Check Point® Software Technologies Ltd. announced a collaboration with Microsoft that utilizes the Microsoft Azure OpenAI Service to enhance Check Point Infinity AI Copilot, marking a significant advancement in cyber security AI applications.
The previous chapter in this WhiteHat Security series examined the security component of step three of the Twelve-Factor methodology — storing config in the environment — with a key focus on the importance of auditing the environment when externalizing. This means identifying and applying hardening guidelines to the environment, and taking the opportunity to leverage a third party security team to assess the environment.
Start with Security and the Twelve-Factor App - Step 1
Start with Security and the Twelve-Factor App - Step 2
Start with Security and the Twelve-Factor App - Step 3
This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.
Defining Backing Services in the Twelve-Factor App
The fourth factor of the Twelve-Factor methodology advises treating backing services as attached resources. It describes backing services as anything that’s outside of your app that may be treated as a resource, for example datastores, messaging/queuing systems, SMTP services for outbound email and caching services.
According to Twelve-Factor, backing services like the database are traditionally managed by the same systems administrators as the app’s runtime deploy. Additionally, the app may also have services provided and managed by third parties. What’s key here is that the code for a twelve-factor app makes no distinction between local and third party services. From the app’s point of view, both are attached resources, which means that a deploy of the twelve-factor app should be able to interchange a local MySQL database with one managed by a third party without any changes to the app’s code.
The rationale is that resources can be attached to and detached from deploys at will. Twelve-Factor shares this example: “If the app’s database is misbehaving due to a hardware issue, the app’s administrator might spin up a new database server restored from a recent backup. The current production database could be detached, and the new database attached — all without any code changes.”
Applying Security to Backing Services
Treating backing services as attached resources helps to encourage encapsulated development and smaller programs for example, but from a security perspective, backing services can also inadvertently encapsulate vulnerabilities.
It’s important to keep the following in mind:
1. You assume their risk
Understand the security posture of the backing service and write code as if it is being attacked, or is attacking you. This is important because at some point in the application’s normal business operation, it will either send or receive sensitive data from the backing service.
If the backing service contains a vulnerability that is exploited, this means that the application’s sensitive data (including customer data) is subject to exposure. Even though you may not have written or built that backing service, ultimately the responsibility is still yours should it be exploited.
2. Secure your communications
Establish all connections using Transport Layer Security (TLS), a cryptographic protocol that provides communications security over a computer network. Authenticate to the backing service using a least privileged account i.e. an account that has only the minimum set of permissions or privileges necessary for it to complete its task.
For example, consider iOS or Android-based mobile devices. When logging into these devices, using a pin number, we are usually logging in with a personal account, which has limited capabilities and permissions. More specifically, it’s not possible to obtain system level privileges on iOS or Android devices. unless we jailbreak those devices. Apple and Google designed these products so that the users (as well as the applications) have enough capabilities to carry out basic tasks but restrict the ability of the user to perform system level tasks.
This analogy is similar to backing services. When we connect and authenticate to a backing service, we are using an account that has just enough permission to carry out the functionality that the application needs. As an example, assume the application needs to connect to a Postgres database. The solution involves creating a separate Postgres account for the application with only the necessary privileges.
3. Resource security abstraction
Encapsulate security checks within the Resource abstraction, and limit the need for users of the Resource abstraction to be security aware.
Industry News
ArmorCode announced ArmorCode Risk Prioritization, providing a 3D scoring approach for managing application security risks.
AppViewX and Fortanix announced a partnership to offer cloud-delivered secure digital identity management and code signing.
WaveMaker has updated its platform in response to customer demand for more sophisticated API and code management tools.
Vercara announced the launch of UltraAPI™, a product suite that protects APIs and web applications from malicious bots and fraudulent activity while ensuring regulatory compliance.
Legit Security announced the launch of its standalone enterprise secrets scanning product, which can detect, remediate, and prevent secrets exposure across the software development pipeline.
Progress announced a strategic partnership with Veeam® Software, the #1 leader by market share in Data Protection and Ransomware Recovery, to provide customers with an enterprise-ready cyber defense solution that strengthens the security of their business-critical data.
GitGuardian released its Software Composition Analysis (SCA) module.
DataStax announced a milestone in its journey to simplify enterprise retrieval-augmented generation (RAG) for developers by integrating with Microsoft Semantic Kernel.
Check Point® Software Technologies Ltd. is collaborating with NVIDIA to enhance the security of AI cloud infrastructure. Integrating NVIDIA BlueField DPUs, which feature a broad range of purpose-built, innovative security capabilities, the new Check Point AI Cloud Protect solution will help prevent threats at both the network and host levels.
Sentry announced the release of Autofix, an AI-powered feature to debug and fix code in minutes, saving important time and resources.
Apiiro announced a product integration and partnership with Secure Code Warrior, the agile developer security training platform, to extend its ASPM technology and processes to the people layer.
Progress announced that Progress® Semaphore™, its metadata management and semantic AI platform, was named a Champion in SoftwareReviews’ 2024 Metadata Management Emotional Footprint Awards.
The Cloud Native Computing Foundation® (CNCF®) has partnered with Udemy, an online skills marketplace and learning platform.
GitLab has acquired Oxeye, the provider of a cloud-native application security and risk management solution.