Security and the Twelve-Factor App - Step 2
A blog series by WhiteHat Security
June 25, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed Codebase as the first step of the Twelve-Factor App and defined a security best practice approach for ensuring a secure source control system. Considering the importance of applying security in a modern DevOps world, this next chapter examines the security component of step two of the Twelve-Factor methodology.

Start with Security and the Twelve-Factor App - Step 1

Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Dependencies in the Twelve-Factor App

All the environments in which code runs will need to have some dependencies, such as a database or an image library. The second step of the Twelve-Factor app methodology refers to the management of application dependencies, and calls for these dependencies to be explicitly declared and isolated. Apps built according to Twelve-Factor declare all dependencies completely and exactly via a dependency declaration manifest. Additionally, it uses a dependency isolation tool to make sure that no implicit dependencies ‘trickle in’ from the surrounding system. Irrespective of the tool chain, this step advocates that dependency declaration and isolation must always be used together.

The benefit it creates is a simplified setup for developers new to the app, who can examine and set up the app’s codebase onto their development machine needing only the language runtime and dependency manager installed as fundamentals.

Applying Security to Dependencies

Most modern applications consist of just 10% of built code, and up to 90% of borrowed code. Because open source is used everywhere, it’s logical that it can enter the code from everywhere and often, application security vulnerabilities come along with it. According to the National Vulnerability Database more than 5,000 new vulnerabilities are disclosed in open source software each year. And it’s these vulnerabilities that pose the biggest security risk to applications. The Department of Defense and Security says that of all recorded security threats in the U.S., 90% occurred as a result of exploits against defects in software, rather than holes in the network.

In order therefore to ensure application security, it’s important to have an understanding of what third party dependencies are in your code. Are they affected by known security vulnerabilities? Are they up-to-date and do they comply with license policies?

Software Composition Analysis (SCA) is one solution that provides in-depth visibility into the third-party and open source dependencies that have been integrated into your applications, helping you to understand potential application vulnerabilities and the overall security posture of your web and mobile applications. SCA can help you accelerate the time-to-market for applications by allowing you to safely and confidently utilize third party code, without introducing unnecessary risk.

Know your composition. Software composition analysis will enable you to identify third party and open source dependencies that have been integrated into your applications. Build a portfolio of dependencies consumed by your applications and where those applications are deployed. In the event a third-party dependency becomes vulnerable, you should be able to quickly identify what applications are impacted and where those applications are deployed.

Know your risks. Software composition analysis also provides information about license risks and can therefore help organizations reduce these risks that may be hidden in open source agreements. This extends to identifying and remediating those dependencies that may introduce security and/or legal risks. It is not uncommon for an application to contain 10 or more explicitly declared dependencies and over 40 implicitly declared dependencies, totaling 40 or more dependencies. That’s a lot of potential risk!

Review dependencies regularly. Now that you know what risks each of these dependencies uses, it will be easy to identify and remove those ones that conflict with business policies. Automate the extraction of composition and liabilities and enforce risk acceptance policy via integration into the build pipeline.

Considering most code is open source, and that applications are a popular attack surface, coupled with further targeted attacks on vulnerabilities in open source code, SCA is an integral part of application security, and secure DevOps. It therefore has a critical role to play in the Twelve-Factor app and for any developer using the methodology, it should be an automatic part of Factor 2’s security checklist.

Read Security and the Twelve-Factor App - Step 3

Eric Sheridan is Chief Scientist at WhiteHat Security

The Latest

September 24, 2018

From how applications and infrastructure are developed, configured and built to how they are tested and deployed, pervasive automation is the key to achieving better efficiency and standardization that gives companies the competitive edge. Pervasive automation is the concept of scaling automation broadly and deeply across the entire software delivery lifecycle ...

September 20, 2018

The latest Accelerate State of DevOps Report from DORA focuses on the importance of the database and shows that integrating it into DevOps avoids time-consuming, unprofitable delays that can derail the benefits DevOps otherwise brings. It highlights four key practices that are essential to successful database DevOps ...

September 18, 2018

To celebrate IT Professionals Day 2018 (this year on September 18), the SolarWinds IT Pro Day 2018: A World Powered by Tech Pros survey explores a "Tech PROactive" world where technology professionals have the time, resources, and ability to use their technology prowess to do absolutely anything ...

September 17, 2018

The role of DevOps in capitalizing on the benefits of hybrid cloud has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud ...

September 13, 2018

"Our research provides compelling evidence that smart investments in technology, process, and culture drive profit, quality, and customer outcomes that are important for organizations to stay competitive and relevant -- both today and as we look to the future," said Dr. Nicole Forsgren, co-founder and CEO of DevOps Research and Assessment (DORA), referring to the organization's latest report Accelerate: State of DevOps 2018: Strategies for a New Economy ...

September 12, 2018

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages ...

September 10, 2018

When thinking about security automation, a common concern from security teams is that they don't have the coding capabilities needed to create, implement, and maintain it. So, what are teams to do when internal resources are tight and there isn't budget to hire an outside consultant or "unicorn?" ...

September 06, 2018

In evaluating 316 million incidents, it is clear that attacks against the application are growing in volume and sophistication, and as such, continue to be a major threat to business, according to Security Report for Web Applications (Q2 2018) from tCell ...

September 04, 2018

There's a welcome insight in the 2018 Accelerate State of DevOps Report from DORA, because for the first time it calls out database development as a key technical practice which can drive high performance in DevOps ...

August 29, 2018

While everyone is convinced about the benefits of containers, to really know if you're making progress, you need to measure container performance using KPIs.These KPIs should shed light on how a DevOps team is faring in terms of important parameters like speed, quality, availability, and efficiency. Let's look at the specific KPIs to track for each of these broad categories ...

Share this