Security and the Twelve-Factor App - Step 4
A blog series by WhiteHat Security
September 12, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series examined the security component of step three of the Twelve-Factor methodology — storing config in the environment — with a key focus on the importance of auditing the environment when externalizing. This means identifying and applying hardening guidelines to the environment, and taking the opportunity to leverage a third party security team to assess the environment.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

Start with Security and the Twelve-Factor App - Step 3

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Backing Services in the Twelve-Factor App

The fourth factor of the Twelve-Factor methodology advises treating backing services as attached resources. It describes backing services as anything that’s outside of your app that may be treated as a resource, for example datastores, messaging/queuing systems, SMTP services for outbound email and caching services.

According to Twelve-Factor, backing services like the database are traditionally managed by the same systems administrators as the app’s runtime deploy. Additionally, the app may also have services provided and managed by third parties. What’s key here is that the code for a twelve-factor app makes no distinction between local and third party services. From the app’s point of view, both are attached resources, which means that a deploy of the twelve-factor app should be able to interchange a local MySQL database with one managed by a third party without any changes to the app’s code.

The rationale is that resources can be attached to and detached from deploys at will. Twelve-Factor shares this example: “If the app’s database is misbehaving due to a hardware issue, the app’s administrator might spin up a new database server restored from a recent backup. The current production database could be detached, and the new database attached — all without any code changes.”

Applying Security to Backing Services

Treating backing services as attached resources helps to encourage encapsulated development and smaller programs for example, but from a security perspective, backing services can also inadvertently encapsulate vulnerabilities.

It’s important to keep the following in mind:

1. You assume their risk

Understand the security posture of the backing service and write code as if it is being attacked, or is attacking you. This is important because at some point in the application’s normal business operation, it will either send or receive sensitive data from the backing service.

If the backing service contains a vulnerability that is exploited, this means that the application’s sensitive data (including customer data) is subject to exposure. Even though you may not have written or built that backing service, ultimately the responsibility is still yours should it be exploited.

2. Secure your communications

Establish all connections using Transport Layer Security (TLS), a cryptographic protocol that provides communications security over a computer network. Authenticate to the backing service using a least privileged account i.e. an account that has only the minimum set of permissions or privileges necessary for it to complete its task.

For example, consider iOS or Android-based mobile devices. When logging into these devices, using a pin number, we are usually logging in with a personal account, which has limited capabilities and permissions. More specifically, it’s not possible to obtain system level privileges on iOS or Android devices. unless we jailbreak those devices. Apple and Google designed these products so that the users (as well as the applications) have enough capabilities to carry out basic tasks but restrict the ability of the user to perform system level tasks.

This analogy is similar to backing services. When we connect and authenticate to a backing service, we are using an account that has just enough permission to carry out the functionality that the application needs. As an example, assume the application needs to connect to a Postgres database. The solution involves creating a separate Postgres account for the application with only the necessary privileges.

3. Resource security abstraction

Encapsulate security checks within the Resource abstraction, and limit the need for users of the Resource abstraction to be security aware.

Read Security and the Twelve-Factor App - Step 5

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

February 24, 2025

Couchbase announced that its Capella AI Model Services have integrated NVIDIA NIM microservices, part of the NVIDIA AI Enterprise software platform, to streamline deployment of AI-powered applications, providing enterprises a powerful solution for privately running generative (GenAI) models.

February 20, 2025

GitLab announced the general availability of GitLab Duo Self-Hosted.

February 20, 2025

Tigera announced the introduction of several new innovations to Calico, including a new Ingress Gateway capability for Calico Cloud and Calico Enterprise, and the launch of Calico Dashboards.

February 20, 2025

Copado introduced three AI-powered DevOps apps for Slack.

February 20, 2025

Gearset announced that it now supports Salesforce's Agentforce.

February 19, 2025

Sonar announced the acquisition of AutoCodeRover, an autonomous AI agent platform for software development.

February 19, 2025

Faros AI announced a collaboration with Microsoft to deliver its AI-powered platform for optimizing engineering workflows on Azure.

February 19, 2025

Apollo GraphQL announced the general availability of Apollo Connectors for REST APIs and new GraphOS platform enhancements — giving enterprises a faster, more efficient way to execute their API strategies.

February 18, 2025

Check Point® Software Technologies Ltd.(link is external) announced that its Check Point CloudGuard solution has been recognized as a Leader across three key GigaOm Radar reports: Application & API Security, Cloud Network Security, and Cloud Workload Security.

February 13, 2025

LaunchDarkly announced the private preview of Warehouse Native Experimentation, its Snowflake Native App, to offer Data Warehouse Native Experimentation.

February 13, 2025

SingleStore announced the launch of SingleStore Flow, a no-code solution designed to greatly simplify data migration and Change Data Capture (CDC).

February 13, 2025

ActiveState launched its Vulnerability Management as a Service (VMaas) offering to help organizations manage open source and accelerate secure software delivery.

February 12, 2025

Genkit for Node.js is now at version 1.0 and ready for production use.

February 12, 2025

JFrog signed a strategic collaboration agreement (SCA) with Amazon Web Services (AWS).

February 12, 2025

mabl launched of two new innovations, mabl Tools for Playwright and mabl GenAI Test Creation, expanding testing capabilities beyond the bounds of traditional QA teams.