Security and the Twelve-Factor App - Step 3
A blog series by WhiteHat Security
August 06, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed dependencies as the second step of the Twelve-Factor App. It highlighted the importance of understanding which third party dependencies are in your code, and the benefit of using Software Composition Analysis (SCA) to provide in-depth visibility into the third-party and open source dependencies.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

This next chapter examines the security component of step three of the Twelve-Factor methodology — storing configurations within the environment. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Configurations in the Twelve-Factor App

The third factor of the Twelve-Factor App advises storing configurations in the environment. According to 12-factor.net, an app's configuration is everything that is likely to vary between deploys (staging, production, developer environments, etc.). This includes resource handles to the database, credentials to external services such as Amazon S3 or Twitter, and per-deploy values such as the canonical hostname for the deployment.

It goes on to explain that apps sometimes store configurations as constants in the code. This is a violation of Twelve-Factor, which requires strict separation of configuration from code. Configuration varies substantially across deploys, code does not. A litmus test for whether an app has all configuration correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.

Twelve-Factor encourages the externalizing of that information, but the security catch can lie in the security of the environment itself. For example, if a properties file is marked as ‘world readable', anyone with access to that system can begin to read production properties, which can include confidential credentials to backend services, secret keys and tokens.

Applying Security to Configurations

When externalizing it's very important to audit the environment. Identify and apply hardening guidelines to the environment and take the opportunity to leverage a third party security team to assess the environment.

Other processes that can be followed to maximize security include:

1. Request and configure your own server certificate. Whether it's issued from your organization or rom a trusted certificate authority (CA), a pre-configured domain certificate is a secure practice for web-based systems and also serves to prevent users from experiencing any browser warnings or other unpredicted activities.

2. Restricting file permissions. When loading your environment from a configuration file, it's best practice to set permissions that are only readable by the user/s running your application.

3. Deactivating the primary site administrator account. Some server managers have an account that requires specification when first creating a site. As it's not an operating system account, disabling it ensures that there isn't another means to administer the server manager, other than the group or role that's been specified in the identity store.

4. Describing the shared key for tokens. A string of encrypted information is a token, and the shared key is the cryptographic key used to generate the token. The more complex the shared key, the more difficult it is for a malicious user to break the encryption and figure out the shared key.

5. Using standardized queries. These offer better protection against SQL injection attacks.

6. Disabling the Services Directory. This action minimizes the risk of services being browsed, found in a web search or queried through HTML forms. It also provides increased protection against cross-site scripting (XSS) attacks.

7. Restricting cross-domain requests. These are used in my system attacks and it's therefore recommended to restrict the use of services to applications hosted just in trusted domains.

Read Security and the Twelve-Factor App - Step 4

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

June 29, 2022

Progress announced the latest release of Progress Flowmon.

June 29, 2022

CodeSee announced the launch of Open Source Hub (OSH).

June 29, 2022

Ambassador Labs announced the newest release of Ambassador Edge Stack, an integrated edge solution that empowers developer teams to quickly configure the edge services required to build, deliver, and scale applications for Kubernetes.

June 29, 2022

Ondat released into general availability version 2.8 of its Ondat platform for stateful workloads in Kubernetes.

June 28, 2022

Hewlett Packard Enterprise (HPE) unveiled platform enhancements and new cloud services for HPE GreenLake, the company’s flagship offering that enables organizations to modernize all their applications and data.

June 28, 2022

Sysdig announced Drift Control to prevent container attacks at runtime. Teams can detect, prevent, and speed incident response for containers that were modified in production, also known as container drift.

June 28, 2022

ShiftLeft announced an investment from and go-to-market partnership with Wipro Ventures.

June 27, 2022

Delinea announced the latest release of DevOps Secrets Vault.

June 27, 2022

Jit announced a $38.5 million seed funding round and launched a free beta version which automates product security.

June 27, 2022

Platform.sh raised $140 million in Series D funding.

June 23, 2022

Akana by Perforce now offers BlazeMeter to customers, previously a solution with Broadcom Layer7.

June 23, 2022

Coder announced the release of a new open source project that gives developers and data scientists a consistent, secure, yet flexible way to create cloud workspaces in minutes.

June 23, 2022

GitGuardian is announcing a series of new features to address developer experience in securing the software development lifecycle.

June 22, 2022

OctoML released a major platform expansion to accelerate the development of AI-powered applications by eliminating bottlenecks in machine learning deployment.

June 22, 2022

Snow Software announced new functionality and integrations for Snow Atlas, a purpose-built platform that provides a framework to accelerate data-driven technology decision-making.