A METHODOLOGICAL APPROACH TO ENSURING THE SECURITY OF MICROSERVICE APPLICATIONS BASED ON STANDARDS, RISK ANALYSIS, AND DEVSECOPS

The article examines security of cloud-based microservice applications. It proposes a seven-stage iterative methodology integrating security standards, threat modeling, risk assessment, and DevSecOps practices. The stages cover asset identification, security requirements, threat modeling, risk assessment, security control selection, automated checks in continuous integration and delivery/deployment (CI/CD), and monitoring with reassessment. A semi-quantitative model compares initial and residual risks using individual risk reduction (ΔR), the reduction coefficient of the aggregate risk index (), and an acceptable residual risk threshold (). In an illustrative API authorization scenario, the assessed risk decreases from 20 to 10 (ΔR = 50%). Deterministic modeling considers six threats and two control selection strategies under an equal hypothetical budget. From an initial aggregate risk index of 98, the residual index reaches 75 without risk-based prioritization and 70 with risk-based selection, corresponding to reductions of 23.47% and 28.57%, respectively. Sensitivity analysis shows that the results depend on assumptions about control effectiveness. The findings illustrate how risk-based prioritization can support security control selection under resource constraints; they do not constitute experimental evidence of effectiveness in real microservice systems.