Security and the Twelve-Factor App - Step 2
A blog series by WhiteHat Security
June 25, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed Codebase as the first step of the Twelve-Factor App and defined a security best practice approach for ensuring a secure source control system. Considering the importance of applying security in a modern DevOps world, this next chapter examines the security component of step two of the Twelve-Factor methodology.

Start with Security and the Twelve-Factor App - Step 1

Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Dependencies in the Twelve-Factor App

All the environments in which code runs will need to have some dependencies, such as a database or an image library. The second step of the Twelve-Factor app methodology refers to the management of application dependencies, and calls for these dependencies to be explicitly declared and isolated. Apps built according to Twelve-Factor declare all dependencies completely and exactly via a dependency declaration manifest. Additionally, it uses a dependency isolation tool to make sure that no implicit dependencies ‘trickle in’ from the surrounding system. Irrespective of the tool chain, this step advocates that dependency declaration and isolation must always be used together.

The benefit it creates is a simplified setup for developers new to the app, who can examine and set up the app’s codebase onto their development machine needing only the language runtime and dependency manager installed as fundamentals.

Applying Security to Dependencies

Most modern applications consist of just 10% of built code, and up to 90% of borrowed code. Because open source is used everywhere, it’s logical that it can enter the code from everywhere and often, application security vulnerabilities come along with it. According to the National Vulnerability Database more than 5,000 new vulnerabilities are disclosed in open source software each year. And it’s these vulnerabilities that pose the biggest security risk to applications. The Department of Defense and Security says that of all recorded security threats in the U.S., 90% occurred as a result of exploits against defects in software, rather than holes in the network.

In order therefore to ensure application security, it’s important to have an understanding of what third party dependencies are in your code. Are they affected by known security vulnerabilities? Are they up-to-date and do they comply with license policies?

Software Composition Analysis (SCA) is one solution that provides in-depth visibility into the third-party and open source dependencies that have been integrated into your applications, helping you to understand potential application vulnerabilities and the overall security posture of your web and mobile applications. SCA can help you accelerate the time-to-market for applications by allowing you to safely and confidently utilize third party code, without introducing unnecessary risk.

Know your composition. Software composition analysis will enable you to identify third party and open source dependencies that have been integrated into your applications. Build a portfolio of dependencies consumed by your applications and where those applications are deployed. In the event a third-party dependency becomes vulnerable, you should be able to quickly identify what applications are impacted and where those applications are deployed.

Know your risks. Software composition analysis also provides information about license risks and can therefore help organizations reduce these risks that may be hidden in open source agreements. This extends to identifying and remediating those dependencies that may introduce security and/or legal risks. It is not uncommon for an application to contain 10 or more explicitly declared dependencies and over 40 implicitly declared dependencies, totaling 40 or more dependencies. That’s a lot of potential risk!

Review dependencies regularly. Now that you know what risks each of these dependencies uses, it will be easy to identify and remove those ones that conflict with business policies. Automate the extraction of composition and liabilities and enforce risk acceptance policy via integration into the build pipeline.

Considering most code is open source, and that applications are a popular attack surface, coupled with further targeted attacks on vulnerabilities in open source code, SCA is an integral part of application security, and secure DevOps. It therefore has a critical role to play in the Twelve-Factor app and for any developer using the methodology, it should be an automatic part of Factor 2’s security checklist.

Read Security and the Twelve-Factor App - Step 3

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

February 02, 2023

Red Hat announced a multi-stage alliance to offer customers a greater choice of operating systems to run on Oracle Cloud Infrastructure (OCI).

February 02, 2023

Snow Software announced a new global partner program designed to enable partners to support customers as they face complex market challenges around managing cost and mitigating risk, while delivering value more efficiently and effectively with Snow.

February 02, 2023

Contrast Security announced the launch of its new partner program, the Security Innovation Alliance (SIA), which is a global ecosystem of system integrators (SIs), cloud, channel and technology alliances.

February 01, 2023

Red Hat introduced new security and compliance capabilities for the Red Hat OpenShift enterprise Kubernetes platform.

February 01, 2023

Jetpack.io formally launched with Devbox Cloud, a managed service offering for Devbox.

February 01, 2023

Jellyfish launched Life Cycle Explorer, a new solution that identifies bottlenecks in the life cycle of engineering work to help teams adapt workflow processes and more effectively deliver value to customers.

January 31, 2023

Ably announced the Ably Terraform provider.

January 31, 2023

Checkmarx announced the immediate availability of Supply Chain Threat Intelligence, which delivers detailed threat intelligence on hundreds of thousands of malicious packages, contributor reputation, malicious behavior and more.

January 31, 2023

Qualys announced its new GovCloud platform along with the achievement of FedRAMP Ready status at the High impact level, from the Federal Risk and Authorization Management Program (FedRAMP).

January 30, 2023

F5 announced the general availability of F5 NGINXaaS for Azure, an integrated solution co-developed by F5 and Microsoft that empowers enterprises to deliver secure, high-performance applications in the cloud.

January 30, 2023

Tenable announced Tenable Ventures, a corporate investment program.

January 26, 2023

Ubuntu Pro, Canonical’s comprehensive subscription for secure open source and compliance, is now generally available.

January 26, 2023

Mirantis, freeing developers to create their most valuable code, today announced that it has acquired the Santa Clara, California-based Shipa to add automated application discovery, operations, security, and observability to the Lens Kubernetes Platform.

January 25, 2023

SmartBear has integrated the powerful contract testing capabilities of PactFlow with SwaggerHub.

January 25, 2023

Venafi introduced TLS Protect for Kubernetes.