# KubeHound: Detecting Microservices' Security Smells in Kubernetes Deployments
## 3 Related Work  
Securing microservice applications is crucial [5], as also witnessed by the number of recent contributions in the field. For instance, [PERSON] et al. [9] propose a technique to automatically identify security threats in microservice applications, starting from a collection of formally defined security characteristics. Other examples are given by [PERSON] et al. [10] and [PERSON] et al. [11], who support checking microservice applications for security by extracting security-aware dataflow diagrams and providing KPI metrics to measure the effectiveness in securing applications, respectively. Automatically detecting the security smells proposed by [PERSON] et al. [1] in microservice applications is, however, still an open problem [8], as also witnessed by the recent review by [PERSON] et al. [12]. Our objective is therefore to complement the existing studies on microservices' security smells [1,8] by providing concrete techniques for their detection and a first tool for support. At the same time, there exist methods and tools for analysing microservice applications' security that can also be used to detect other security smells, sometimes partly overlapping with those of [PERSON] et al. [1]. The closest to our proposal is perhaps the security smell detection proposed by [PERSON] et al. [13]. They propose a static analysis approach to detect smells in Infrastructure-as-Code (IaC) scripts. Their approach differs from ours in its objectives, as it aims at detecting IaC security smells, rather than microservices' security smells. The security smells detected by [PERSON] et al. [13], however, cover two instances of microservice security smells that we also consider, viz., _Hardcoded Secrets_ and _Unnecessary Privileges to Microservices_, which can be detected on the IaC scripts used to deploy a microservice application. The other microservice security smells by [PERSON] et al. [1] cannot be detected with the method proposed by [PERSON] et al. [13]. There also exist production-ready tools for security analysis, such as Kubesec.io [14], Checkov [15], Kube-bench [16], Kube-hunter [17], OWASP Zed Application Proxy (ZAP) [18], OpenAPI-fuzzer [19], and Sonarqube [20], for instance. Kubesec.io [14] implements a static analysis of Kubernetes configuration files, aimed at detecting known security weaknesses. More generally, Kubesec.io [14] provides a priming tool to detect misconfigurations that may induce vulnerabilities for a microservice application deployed with Kubernetes. Checkov [15] is another tool based on the static analysis of deployment configuration files. It enables the detection of security weaknesses due to misconfigurations in the Kubernetes configuration files and Dockerfiles, among others. Checkov features manybuilt-in policies, each targeting a specific known security weakness, and it provides a Python interface to support extending it with custom policies. Kube-bench [16] and Kube-hunter [17] instead implement two different dynamic analyses to detect security issues in containerised applications running on some Kubernetes clusters. Kube-bench [16] checks whether a running application adheres to the security guidelines defined by the Center for Internet Security [21]. This is carried out by inspecting the configuration of the cluster where the application is running by running Kube-bench either directly on its nodes or as a privileged pod on the cluster. Kube-hunter [17] instead performs a black-box vulnerability assessment of the cluster. Kube-hunter can also run a so-called \"active scan\" that will try to automatically exploit the vulnerabilities found to find even more vulnerabilities to automatically create exploitation chains. OWASP ZAP [18] and OpenAPI-fuzzer [19] are two other tools enacting dynamic analyses for finding the security vulnerabilities/weaknesses of running applications. They, however, differ from the above-described tools in their scope and method, focusing on the APIs of running services and enacting security testing.