# Security in Cloud-Native Services: A Survey
## 4 Enabling Technologies for Cybersecurity in Cloud-Native Services
### Service Mesh  
The rise of microservice-based architectures is not without its challenges. Despite all the benefits and flexibility, such architectures are composed of numerous and dynamic components that need to communicate and interact with each other. Hence, one of the biggest challenges is how to deal with the exponential and complex relationship between all the moving parts that form a cloud-native application. Service mesh [91] is an increasingly widely used solution to address challenges of complex and exponential relationships between components [92]. The service mesh concept has gained a lot of strength to achieve network and resource observability; a key feature within any cloud-native environment. An example of this approach, [PERSON] et al. [93] used Istio and Envoy for data collection and full visibility into infrastructure resources, network traffic, and application behavior in the environment. Similarly, the INSPIRE-5 Gplus [[https://www.inspire-5](https://www.inspire-5) gplus.eu/inspire-5 gplus-high-level-architecture/]([https://www.inspire-5](https://www.inspire-5) gplus.eu/inspire-5 gplus-high-level-architecture/) (accessed on 15 August 2023) project adopted Istio in implementing the integration fabric of its 5G security management framework [94]. Service mesh is an infrastructure layer for handling service-to-service communication without imposing changes to services [92]. Service meshes provide a more cloud-native and comprehensive strategy to control network traffic, apply distinct policies, and cope with the complexity and dynamism of service communications. Service mesh addresses  
Figure 2: Comparison between perimeter security model and zero-trust model. such challenges by shifting common orchestration-related functions from the application logic to the infrastructure layer. The immediate benefit is the simplification of applications that would otherwise need to include them. Moreover, by abstracting common functions to the infrastructure layer, one might envision a more standard approach to implementing them. As a summary, service meshes are used to provide the following key features:  
* **Service Registry and discovery**: Mechanisms used to facilitate the process of discovery and registry of new components and services. * **Load balancing**: The ability to balance network traffic depending on aspects such as latency, infrastructure, and health status. * **Fault tolerance**: The ability to redirect requests to an alternate instance when the original is degraded or not available. * **Traffic monitoring**: The ability to monitor all the network traffic and key metrics between the mesh of microservices. * **Encryption, Authentication, and Access Control**: The possibility of dynamically encrypting the network communication on the fly as well as the possibility to authorize and authenticate network communication between services. Although conceptually not restricted, the rise of service meshes is tied to cloud-native applications [95]. As depicted in Figure 3, a service mesh is constituted of two planes: data and control planes. The data plane is composed of a set of proxies known as sidecars, co-located in each microservice. The sidecars are proxies that intermediate the communication with other proxies. The combination of several proxies forms a mesh network intercepting the communication between microservices, mediating and controlling all network communications, and collecting telemetry. Together, they have full visibility over all microservice communications, being able to perform health checking, filtering, routing, load balancing, service discovery, authentication, authorization, collecting telemetry, etc. The control plane is responsible for the overall orchestration of sidecar behavior. Herein, the proxies provide the capabilities to configure the components in order to collect telemetry and enable observability and also to apply policies for routing traffic [96].