Microservices have refashioned the way modern apps are developed. Previously, monolithic architecture was used for app development. A monolithic app is made from a single unit with three parts: a database, a client-side UI that runs on the user’s system or browser, and a server-side app. But in microservices, an app consists of multiple units. Each of these units runs alone and connects via APIs. Although this makes an app fast and scalable, it poses a security risk for the following reasons:
- Decentralized development. Many teams are developing at the same time, hence, overseeing the app’s security centrally is very difficult.
- Secret storage. Suppose a user is trying to log in to your app. In a microservices architecture, the login details must be stored in a cache. The storing needs to be done in such a way that the app doesn’t ask users for login details every time they try to access a feature. A third party can easily access these details unless they’re secure. Monitoring the security of these externally stored details can be difficult.
To deal with this, companies are tuning their security protocols. They’re also adopting some best practices to ensure their app’s security. On that note, this post will discuss seven best practices for microservices security.
Use an API gateway
Do you know what the most vulnerable zones of your microservices application are?
- The point where the user is trying to access something
- Points of authentication or authorization
The reason for the threat is that in these zones, you’re exposing your APIs to access from an external party. Hackers with malicious intent look for these weak zones and try to break into your app.
To secure these vulnerable zones, you can design the app in such a way that whenever a user tries to use or access something, the app makes a direct call to each service. In theory, this is a good idea, but practically speaking, it’ll lead to a lot of complex coding.
There’s a better idea: API gateways. Let’s discuss how they secure your app. APIs in microservices act as a bridge between different components. An API gateway provides a single entry point and directs the traffic to other services. For instance, you may have seen that just after logging into an app, a pop-up asks you to accept the license and grant permission to store cookies. But what does that mean? The API gateway granted you access. Now a session will be created and the app will store your user credentials in it. The next time you visit the same page or service, it’ll load from the cache memory instead of the server.
Because microservices have a distributed and ever evolving architecture, monitoring the security of each API is quite challenging. It’s common for the security team to lose sight of rapidly changing APIs. Thus, an API gateway makes your app more scalable and secure.
Implement a defense-in-depth strategy
It’s a common mistake to think that a single firewall around the network will protect your app. Hackers are always looking to exploit the security layer and find ways to crack the sensitive zones of your app. A great way to protect these sensitive zones is to use the defense-in-depth strategy.
Consider the following example to understand this better. Suppose you have an e-commerce app. The most sensitive zones of your app are the user profile and the payment section. The diversified nature of microservices architecture allows your app to easily adapt to this strategy. All you need to do is to add multiple security layers to the sensitive zones. As soon as a hacker cracks one of the security layers, the hacker will have to face another one or more. Additionally, each security layer adds a different lens and approach to security, meaning that you’re getting additional protection and visibility, not just redundancy.
Implement a DevSecOps strategy
Using the right tool isn’t the end of the journey towards enhanced security all by itself. Another way to improve is for your development and operations teams to work closely with the security team—a practice that begat the term “DevSecOps.” This practice focuses on the need to develop a security foundation into DevOps. With the DevSecOps approach, the DevOps team includes security teams when designing the app’s architecture, rather than consulting with them once the app goes live. Development teams get concerned about security and implement the best practices to make their codes secure—thus securing their code during the initial development stage. Later, before deployment, an expert peer reviews the code to find security issues.
DevSecOps also involves automated code scanning and constant app monitoring to prevent any unwanted access.
Use a centralized tool for security and monitoring
It’s quite difficult to constantly monitor and protect microservices, due to their distributed nature. You’ll need a solid, reliable, and advanced monitoring system. Given the distributed nature of microservices, a Runtime Application Self-Protection (RASP) solution can work quite well. Sqreen’s RASP is one such tool. But why is this tool special for microservices security?
- RASP’s in-depth security discovers attacks that exploit production vulnerabilities.
- It reduces the risk of data breaches because it protects against OWASP’s top 10 threats, including XSS and SQL injections.
- It bridges the DevSecOps gap by allowing security, development, and operations teams to work together to improve security beyond the HTTP layer.
Moreover, with a dashboard that provides real-time visibility, you can monitor security incidents and always stay a step ahead of hackers.
Avoid writing your own crypto code
Unless you’re an expert in cryptography and security, avoid writing in-house crypto code. Over the years, developers have invested a great deal of time and resources in developing libraries that can encrypt and decrypt anything. Many of these libraries are open source, and over time, developers worked on them to resolve any security issues. If you’re trying to roll out an in-house crypto code, there’s a good chance that you’ll commit a security mistake at the initial stages. So, it’s always a good idea to choose a reliable library.
Secure your app at the services level
Within a microservices architecture, the components of a monolith are broken down into multiple distinct services. There, they connect to form the app. The idea behind splitting the monolith into services is to make apps scalable, fast, and agile. Traditional security protocols are mostly network security tools based on the perimeter. They don’t have visibility into specific services and their interaction with the system.
Ensure that you include a security solution to protect your distinct services at their level, not just at the perimeter. The suite provided by Sqreen can monitor both monolith and decoupled architectures, including microservices. Contact Sqreen for a demo.
Secure with multifactor authentication
When a user logs into your system, using a single piece of information like the username and password isn’t enough. To make your app more secure against account takeover attempts, you should use multifactor authentication. For instance, you can ask the user for a password as well as a one-time password (OTP) sent to the user’s mobile number and/or email. You can take security to a whole new level by implementing biometric scanning. Using multifactor authentication is an example of layered defense-in-depth. The goal is to prevent hackers from accessing any secured component by adding multiple security layers.
Adopt best practices and ensure optimum security of your microservices
By considering the potential problems around microservices security—and ways to solve them—we can conclude that microservices pose new and unique challenges for security, which require new approaches. Remember that there’s always scope for innovation when it comes to security. Rather than depending on old approaches, it’s best to rely on a cutting-edge solution like RASP that can deal with modern threats. So, try out a tool, adopt the best practices, and ensure optimum security for your app.
—-
This post was written by Arnab Roy Chowdhury. Arnab is a UI developer by profession and a blogging enthusiast. He has strong expertise in the latest UI/UX trends, project methodologies, testing, and scripting.
