Análise de superfície de ataques aplicada a microsserviço

Abstract

Context: Microservices Architecture (MSA) has become prominent in the development of distributed systems by promoting scalability, modularity, and independence by fragmenting monolithic applications into smaller, cohesive services that communicate via defined interfaces (REST APIs or messaging systems). However, the adoption of MSA introduces notable operational and technical complexities, such as fault management, the inherent complexity of communication, and observability in distributed environments, in addition to dealing with eventual data consistency. Method: This dissertation adopts the Design Science Research (DSR) methodology, structured into the three stages of its cycle: knowledge acquisition, model construction, and evaluation. The acquisition phase involved a Systematic Literature Mapping (SLM) to identify practices, gaps, and challenges in security and non-functional requirements in microservices. This SLM served as the basis for the construction of the proposed model, anchored in the **EventStorming and Behavior-Driven Development (BDD)** techniques, focusing on the analysis of the attack surface and the systematic verification of requirements. Results: The application of the proposed methodology demonstrated effectiveness in identifying and analyzing the attack surface in microservices. The EventStorming technique enabled the mapping of vulnerabilities and critical exposure points, promoting improvements in process visibility and collaboration between teams. Additionally, the case study with BDD allowed for the systematic verification of non-functional requirements (security and performance), resulting in expressive benefits in test automation and requirements traceability, increasing system reliability. In summary, the solution is applicable, scalable, and contributes to strengthening security-oriented software engineering in distributed environments.