Security and the Twelve-Factor App - Step 3
A blog series by WhiteHat Security
August 06, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed dependencies as the second step of the Twelve-Factor App. It highlighted the importance of understanding which third party dependencies are in your code, and the benefit of using Software Composition Analysis (SCA) to provide in-depth visibility into the third-party and open source dependencies.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

This next chapter examines the security component of step three of the Twelve-Factor methodology — storing configurations within the environment. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Configurations in the Twelve-Factor App

The third factor of the Twelve-Factor App advises storing configurations in the environment. According to 12-factor.net, an app's configuration is everything that is likely to vary between deploys (staging, production, developer environments, etc.). This includes resource handles to the database, credentials to external services such as Amazon S3 or Twitter, and per-deploy values such as the canonical hostname for the deployment.

It goes on to explain that apps sometimes store configurations as constants in the code. This is a violation of Twelve-Factor, which requires strict separation of configuration from code. Configuration varies substantially across deploys, code does not. A litmus test for whether an app has all configuration correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.

Twelve-Factor encourages the externalizing of that information, but the security catch can lie in the security of the environment itself. For example, if a properties file is marked as ‘world readable', anyone with access to that system can begin to read production properties, which can include confidential credentials to backend services, secret keys and tokens.

Applying Security to Configurations

When externalizing it's very important to audit the environment. Identify and apply hardening guidelines to the environment and take the opportunity to leverage a third party security team to assess the environment.

Other processes that can be followed to maximize security include:

1. Request and configure your own server certificate. Whether it's issued from your organization or rom a trusted certificate authority (CA), a pre-configured domain certificate is a secure practice for web-based systems and also serves to prevent users from experiencing any browser warnings or other unpredicted activities.

2. Restricting file permissions. When loading your environment from a configuration file, it's best practice to set permissions that are only readable by the user/s running your application.

3. Deactivating the primary site administrator account. Some server managers have an account that requires specification when first creating a site. As it's not an operating system account, disabling it ensures that there isn't another means to administer the server manager, other than the group or role that's been specified in the identity store.

4. Describing the shared key for tokens. A string of encrypted information is a token, and the shared key is the cryptographic key used to generate the token. The more complex the shared key, the more difficult it is for a malicious user to break the encryption and figure out the shared key.

5. Using standardized queries. These offer better protection against SQL injection attacks.

6. Disabling the Services Directory. This action minimizes the risk of services being browsed, found in a web search or queried through HTML forms. It also provides increased protection against cross-site scripting (XSS) attacks.

7. Restricting cross-domain requests. These are used in my system attacks and it's therefore recommended to restrict the use of services to applications hosted just in trusted domains.

Read Security and the Twelve-Factor App - Step 4

Eric Sheridan is Chief Scientist at WhiteHat Security

The Latest

September 18, 2018

To celebrate IT Professionals Day 2018 (this year on September 18), the SolarWinds IT Pro Day 2018: A World Powered by Tech Pros survey explores a "Tech PROactive" world where technology professionals have the time, resources, and ability to use their technology prowess to do absolutely anything ...

September 17, 2018

The role of DevOps in capitalizing on the benefits of hybrid cloud has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud ...

September 13, 2018

"Our research provides compelling evidence that smart investments in technology, process, and culture drive profit, quality, and customer outcomes that are important for organizations to stay competitive and relevant -- both today and as we look to the future," said Dr. Nicole Forsgren, co-founder and CEO of DevOps Research and Assessment (DORA), referring to the organization's latest report Accelerate: State of DevOps 2018: Strategies for a New Economy ...

September 12, 2018

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages ...

September 10, 2018

When thinking about security automation, a common concern from security teams is that they don't have the coding capabilities needed to create, implement, and maintain it. So, what are teams to do when internal resources are tight and there isn't budget to hire an outside consultant or "unicorn?" ...

September 06, 2018

In evaluating 316 million incidents, it is clear that attacks against the application are growing in volume and sophistication, and as such, continue to be a major threat to business, according to Security Report for Web Applications (Q2 2018) from tCell ...

September 04, 2018

There's a welcome insight in the 2018 Accelerate State of DevOps Report from DORA, because for the first time it calls out database development as a key technical practice which can drive high performance in DevOps ...

August 29, 2018

While everyone is convinced about the benefits of containers, to really know if you're making progress, you need to measure container performance using KPIs.These KPIs should shed light on how a DevOps team is faring in terms of important parameters like speed, quality, availability, and efficiency. Let's look at the specific KPIs to track for each of these broad categories ...

August 27, 2018

Protego Labs recently discovered that 98 percent of functions in serverless applications are at risk, with 16 percent considered "serious" ...

August 23, 2018

After another record year of breaches, The 2018 DevSecOps Community Survey found that 3 in 10 respondents suspected or verified breaches stemming from vulnerabilities in open source components — a 55% increase over 2017, and 121% increase since 2014 ...

Share this