Protecting the resources of a cloud-native application is essential to meet an organization’s security goals. Cloud-native applications manage thousands of user requests, and an organization must employ a proper access control mechanism. However, unfortunately, developers sometimes grumble when designing and enforcing access decisions for a gigantic scalable application. It is sometimes complicated to choose the potential access control model for the system. Cloud-native software architecture has become an integral part of the industry to manage and maintain customer needs. A microservice is a combination of small independent services that might have hundreds of parts, where the developers must protect the individual services. An efficient access control model can defend the respective services and consistency. This study intends to comprehensively analyze the current access control mechanism and techniques utilized in cloud-native architecture. For this, we present a systematic mapping study that extracts current approaches, categorizes access control patterns, and provides developers guidance to meet security principles. In addition, we have gathered 234 essential articles, of which 29 have been chosen as primary studies. Our comprehensive analysis will guide practitioners to identify proper access control mechanisms applicable to ensuring security goals in cloud-native architectures.

The increasing use of Web-based applications continues to broaden the user groups of enterprise applications at large. Since ordinary users often equate the quality of user interface (UI) with the quality of the entire application, the importance of providing easy-to-use UIs has been significantly increasing. Unfortunately, designing a single UI satisfying all end users remains challenging. To address this issue, researchers and developers are looking to Context-aware/Adaptive UIs (CUIs) that aim to provide end users with more personalized user interaction experiences. Although multiple proposals have been made, very few production systems provide such malleable interfaces due to the excessive cost of development and maintenance. In this paper, we propose a technique that aims to reduce development and maintenance efforts of CUI to a level comparable with a single UI. Unlike most of the existing CUI approaches, our technique does not involve an external UI model. Instead, it aims to reflect runtime-information and structures already captured in the application, while extending them to provide an appropriate CUI. With this technique, developers do not design forms or tables directly for each page or panel. Instead they design generic and reusable transformation rules capable of presenting application data instances in the UI while considering the runtime context. To demonstrate our technique and its impact on CUI development and maintenance, we provide a case study. Moreover, we present our experience from its application to an existing production-level enterprise application, with high demands on performance.

Test coverage is a critical aspect of the software development process, aiming for overall confidence in the product. When considering cloud-native systems, testing becomes complex, as it becomes necessary to deal with multiple distributed microservices that are developed by different teams and may change quite rapidly. In such a dynamic environment, it is important to track test coverage. This is especially relevant for end-to-end (E2E) and API testing, as these might be developed by teams distinct from microservice developers. Moreover, indirection exists in E2E, where the testers may see the user interface but not know how comprehensive the test suits are. To ensure confidence in health checks in the system, mechanisms and instruments are needed to indicate the test coverage level. Unfortunately, there is a lack of such mechanisms for cloud-native systems. This manuscript introduces test coverage metrics for evaluating the extent of E2E and API test suite coverage for microservice endpoints. It elaborates on automating the calculation of these metrics with access to microservice codebases and system testing traces, delves into the process, and offers feedback with a visual perspective, emphasizing test coverage across microservices. To demonstrate the viability of the proposed approach, we implement a proof-of-concept tool and perform a case study on a well-established system benchmark assessing existing E2E and API test suites with regard to test coverage using the proposed endpoint metrics. The results of endpoint coverage reflect the diverse perspectives of both testing approaches. API testing achieved 91.98% coverage in the benchmark, whereas E2E testing achieved 45.42%. Combining both coverage results yielded a slight increase to approximately 92.36%, attributed to a few endpoints tested exclusively through one testing approach, not covered by the other.

Software development underwent a significant shift with the adoption of microservice architecture. Such architecture offers modularity and scalability but introduces new testing challenges. This review aims to identify, categorize, and analyze key testing methods used in microservices-based systems, emphasizing how these methods address architectural challenges and affect overall system quality. The distributed nature and asynchronous communication patterns of microservices architecture create a pressing need for robust and adaptive testing approaches. We systematically reviewed relevant papers, categorized approaches, and analyzed their strengths, limitations, and impact on system reliability. Our findings reveal that contract testing, behavior-driven development, and automated regression testing are widely practiced, yet there is a notable shortage of dedicated test generation tools designed specifically for microservices (i.e., the automated creation of test cases and test scripts tailored to verify microservices’ functionality and interactions). Additionally, this study underscores the necessity of specialized tools and advocates mock services as a solution for stabilizing complex inter-service dependencies. This study offers insights that advance both research and practice, ultimately improving microservices system reliability.

Internet of Things (IoT) devices have been widely adopted in recent years. Unlike conventional information systems, IoT solutions have greater access to real-world contextual data and are typically deployed in an environment that cannot be fully controlled, and these circumstances create new challenges and opportunities. In this article, we leverage the knowledge that an IoT device has about its network context to provide an additional security factor. The device periodically scans a network and reports a list of all devices in the network. The server analyzes movements in the network and subsequently reacts to suspicious events. This article describes how our method can detect network changes, retrieved only from scanning devices in the network. To demonstrate the proposed solution, we perform a multiweek case study on a network with hundreds of active devices and confirm that our method can detect network anomalies or changes.

Microservices have gained widespread adoption in enterprise software systems because they encapsulate the expertise of specific organizational subunits. This approach offers valuable insights into internal processes and communication channels. The advantage of microservices lies in their self-contained nature, streamlining management and deployment. However, this decentralized approach scatters knowledge across microservices, making it challenging to grasp the holistic system. As these systems continually evolve, substantial changes may affect not only individual microservices but the entire system. This dynamic environment increases the complexity of system maintenance, emphasizing the need for centralized assessment methods to analyze these changes. This paper derives and introduces quantification metrics to serve as indicators for investigating system architecture evolution across different system versions. It focuses on two holistic viewpoints of inter-service interaction and data perspectives derived through static analysis of the system’s source code. The approach is demonstrated with a case study using established microservice system benchmarks.