An Empirical Study of Security Practices for Microservices Systems

TL;DR

This paper presents an empirical study analyzing security practices in microservices systems, resulting in a catalog of 28 practices validated by practitioners, aiming to improve security management in such architectures.

Contribution

The study provides the first comprehensive catalog of microservices security practices based on empirical analysis and practitioner validation, addressing a critical knowledge gap.

Findings

Practitioners find the 28 security practices useful.

The catalog can guide practitioners in securing microservices systems.

The study highlights less explored areas for future security research.

Abstract

Despite the numerous benefits of microservices systems, security has been a critical issue in such systems. Several factors explain this difficulty, including a knowledge gap among microservices practitioners on properly securing a microservices system. To (partially) bridge this gap, we conducted an empirical study. We first manually analyzed 861 microservices security points, including 567 issues, 9 documents, and 3 wiki pages from 10 GitHub open-source microservices systems and 306 Stack Overflow posts concerning security in microservices systems. In this study, a microservices security point is referred to as "a GitHub issue, a Stack Overflow post, a document, or a wiki page that entails 5 or more microservices security paragraphs". Our analysis led to a catalog of 28 microservices security practices. We then ran a survey with 74 microservices practitioners to evaluate the usefulness of these 28 practices. Our findings demonstrate that the survey respondents affirmed the usefulness of the 28 practices. We believe that the catalog of microservices security practices can serve as a valuable resource for microservices practitioners to more effectively address security issues in microservices systems. It can also inform the research community of the required or less explored areas to develop microservices-specific security practices and tools.