Security and the Twelve-Factor App - Step 2
A blog series by WhiteHat Security
June 25, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed Codebase as the first step of the Twelve-Factor App and defined a security best practice approach for ensuring a secure source control system. Considering the importance of applying security in a modern DevOps world, this next chapter examines the security component of step two of the Twelve-Factor methodology.

Start with Security and the Twelve-Factor App - Step 1

Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Dependencies in the Twelve-Factor App

All the environments in which code runs will need to have some dependencies, such as a database or an image library. The second step of the Twelve-Factor app methodology refers to the management of application dependencies, and calls for these dependencies to be explicitly declared and isolated. Apps built according to Twelve-Factor declare all dependencies completely and exactly via a dependency declaration manifest. Additionally, it uses a dependency isolation tool to make sure that no implicit dependencies ‘trickle in’ from the surrounding system. Irrespective of the tool chain, this step advocates that dependency declaration and isolation must always be used together.

The benefit it creates is a simplified setup for developers new to the app, who can examine and set up the app’s codebase onto their development machine needing only the language runtime and dependency manager installed as fundamentals.

Applying Security to Dependencies

Most modern applications consist of just 10% of built code, and up to 90% of borrowed code. Because open source is used everywhere, it’s logical that it can enter the code from everywhere and often, application security vulnerabilities come along with it. According to the National Vulnerability Database more than 5,000 new vulnerabilities are disclosed in open source software each year. And it’s these vulnerabilities that pose the biggest security risk to applications. The Department of Defense and Security says that of all recorded security threats in the U.S., 90% occurred as a result of exploits against defects in software, rather than holes in the network.

In order therefore to ensure application security, it’s important to have an understanding of what third party dependencies are in your code. Are they affected by known security vulnerabilities? Are they up-to-date and do they comply with license policies?

Software Composition Analysis (SCA) is one solution that provides in-depth visibility into the third-party and open source dependencies that have been integrated into your applications, helping you to understand potential application vulnerabilities and the overall security posture of your web and mobile applications. SCA can help you accelerate the time-to-market for applications by allowing you to safely and confidently utilize third party code, without introducing unnecessary risk.

Know your composition. Software composition analysis will enable you to identify third party and open source dependencies that have been integrated into your applications. Build a portfolio of dependencies consumed by your applications and where those applications are deployed. In the event a third-party dependency becomes vulnerable, you should be able to quickly identify what applications are impacted and where those applications are deployed.

Know your risks. Software composition analysis also provides information about license risks and can therefore help organizations reduce these risks that may be hidden in open source agreements. This extends to identifying and remediating those dependencies that may introduce security and/or legal risks. It is not uncommon for an application to contain 10 or more explicitly declared dependencies and over 40 implicitly declared dependencies, totaling 40 or more dependencies. That’s a lot of potential risk!

Review dependencies regularly. Now that you know what risks each of these dependencies uses, it will be easy to identify and remove those ones that conflict with business policies. Automate the extraction of composition and liabilities and enforce risk acceptance policy via integration into the build pipeline.

Considering most code is open source, and that applications are a popular attack surface, coupled with further targeted attacks on vulnerabilities in open source code, SCA is an integral part of application security, and secure DevOps. It therefore has a critical role to play in the Twelve-Factor app and for any developer using the methodology, it should be an automatic part of Factor 2’s security checklist.

Read Security and the Twelve-Factor App - Step 3

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

November 24, 2020

Red Hat announced new capabilities and features for Red Hat OpenShift, the company's enterprise Kubernetes platform.

November 24, 2020

Sectigo released Chef, Jenkins, JetStack Cert-Manager, Puppet, and SaltStack integrations for its certificate management platform.

November 24, 2020

DataStax released K8ssandra, an open-source distribution of Apache Cassandra on Kubernetes.

November 23, 2020

Spectro Cloud has released a new, self-hosted version of its flagship product, Spectro Cloud.

November 23, 2020

GitLab completed integration of Peach Tech, a security software firm specializing in protocol fuzz testing and dynamic application security testing (DAST) API testing, and Fuzzit, a continuous fuzz testing solution providing coverage-guided testing.

November 23, 2020

Fugue announced the availability of its SaaS product in AWS Marketplace, further simplifying the process for Amazon Web Services customers to use Fugue to bring their environments into compliance quickly, demonstrate compliance at any time, and Shift Left on cloud security.

November 19, 2020

Rollbar announced AI-assisted workflows powered by its new automation-grade grouping engine.

November 19, 2020

Buildkite expanded its integration with GitHub and introduced a new onboarding experience.

November 19, 2020

Rancher Labs launched a new Partner Program for the OEM and embedded community.

November 18, 2020

Puppet announced its evolution to an integrated automation platform to enable key business initiatives such as scaling DevOps, risk reduction, policy as code, and evolving cloud strategies.

November 18, 2020

Adaptavist has joined the GitLab partner program as a Select partner.

November 18, 2020

Postman launched the beta version of public workspaces, a hub that makes it possible for both API producers and consumers to seamlessly communicate and collaborate in real time without team or organizational boundaries.

November 17, 2020

Red Hat introduced new capabilities for Red Hat Enterprise Linux and Red Hat OpenShift intended to help enterprises bring edge computing into hybrid cloud deployments.

November 17, 2020

Humio announced the availability of the Humio Operator.

November 17, 2020

Accurics announced that Terrascan, the open source static code analyzer that enables developers to build secure infrastructure as code (IaC), has been extended to support Helm and Kustomize.