2021/02/18 by Alexander Barabanov, Barabanov, Alexander, Denis Makrushin +1
Computer Science · #Cloud Computing and Resource Management #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection #Software System Performance and Reliability
paper · pdf · doi:10.48550/arxiv.2102.09435
openalex publication_date 2021/02/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Objective. Service-oriented architecture increases technical abilities for\nattacker to move laterally and maintain multiple pivot points inside of\ncompromised environment. Microservice-based infrastructure brings more\nchallenges for security architect related to internal event visibility and\nmonitoring. Properly implemented logging and audit approach is a baseline for\nsecurity operations and incident management. The aim of this study is to\nprovide helpful resource to application and product security architects,\nsoftware and operation engineers on existing architecture patterns to implement\ntrustworthy logging and audit process in microservice-based environments.\nMethod. In this paper, we conduct information security threats modeling and a\nsystematic review of major electronic databases and libraries, security\nstandards and presentations at the major security conferences as well as\narchitecture whitepapers of industry vendors with relevant products. Results\nand practical relevance. In this work based on research papers and major\nsecurity conferences presentations analysis, we identified industry best\npractices in logging audit patterns and its applicability depending on\nenvironment characteristic. We provided threat modeling for typical\narchitecture pattern of logging system and identified 8 information security\nthreats. We provided security threat mitigation and as a result of 11\nhigh-level security requirements for audit logging system were identified.\nHigh-level security requirements can be used by application security architect\nin order to secure their products.\n