![](bg8.png)
nents (A9:2017) or insufficient logging and monito-
ring (A10:2017). Also, Dev-ops, a software engineer-
ing culture and practice aimed at unifying develop-
ment and operation that is often used in conjunction
with microservices, introduces non-production envi-
ronment exposure as a microservice-specific risk.
The main conclusions of this paper are that 1) mo-
dern computer systems are very complex, due to the
many layers they are made up from, and 2) security
is hard, takes effort, and should be an important con-
sideration from the beginning of a project instead of
an afterthought. At many points, security measures
were not taken “for simplicity” or because “(human)
resources were unavailable”. While this may have
been acceptable in the test system, a real-world pro-
duct should never be launched with this many issues
or areas of improvement.
We believe this shows very clearly why security is
such a difficult topic: The benefits are hidden and the
costs are high. The implementation of security in se-
veral microservices and in all system levels requires
effort and careful planning. Once a project has star-
ted, security can easily be neglected for more immedi-
ately pressing concerns and may be difficult and even
more expensive to add later. Even if security is a con-
sideration from the beginning, there is often a choice
between complexity and practicality. For example, to
increase security, it would be possible to implement
not only certificate-based authentication and authori-
zation, but network policy-based authentication and
authorization as a second layer of security. However,
this would increase costs and complexity. Although
the certificate-based method is clearly more secure
than the certificate-based method, it is also more com-
plex to implement than a token-based method because
an additional infrastructure is required to manage all
cryptographic keys.
As a final summary, we conclude that security
should be a consideration from the very beginning of
planning a system, to be able to implement effective
and comprehensive security measures throughout the
project – especially if monolithic applications are to
be realized based on microservice applications.
ACKNOWLEDGEMENTS
The authors would like to thank Lena Feinbube, Leo-
nard Marschke, Cornelius Pohl, Robert Beilich, Tim
Basel, Timo Traulsen, Henry H
¨
ubler, Dr. Stephan
Gerberding, Wolfgang Schwab, and Ingo Schwarzer
for their support and assistance with this project.
REFERENCES
Amazon Web Services (2017). AWS Cloud Compli-
ance. https://aws.amazon.com/compliance/. (visited
on 2017/07/16).
Buest, R. (2014). Top 15 open source cloud compu-
ting technologies 2014. http://analystpov.com/
cloud-computing/top-15-open-source-cloud-
computing-technologies-2014-24727. (visited
on 2017/07/16).
Coles, C. (2017). AWS vs Azure vs Google Cloud Market
Share 2017. https://www.skyhighnetworks.com/
cloud-security-blog/microsoft-azure-closes-iaas-
adoption-gap-with-amazon-aws/. (visited on
2017/07/16).
Dragoni, N., Giallorenzo, S., Lafuente, A. L., Mazzara,
M., Montesi, F., Mustafin, R., and Safina, L. (2017).
Microservices: Yesterday, today, and tomorrow. In
Present and Ulterior Software Engineering, pages
195–216. Springer, Cham. DOI: 10.1007/978-3-319-
67425-4 12.
Felter, W., Ferreira, A., Rajamony, R., and Rubio, J. (2015).
An updated performance comparison of virtual machi-
nes and linux containers. In 2015 IEEE International
Symposium on Performance Analysis of Systems and
Software (ISPASS), pages 171–172. DOI: 10.1109/IS-
PASS.2015.7095802.
Fowler, S. J. (2016). Production-Ready Microservices:
Building Stable, Reliable, Fault-Tolerant Systems.
O’Reilly Media. ISBN: 978-1-4919-6597-9.
Galuba, W. and Girdzijauskas, S. (2009). Overlay Network,
pages 2008–2008. Springer US, Boston, MA. DOI:
10.1007/978-0-387-39940-9 1231.
Horsdal, C. (2016). Microservices in .NET Core: With C#,
the Nancy Framework, and Owin Middleware. Man-
ning Publications. ISBN: 978-1-61729-337-5.
Newman, S. (2015). Building Microservices. O’Reilly Me-
dia. ISBN: 978-1-4919-5035-7.
Open Web Application Security Project (2017). OWASP
top 10 security risks 2017. https://www.owasp.org/
index.php/ Top 10-2017 Top 10. (visited on
2018/01/24).
PCI Security Standards Council (2016). Payment
card industry (pci) data security standard, v3.2.
https://www.pcisecuritystandards.org/document
library?category=pcidss&document=pci dss. (visited
on 2017/07/16).
Richardson, C. (2017). Microservice Patterns. Manning
Publications Co. ISBN: 978-1-61729-454-9.
Security Considerations for Microservice Architectures
615