Ensuring security in microservices means applying authentication, authorization, encryption, and monitoring consistently across every independently deployed service, since there's no single perimeter protecting the whole system.
Key Points: • Enforce strong authentication and authorization on every service so only verified callers with the right permissions can access it, typically via OAuth2/JWT. • Encrypt data in transit with HTTPS/TLS and encrypt sensitive data at rest in each service's database. • Keep every service's dependencies and container images patched, since an outdated library in even one service creates a vulnerability for the whole system. • Apply least-privilege access so each service, and each user, has only the permissions strictly necessary for its function. • Continuously scan for vulnerabilities and log access across services so security issues can be detected and traced quickly.
Example: A Spring Boot service would use Spring Security configured as an OAuth2 resource server to validate incoming JWTs, reject unauthenticated requests before they reach business logic, and log every authorization decision for later auditing.
Interview Tip: A concise interview answer is:
"I secure microservices with strong authentication and authorization on every service, usually OAuth2 with JWTs, encrypt all traffic with TLS, apply least-privilege access, and keep dependencies patched. I also make sure every service logs access decisions so security issues can be traced quickly, since there's no single perimeter to rely on."