Microservices: Security
2h 27mAdvanced2025-01-24
Authors
Kevin Bowersox
Full-Stack Java Developer, Instructor
Course details
Cyberattacks are on the rise—and your microservices may very well be underprotected. Microservices present new safety considerations, and while protective techniques exist, the implementation can be complex and challenging to understand. This course provides developers with a playbook for safeguarding such services using various strategies and levels of security. Learn about security concepts that must be addressed for all information systems and explore microservice-specific concerns like distributed security checks and advanced identity management. Instructor Kevin Bowersox discusses patterns for establishing identity management, access control, and secure communications between services in a microservice-based system. Kevin also goes in depth on how you can leverage API gateways and identity providers to create better defenses, use principles to secure containers that are commonly used for microservice deployments, and more.
Skills covered
OpenIDApplication SecuritySoftware ArchitectureJavaOracleProjectCybersecurityProgramming LanguagesSoftware Development
Concepts
0. Introduction
- 01 - Securing microservices
- 02 - Microservices learning curve
1. Microservice Security Foundations
- 03 - Microservice concepts
- 04 - Security fundamentals
- 05 - Microservice security challenges
2. Identity Management and Access Control
- 06 - Distributed access management patterns
- 07 - Identity and Access Management platforms
- 08 - API gateways
- 09 - Access scenarios
- 10 - Work with IAM platforms
3. Token-Based Security and Standards
- 11 - Tokens
- 12 - OAuth 2 primer
- 13 - OAuth in Microsoft Entra
- 14 - Register client applications
- 15 - Issuing tokens
- 16 - Work with OAuth 2.0 endpoints
- 17 - Issuing identity tokens with OIDC
- 18 - Token validation
- 19 - Token maintenance and protection
4. Security between Microservices
- 20 - MTLS
- 21 - Securing east to west traffic
- 22 - Monitoring and logging
- 23 - Service mesh
5. Application and Container Security
- 24 - Throttling and rate limiting
- 25 - Container runtime security
- 26 - Image security
- 27 - Audit container security
- 28 - Secrets management
- 29 - Secure pipelines
- 30 - Prevent leaked credentials
- 31 - Keep secrets with Key Vault
Conclusion
- 32 - Securing microservices