Docker has extended its strategic collaboration with Microsoft to simplify code to cloud application development for developers and development teams by more closely integrating with Azure Container Instances (ACI).
Security and the Twelve-Factor App - Step 10
A blog series by WhiteHat Security
September 16, 2019
In the previous chapter of this WhiteHat Security series, we recommended applying signatures and expirations to limit the life of derived security assertions. This is relevant for Twelve-Factor App’s Step 9, which focuses on disposability i.e. apps built using the twelve-factor methodology can be started or stopped at a moment’s notice.
Step 10 highlights DEV/product parity and relates to keeping development, staging and production as similar as possible.
Start with Security and the Twelve-Factor App - Step 1
Start with Security and the Twelve-Factor App - Step 2
Start with Security and the Twelve-Factor App - Step 3
Start with Security and the Twelve-Factor App - Step 4
Start with Security and the Twelve-Factor App - Step 5
Start with Security and the Twelve-Factor App - Step 6
Start with Security and the Twelve-Factor App - Step 7
Start with Security and the Twelve-Factor App - Step 8
Start with Security and the Twelve-Factor App - Step 9
Defining DEV/Product Parity in the Twelve-Factor App
The tenth factor, DEV/product parity, suggests keeping development, staging and production as similar as possible. According to 12.factor.net, historically there have been significant gaps between development, edits to a local deploy of the app and production.
The twelve-factor app is designed for continuous deployment by keeping the gap between these as small and similar as possible.
Applying Security to Step 10
The Twelve-Factor app methodology puts a lot of emphasis on keeping services the same between the various phases of the product development lifecycle. However, when striving for DEV/prod parity as you move through the Twelve-Factors, it’s important that product secrets are not shared. Uber found this out the hard way when it stored a sensitive database key on a public GitHub page.
■ Enforce the separation of duties. This means that DEV can’t see any secrets in QA, QA can’t see any secrets in STAGE, and STAGE can’t see any secrets in PROD.
■ Replicate security services. Simply put, product security services must be replicated in the DEV, QA, and STAGE processes.
Industry News
May 28, 2020
Eggplant announced updates to its Digital Automation Intelligence (DAI) platform.
May 28, 2020
Aptum launched its Managed DevOps Service in partnership with CloudOps, a cloud consulting and professional services company specializing in DevOps.
May 27, 2020
Red Hat announced an expansion of its application services portfolio with the addition of Quarkus as a fully supported framework in Red Hat Runtimes.
May 27, 2020
Couchbase has completed a $105 million all-equity Series G round of fundraising.
May 27, 2020
Aqua Security closed a Series D round of $30M led by Greenspring Associates.
May 26, 2020
GitLab is releasing 13.0 of its DevSecOps platform to enable organizations to efficiently adapt and respond to new and dynamic business challenges.
May 26, 2020
Solo.io announced the availability of the Istio Developer Portal to streamline the developer onboarding process for improved developer experience and increased productivity with added security features.
May 26, 2020
WhiteHat Security will offer free application scanning services to any education institution to support secure online learning.
May 21, 2020
Exadel announced the Grand Prize winner of the “Appery.io COVID-19 Virtual Hackathon.”
May 21, 2020
CloudBees announced significant advances for its Software Delivery Management (SDM) platform – integrations with additional continuous integration and continuous delivery (CI/CD) engines, including Google Cloud Build and Tekton, and extension of the availability of CloudBees’ SDM Preview Program.
May 21, 2020
OutSystems is announcing over 70 development accelerators that ensure web and mobile applications created on the OutSystems low-code development platform can comply with the highest accessibility standards and regulations.
May 20, 2020
Styra announced that Styra Declarative Authorization Service (DAS) now supports microservices and extends context-based authorization to the service mesh.
May 20, 2020
Optimizely announced that its free feature flagging plan for development teams, Rollouts, now also includes A/B testing and feature configuration.
May 20, 2020
StackRox announced new runtime security features in the latest release of the StackRox Kubernetes Security Platform.
