Security and the Twelve-Factor App - Step 2
A blog series by WhiteHat Security
June 25, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed Codebase as the first step of the Twelve-Factor App and defined a security best practice approach for ensuring a secure source control system. Considering the importance of applying security in a modern DevOps world, this next chapter examines the security component of step two of the Twelve-Factor methodology.

Start with Security and the Twelve-Factor App - Step 1

Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Dependencies in the Twelve-Factor App

All the environments in which code runs will need to have some dependencies, such as a database or an image library. The second step of the Twelve-Factor app methodology refers to the management of application dependencies, and calls for these dependencies to be explicitly declared and isolated. Apps built according to Twelve-Factor declare all dependencies completely and exactly via a dependency declaration manifest. Additionally, it uses a dependency isolation tool to make sure that no implicit dependencies ‘trickle in’ from the surrounding system. Irrespective of the tool chain, this step advocates that dependency declaration and isolation must always be used together.

The benefit it creates is a simplified setup for developers new to the app, who can examine and set up the app’s codebase onto their development machine needing only the language runtime and dependency manager installed as fundamentals.

Applying Security to Dependencies

Most modern applications consist of just 10% of built code, and up to 90% of borrowed code. Because open source is used everywhere, it’s logical that it can enter the code from everywhere and often, application security vulnerabilities come along with it. According to the National Vulnerability Database more than 5,000 new vulnerabilities are disclosed in open source software each year. And it’s these vulnerabilities that pose the biggest security risk to applications. The Department of Defense and Security says that of all recorded security threats in the U.S., 90% occurred as a result of exploits against defects in software, rather than holes in the network.

In order therefore to ensure application security, it’s important to have an understanding of what third party dependencies are in your code. Are they affected by known security vulnerabilities? Are they up-to-date and do they comply with license policies?

Software Composition Analysis (SCA) is one solution that provides in-depth visibility into the third-party and open source dependencies that have been integrated into your applications, helping you to understand potential application vulnerabilities and the overall security posture of your web and mobile applications. SCA can help you accelerate the time-to-market for applications by allowing you to safely and confidently utilize third party code, without introducing unnecessary risk.

Know your composition. Software composition analysis will enable you to identify third party and open source dependencies that have been integrated into your applications. Build a portfolio of dependencies consumed by your applications and where those applications are deployed. In the event a third-party dependency becomes vulnerable, you should be able to quickly identify what applications are impacted and where those applications are deployed.

Know your risks. Software composition analysis also provides information about license risks and can therefore help organizations reduce these risks that may be hidden in open source agreements. This extends to identifying and remediating those dependencies that may introduce security and/or legal risks. It is not uncommon for an application to contain 10 or more explicitly declared dependencies and over 40 implicitly declared dependencies, totaling 40 or more dependencies. That’s a lot of potential risk!

Review dependencies regularly. Now that you know what risks each of these dependencies uses, it will be easy to identify and remove those ones that conflict with business policies. Automate the extraction of composition and liabilities and enforce risk acceptance policy via integration into the build pipeline.

Considering most code is open source, and that applications are a popular attack surface, coupled with further targeted attacks on vulnerabilities in open source code, SCA is an integral part of application security, and secure DevOps. It therefore has a critical role to play in the Twelve-Factor app and for any developer using the methodology, it should be an automatic part of Factor 2’s security checklist.

Read Security and the Twelve-Factor App - Step 3

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

July 09, 2020

ShiftLeft released a new version of NextGen Static Analysis (NG SAST), including new workflows, purpose-built for developers that significantly improve security, while enhancing productivity.

July 09, 2020

RunSafe Security announced a partnership with JFrog that will enable RunSafe to supercharge binary protections via a simple plugin that JFrog users can deploy within their Artifactory repositories and instantly protect binaries and containers.

July 09, 2020

LeanIX closed $80 million in Series D funding led by new investor Goldman Sachs Growth.

July 08, 2020

Afi.ai introduced Afi Data Platform, a cloud-based replication and resiliency service that helps to monitor, predict downtime and recover K8s applications.

July 08, 2020

D2iQ announced the release of Conductor, a new interactive learning platform that enables enterprises to access hands-on cloud native courses and training.

July 08, 2020

SUSE entered into a definitive agreement to acquire Rancher Labs.

July 07, 2020

Micro Focus announced AI-powered enhancements to the intelligent testing capabilities of the UFT Family, a unified set of solutions designed to reduce the overall complexity of automating the functional testing processes.

July 07, 2020

Push Technology announced the launch of a new Service API capability for Diffusion Cloud, Push’s Real-Time API Management Cloud Platform.

July 07, 2020

Lightrun exited stealth and announced $4M in seed funding for the first complete continuous debugging and observability platform for production applications.

July 01, 2020

JFrog announced the launch of ChartCenter, a free, security-focused central repository of Helm charts for the community.

July 01, 2020

Kong announced a significant upgrade to open source Kuma, Kuma 0.6, available today.

July 01, 2020

Compuware Corporation, a BMC company, announced new capabilities that further automate and integrate test data and test case execution, empowering IT teams to achieve high-performance application development quality, velocity and efficiency.

June 30, 2020

Couchbase announced the general availability of Couchbase Cloud, a fully-managed Database-as-a-Service (DBaaS).

June 30, 2020

Split Software announced new capabilities designed to accelerate the adoption of feature flags in large-scale organizations.

June 30, 2020

WhiteHat Security announced a discounted Web + Mobile Application Security bundle to help organizations secure the digital future.