path and controlled penetration testing as a cohesive workflow evaluation. The interfaces, APIs, authentication systems, the communication system, as well as the publicly accessible services are security tested with the aim of determining potential vulnerabilities to detect their security worth. A system comprises a risk based prioritization system, which will prioritize the identified vulnerabilities based on severity, exploitability and possible impact of the service. This framework will also help in a continuous security evaluation through the introduction of automated testing in microservices development and deployment processes. The proposed solution offers an organized and systematic method of security testing, lessens on the reliance on a manual analysis, and enhances the visibility of distributed attack surfaces. Security teams and the developers can also use the framework to improve security of microservice using the application lifecycle.
Article Details
Section
How to Cite
References
[1] Abidi, S., Bennacer, H., &Kazar, O. (2019). A web service security governance approach based on dedicated micro-services.Procedia Computer Science, 159, 2247–2254. https://doi.org/10.1016/j.procs.2019.09.192
[2] Gerking, C., Dziwok, S., Heinzemann, C., &Schäfer, W. (2019). Component-based refinement and verification of information-flow security policies for cyber-physical microservice architectures.In 2019 IEEE International Conference on Software Architecture (ICSA) (pp. 61–70).IEEE.https://doi.org/10.1109/ICSA.2019.00015
[3] Guija, D., Shousha, M., &Openo, E. (2018). Identity and access control for micro-services based 5G NFV platforms. In Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES '18) (Article 66, pp. 1–10).Association for Computing Machinery.https://doi.org/10.1145/3230833.3233255
[4] He, X., Ren, L., & Li, Z. (2017). Authentication and authorization of end user in microservice architecture.Journal of Physics: Conference Series, 910, Article 012060. https://doi.org/10.1088/1742-6596/910/1/012060
[5] Hannousse, A., &Yahiouche, S. (2021). Securing microservices and microservice architectures: A systematic mapping study.Computer Science Review, 41, Article 100415. https://doi.org/10.1016/j.cosrev.2021.100415
[6] Ahmadvand, M., Pretschner, A., &Kelbert, F. (2018). Integrity protection against insiders in microservice-based infrastructures: From threats to a security framework. In P. Milazzo, D. Varró, & M. Wimmer (Eds.), Software Technologies: Applications and Foundations (pp. 419–434). Springer.https://doi.org/10.1007/978-3-030-04771-9_31
[7] Bánáti, A., Kertész, A., &Németh, Z. (2018). Authentication and authorization orchestrator for microservice-based software architectures.In 2018 41st International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO) (pp. 1180–1185).IEEE.https://doi.org/10.23919/MIPRO.2018.8400215
[8] Brenner, S., Wulf, C., Goltzsche, D., Weichbrodt, N., Lorenz, M., Fetzer, C., &Kapitza, R. (2017). Secure cloud micro services using Intel SGX. In L. Y. Chen & H. P. Reiser (Eds.), Distributed Applications and Interoperable Systems (pp. 177–191).Springer.https://doi.org/10.1007/978-3-319-59665-5_13
[9] Chen, C. (2019). With great abstraction comes great responsibility: Sealing the microservices attack surface. In 2019 IEEE Cybersecurity Development (SecDev) (pp. 101–110).IEEE.https://doi.org/10.1109/SecDev.2019.00028
[10] Fetzer, C. (2016). Building critical applications using microservices.IEEE Security & Privacy, 14(6), 86–89. https://doi.org/10.1109/MSP.2016.129
[11] Jander, K., Braubach, L., &Pokahr, A. (2018). Defense-in-depth and role authentication for microservice systems.Procedia Computer Science, 130, 456–463. https://doi.org/10.1016/j.procs.2018.04.047
[12] Jander, K., Braubach, L., &Pokahr, A. (2019). Practical defense-in-depth solution for microservice systems.Journal of Ubiquitous Systems and Pervasive Networks, 10(1), 17–24. https://doi.org/10.5383/JUSPN.10.01.003
[13] Krämer, M., Frese, S., &Kuijper, A. (2019). Implementing secure applications in smart city clouds using microservices.Future Generation Computer Systems, 99, 484–498. https://doi.org/10.1016/j.future.2019.04.042
[14] Zaheer, Z., Liang, C., Yu, S., Bavier, A., & Rexford, J. (2019). EZTrust: Network-independent zero-trust perimeterization for microservices. In Proceedings of the 2019 ACM Symposium on SDN Research (SOSR '19) (pp. 89–95). Association for Computing Machinery.https://doi.org/10.1145/3314148.3314352