# SP-005 SOA Internal Service Usage Pattern

Status: published. Release 26.02. Modified 2026-02-06. Licence: CC BY-SA 4.0.

Scope: Security architecture for internal service-to-service communication in SOA and microservices environments. Covers mutual authentication, transport security, authorisation enforcement, input validation, and denial-of-service protection within the enterprise service bus or service mesh.
Use when: Apply this pattern whenever internal services communicate within an enterprise environment, particularly when services handle sensitive data, execute financial transactions, or operate across different internal trust domains. It is essential when composite services chain multiple operations where a security failure at any point in the chain could compromise the entire transaction.
Not when: This pattern may be over-engineered for very small, monolithic applications where all components run in the same process and share the same trust context.

## Controls (14, NIST SP 800-53 ids)
- Critical (5): AC-03, AC-04, IA-02, SC-08, SC-09
- Important (8): AC-01, AC-06, AU-02, IA-01, IA-07, SC-05, SC-23, SI-10
- Standard (1): AC-07
- Withdrawn from SP 800-53 by NIST: SC-09 (now in SC-08)

## What each critical control mitigates (5)
- AC-03 Access Enforcement: T-IS-001, T-IS-004
- AC-04 Information Flow Enforcement: T-IS-004, T-IS-005, T-IS-006, T-IS-009, T-IS-010
- IA-02 Identification and Authentication (Organizational Users): T-IS-001, T-IS-003, T-IS-007, T-IS-008
- SC-08 Transmission Confidentiality and Integrity: T-IS-001, T-IS-002
- SC-09 Transmission Confidentiality: T-IS-002

## Threats and the controls that mitigate them (10)
- T-IS-001 Lateral Movement via Compromised Internal Service: AC-03, AC-06, IA-02, SC-08
- T-IS-002 Internal Network Eavesdropping: SC-08, SC-09, IA-07
- T-IS-003 Service Impersonation: IA-02, IA-07, SC-23
- T-IS-004 Privilege Escalation via Inherited Trust: AC-06, AC-03, AC-04
- T-IS-005 Injection Attack Propagation Through Service Chain: SI-10, AC-04
- T-IS-006 Denial of Service Between Internal Services: SC-05, AC-04
- T-IS-007 Session Hijacking or Replay Attack: SC-23, IA-02, IA-07
- T-IS-008 Brute-Force Attack on Service Credentials: AC-07, IA-02, AU-02
- T-IS-009 Unauthorised Data Flow Across Internal Boundaries: AC-04, AC-06, AU-02
- T-IS-010 Undetected Anomalous Service Communication: AU-02, AC-04, SC-05

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-005/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-005/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 19 KB: /api/v1/patterns/SP-005
- Page for people: /patterns/sp-005/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-002 Server Module; SP-004 SOA Publication and Location Pattern; SP-008 Public Web Server Pattern; SP-011 Cloud Computing Pattern; SP-016 DMZ Module; SP-025 Advanced Monitoring and Detection

This card, the API and the page are generated from one file. Checking one against another adds no evidence.