Microservices Security Workshop: From Build to Production
2h 22mIntermediate2025-07-30
Authors

James Berthoty
Course details
Microservice-based architectures have become the new standard for deploying web apps in the cloud. While there are many development benefits, security challenges increase as code spreads across thousands of repos and different environments. In this course, instructor James Berthoty shows you how to secure microservice architectures—from threat modeling to runtime protection. Along the way, develop the core skills and technical know-how required to start building or improving a robust microservice security program.
Learning objectives
Analyze microservice architecture patterns to identify potential security vulnerabilities and attack vectors.
Design comprehensive threat models for containerized applications using industry-standard frameworks.
Evaluate source code and dependencies for security issues across distributed codebases.
Implement secure authentication and authorization controls between microservices.
Create automated security testing pipelines that integrate with CI/CD workflows.
Learning objectives
Analyze microservice architecture patterns to identify potential security vulnerabilities and attack vectors.
Design comprehensive threat models for containerized applications using industry-standard frameworks.
Evaluate source code and dependencies for security issues across distributed codebases.
Implement secure authentication and authorization controls between microservices.
Create automated security testing pipelines that integrate with CI/CD workflows.
Skills covered
Application SecuritySoftware ArchitectureDevOps FoundationsDevOpsCybersecuritySoftware DevelopmentOne-Off
Concepts
0. Introduction
- 01 - Why microservices are really scaryand exciting
- 02 - How microservices made security worse
- 03 - How microservices made security better
- 04 - Challenge - Setting up your microservices for real
- 05 - Solution - Setting up your microservices for real
1. Designing Secure Microservices
- 06 - How to threat model in a microservice world
- 07 - Realistic team workflows for security involvement
- 08 - James' Top 10 microservice vulnerabilities
- 09 - Designing authentication
- 10 - Always use a framework
- 11 - Designing API gateways
- 12 - I've got 99 problems and they're all auth-related
- 13 - Never forget the front-end
- 14 - Challenge - Getting hands-on with JWT
- 15 - Solution - Getting hands-on with JWT
2. Building Secure Microservices
- 16 - Secure libraries for common languages
- 17 - JWT crash course
- 18 - Static application security testing (SAST)
- 19 - Software composition analysis (SCA)
- 20 - Secrets management
- 21 - Infrastructure as Code (IaC) patterns
- 22 - Other shift-left stuff
- 23 - Challenge - Run and fix a SAST scan
- 24 - Solution - Run and fix a SAST scan
3. Deploying and Testing Secure Microservices
- 25 - CI CD security
- 26 - Securing artifact repositories (artifactories)
- 27 - Container scanning
- 28 - DAST for microservices
- 29 - Microservice backups
- 30 - Encryption and service mesh
- 31 - Red teaming and penetration testing (pentesting)
- 32 - Challenge - Run and fix a container scan
- 33 - Solution - Run and fix a container scan
4. Monitoring Secure Microservices
- 34 - Web application firewalls (WAF)
- 35 - Emerging security technologies
- 36 - APM, ADR, oTel, and the wonderful world of monitoring
- 37 - Creating custom security alerts
Conclusion
- 38 - Tools or no tools
- 39 - Where to get started
- 40 - Team alignment and security champions
- 41 - Next steps