MICROSERVICE SECURITY PARADIGM FOR CRITICAL INFORMATION INFRASTRUCTURE

The paper proposes a microservice security paradigm for Critical Information Infrastructure (CII), in which security is treated as an embedded architectural property of a distributed system, and a microservice is considered the minimal security unit.Unlike perimeter-based models that concentrate control at external boundaries, the proposed approach shifts the focus to internal (east-west) interactions, which constitute the major portion of the attack surface in modern service-oriented ecosystems.The study substantiates the need to apply Zero Trust principles to inter-service calls, use policy-driven access control, and treat observability as an active component of CII cyber resilience.The experimental part is built on a CII model represented as a graph of 24 microservices divided into criticality zones (Z1-Z3), with a workload of 1200 rps, where 85% are internal calls.A baseline variant V0 (perimeter control at the API Gateway) is compared with variant V1 (the proposed paradigm with Zero Trust for № 13(54) 2025 1580 east-west traffic) across four attack scenarios.The results show a 2.2-3.7×reduction in the success rate of attack scenarios and an 8-27% decrease in the compromise spread (blast radius) compared with V0, as well as a 3-5× reduction in MTTD and MTTC due to observability and controlled interaction policies.The overhead is moderate for CII: the p95 latency increase for internal calls does not exceed 10 ms, while telemetry volume grows as a predictable consequence of strengthened control and monitoring.The obtained results provide practical grounds for adopting a microservice-oriented CII cyber defense model that prioritizes incident localization, risk manageability, and continuity of critical services.