<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-microservices-threat-modeling
description: >-
  Threat model microservices including service mesh and Kubernetes security.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - microservices
  - service-mesh
  - kubernetes
  - api-gateway
  - container-security
  - zero-trust
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1190"
  - "T1071"
  - "T1046"
  - "T1610"
---

# Performing Microservices Threat Modeling

## Overview

Microservices architectures distribute the attack surface across dozens or hundreds of services
with complex inter-service communication. This technique applies threat modeling to service
mesh configurations, API gateways, container orchestration, inter-service authentication
(mTLS, JWT), distributed data flows, and east-west traffic patterns.

Mode: `[MODE: ARCHITECT]` — Microservices security architecture and zero-trust design.

## Prerequisites

- Microservices architecture diagrams and service catalog
- Kubernetes manifests or Docker Compose files
- Service mesh configuration (Istio, Linkerd, Consul)
- Python 3.10+

## Key Concepts

### Microservices Threat Categories

| Category | Threats | Controls |
|----------|---------|----------|
| **Service Identity** | Spoofed service, stolen tokens | mTLS, SPIFFE/SPIRE |
| **API Gateway** | Auth bypass, rate limit evasion | OAuth2, rate limiting, WAF |
| **East-West Traffic** | Lateral movement, interception | Service mesh, network policies |
| **Container Runtime** | Escape, privilege escalation | Non-root, read-only FS, seccomp |
| **Orchestration** | RBAC bypass, etcd exposure | K8s RBAC, secrets encryption |
| **Data** | Cross-service leaks, inconsistent auth | Classification, policy engines |

### Zero Trust Principles for Microservices

- Verify every service-to-service call (mTLS)
- Least privilege RBAC for all service accounts
- Network policies deny by default
- Encrypt all east-west traffic
- Log and audit all inter-service communication

## Workflow

### Step 1: Enumerate Services

```bash
node scripts/agent.js --action enumerate --input services.json
node scripts/agent.js --action analyze --input services.json
```

### Step 2: Map Inter-Service Threats

```bash
node scripts/agent.js --action threats --input services.json
```

### Step 3: Generate Report

```bash
node scripts/agent.js --action report --input threats.json --output report.json
```

## Verification

- [ ] All services inventoried with communication dependencies
- [ ] mTLS enforced for all inter-service communication
- [ ] Network policies restrict east-west traffic to required paths only
- [ ] API gateway configured with auth, rate limiting, and input validation
- [ ] Container security baselines enforced (non-root, resource limits, seccomp)
- [ ] Kubernetes RBAC follows least privilege for all service accounts

## References

- [NIST SP 800-204 — Microservices Security](https://csrc.nist.gov/publications/detail/sp/800-204/final)
- [OWASP Kubernetes Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html)
- [Istio Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)
