# Security in Cloud-Native Services: A Survey
## 2 Challenges for Security in Cloud-Native Services  
Cloud-native services offer significant advantages such as scalability, flexibility, and cost-efficiency. However, establishing secure cloud-native services is quite difficult given the fact that there are numerous inherent challenges. This section is dedicated to briefly exploring some of them. In the frame of cloud-native services, the processing and storage of sensitive data present additional cybersecurity challenges. Furthermore, safeguarding user data and proprietary information is crucial to maintain trust, comply with privacy regulations, and prevent potential legal, monetary, and reputational consequences. Furthermore, the dynamic and scalable nature of cloud-native services introduces unique challenges when it comes to maintaining a consistent security posture; although scalability is a key advantage, it also necessitates careful consideration of security implications. The notion that the distributed nature of cloud-native services introduces specific cybersecurity challenges is supported by the examination of the types of attacks that they are prone to [50]. * **Malware Attacks [51]:** The distributed nature of cloud-native services makes them vulnerable to malware attacks. Malicious software can infiltrate one part of the infrastructure and spread across the interconnected components, potentially causing data breaches, unauthorized access, or disruption of services. Additionally, malware can be designed to exploit specific weaknesses in cloud-native architectures, compromising the security and integrity of the entire system. * **Man-in-the-Middle (MITM) Attacks [52]:** The distributed nature of cloud-native services also increases the risk of Man-in-the-Middle attacks. In such attacks, an attacker intercepts and alters the communication between two parties without their knowledge. This can lead to data leakage, unauthorized access, or manipulation of sensitive information. MITM attacks can exploit vulnerabilities in communication channels, weak encryption protocols, or compromised certificates. * **DDoS Attacks [53]:** Cloud-native services are also susceptible to Distributed Denial of Service (DDoS) attacks, where a large number of compromised devices flood the network or services with excessive traffic, overwhelming the infrastructure and causing service disruptions. These attacks, which are also referred to as Cloud Zombie attacks [54], can be devastating for cloud-native services as they rely heavily on network connectivity and availability [55]. Furthermore, there have been certain variations of this type of attack that are designed to exploit the autoscaling capabilities of cloud environments [56]. These variations include Yo-Yo attacks [57], which rely on producing periodic bursts of traffic to oscillate the auto-scaling system between scale-out and scale-in status inducing economic loss to the tenant. In order to better understand the intricacies that are intertwined with tackling such attacks, it is worth examining Link Flooding Attacks (LFAs) [58], which have emerged as another prominent example of DDoS Attacks. LFAs aim to disrupt the network connectivity of numerous users by congesting critical network links. Essentially, adversaries seek to overwhelm these links by injecting a substantial volume of flows that simultaneously traverse a specific set of core network links. The challenge lies in the fact that adversaries can employ low-volume, individual flows that blend with regular traffic, making it arduous for network operators to implement efficient countermeasures against LFAs. Research conducted by [PERSON] et al. [59] included launching an LFA on a specific link without any knowledge of the network topology necessitates adversaries to transmit five times more flows compared to when they possess such information. Similarly, the number of flows required to execute an LFA against a target link increases exponentially when the topology remains unknown.