CISSP 9.13 - Microservices

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series examines how modern applications are assembled from many small, connected pieces. Continuing Domain 3, it considers what happens to security when independent services are wired together into one larger system, why so many engineering teams prefer building this way, and where the seams between the parts deserve the closest guarding.

Frequently Asked Questions

Why do integrated architectures raise new risks?

When you wire many technologies and processes together, fresh weaknesses appear that none of the pieces had alone. Bolting existing services into a new application creates something novel with security that is untested and unproven, so watch especially for single points of failure and for weak spots that emerge only once the parts interact, and vet every new deployment before it reaches production or the public Internet.

What is a microservices architecture?

It is a style where an application is built as a collection of small, independent, loosely coupled services. Each microservice handles one specific business capability and runs as a self-contained unit with its own data and its own way of communicating, so you can build, update, and scale each one without disturbing the rest.

What role do the connecting interfaces play?

They are the language the services speak to each other. Each microservice exposes a well-defined interface that says exactly how others may request or change its data, and these channels let the services coordinate and work as one larger application while each service is developed and deployed on its own.

Why do teams choose microservices?

Because the style turns one giant, tangled system into small, self-contained functions that are far easier to manage. It also lets multiple teams build separate services at the same time without stepping on each other, which means more flexibility, faster delivery, and cleaner scaling, with each capability able to grow or be replaced on its own.

What security concerns come with microservices?

The distributed, interconnected nature of the design is its strength and also its exposure, so you secure every service and every connection between them. Enforce strong authentication and authorization, encrypt data both in transit and at rest, lock down the interfaces, often behind a gateway, build in thorough monitoring and logging, and if services run in containers, secure those images, configurations, and running behavior too.

Reference: This article is based on concepts discussed in CISSP 9.13 - Microservices.