# Security in Cloud-Native Services: A Survey
## 4 Enabling Technologies for Cybersecurity in Cloud-Native Services
### Service Mesh
The service mesh concept is used as an architectural approach to enforce security policies on top of microservices network traffic. Although this approach has many benefits, they have not yet been fully investigated in the available literature. [PERSON] et al. [97] address this issue in a NIST publication. This publication presents some additional implementation guidance on security solutions for cloud-native environments, more specifically, how proxy-based service mesh components can collectively form a security infrastructure to support microservices. The topic of anomaly detection in cloud-native environments has new challenges and new relevance, as discussed in several works. [PERSON] et al. [98] discussed this problem for the detection  
Figure 3: Data and control planes of a service mesh, adapted from [[https://www.nginx.com/blog/what-is-a-service-mesh/](https://www.nginx.com/blog/what-is-a-service-mesh/)]([https://www.nginx.com/blog/what-is-a-service-mesh/](https://www.nginx.com/blog/what-is-a-service-mesh/)) (accessed on 15 August 2023). of web-based attacks on microservices, using Kubernetes and Istio. Similarly, in [99] the authors proposed an anomaly detection mechanism in API traffic to improve its security in microservice environments. Characteristics such as bandwidth, number of consecutive requests were some characteristics analyzed, concluding that such a mechanism is more accurate than a rule-based anomaly detection mechanism. On the other hand, both works do not cover automated mitigation of incidents (e.g., based on policies). Istio is a realization of an open-source service mesh platform that establishes control over the way microservices share data between them. It comprises a set of layered distributed applications providing traffic management, security, and observability at the service mesh level. Istio exposes APIs to enforce access control at mesh, namespace, and service levels. As a result of applying policies over a Kubernetes network, it becomes possible to configure security for service communications at the network and application layers. Istio APIs also provide support for integration with other components, such as telemetry or policy systems. The sidecars are deployed as Envoy proxies supporting compatibility issues. Envoy provides built-in functionality to cope with challenges, such as retries, delays, circuit breakers and fault injection, dynamic service discovery and load balancing, traffic management and routing, security policies, and rate limiting. Istio offers security advantages through strong identity, transparent TLS encryption, powerful policy, and authentication, authorization, and auditing (AAA) tools to protect services and data exchanged between them. However, another feature to highlight is its support for heterogeneous environments, including virtual machines (VMs), Kubernetes, and multi-domain settings [100]. It is not only a challenge to efficiently observe and understand, for instance, all the network traffic of an environment, but it is also crucial to have the means to apply mitigation measures and security policies effectively. One example of policy enforcement in cloud-native environments is the architecture proposed by [PERSON] et al. [101] that uses Istio combined with the Open Policy Agent (OPA) to execute policies. It should be noted that although this architecture presents key ideas focused on the authorization of communications through the set of defined policies, it does not present ways of detecting anomalies. OPA is an open-source, general-purpose policy engine that unifies the implementation of policy enforcement procedures across IT environments, such as the ones involving cloud-native applications. OPA enables decoupling policy decisions from software for policy enforcement, and whereas Istio policies are limited to networks, OPA allows a more comprehensive strategy to implement distinct policies and provide more control over deployments and containers.