Security and the Twelve-Factor App - Step 3
A blog series by WhiteHat Security
August 06, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed dependencies as the second step of the Twelve-Factor App. It highlighted the importance of understanding which third party dependencies are in your code, and the benefit of using Software Composition Analysis (SCA) to provide in-depth visibility into the third-party and open source dependencies.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

This next chapter examines the security component of step three of the Twelve-Factor methodology — storing configurations within the environment. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Configurations in the Twelve-Factor App

The third factor of the Twelve-Factor App advises storing configurations in the environment. According to 12-factor.net, an app's configuration is everything that is likely to vary between deploys (staging, production, developer environments, etc.). This includes resource handles to the database, credentials to external services such as Amazon S3 or Twitter, and per-deploy values such as the canonical hostname for the deployment.

It goes on to explain that apps sometimes store configurations as constants in the code. This is a violation of Twelve-Factor, which requires strict separation of configuration from code. Configuration varies substantially across deploys, code does not. A litmus test for whether an app has all configuration correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.

Twelve-Factor encourages the externalizing of that information, but the security catch can lie in the security of the environment itself. For example, if a properties file is marked as ‘world readable', anyone with access to that system can begin to read production properties, which can include confidential credentials to backend services, secret keys and tokens.

Applying Security to Configurations

When externalizing it's very important to audit the environment. Identify and apply hardening guidelines to the environment and take the opportunity to leverage a third party security team to assess the environment.

Other processes that can be followed to maximize security include:

1. Request and configure your own server certificate. Whether it's issued from your organization or rom a trusted certificate authority (CA), a pre-configured domain certificate is a secure practice for web-based systems and also serves to prevent users from experiencing any browser warnings or other unpredicted activities.

2. Restricting file permissions. When loading your environment from a configuration file, it's best practice to set permissions that are only readable by the user/s running your application.

3. Deactivating the primary site administrator account. Some server managers have an account that requires specification when first creating a site. As it's not an operating system account, disabling it ensures that there isn't another means to administer the server manager, other than the group or role that's been specified in the identity store.

4. Describing the shared key for tokens. A string of encrypted information is a token, and the shared key is the cryptographic key used to generate the token. The more complex the shared key, the more difficult it is for a malicious user to break the encryption and figure out the shared key.

5. Using standardized queries. These offer better protection against SQL injection attacks.

6. Disabling the Services Directory. This action minimizes the risk of services being browsed, found in a web search or queried through HTML forms. It also provides increased protection against cross-site scripting (XSS) attacks.

7. Restricting cross-domain requests. These are used in my system attacks and it's therefore recommended to restrict the use of services to applications hosted just in trusted domains.

Read Security and the Twelve-Factor App - Step 4

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

May 22, 2024

Mendix announced a partnership with Snowflake to enable the enterprise to activate and drive maximum value from their data through low-code application development.

May 22, 2024

LaunchDarkly set the stage for “shipping at the speed of now” with the unveiling of new features, empowering engineering teams to streamline releases and accelerate the pace of innovation.

May 22, 2024

Tigera launched new features for Calico Enterprise and Calico Cloud, extending the products' Runtime Threat Defense capabilities.

May 22, 2024

Cirata announced the latest version of Cirata Gerrit MultiSite®.

May 21, 2024

Puppet by Perforce announced a significant enhancement to the capabilities of its commercial offering with the addition of new security, compliance, and continuous integration/continuous delivery (CI/CD) capabilities.

May 21, 2024

Red Hat and Nutanix announced an expanded collaboration to use Red Hat Enterprise Linux as an element of Nutanix Cloud Platform.

May 21, 2024

Nutanix announced Nutanix Kubernetes® Platform (NKP) to simplify management of container-based modern applications using Kubernetes.

May 21, 2024

Octopus Deploy announced their GitHub Copilot Extension that increases efficiency and helps developers stay in the flow.

May 20, 2024

Pegasystems introduced Pega GenAI™ Coach, a generative AI-powered mentor for Pega solutions that proactively advises users to help them achieve optimal outcomes.

May 20, 2024

SmartBear introduces SmartBear HaloAI, trusted AI-driven technology deploying across its entire product portfolio.

May 16, 2024

Pegasystems announced the general availability of Pega Infinity ’24.1™.

May 16, 2024

Mend.io and Sysdig unveiled a joint solution to help developers, DevOps, and security teams accelerate secure software delivery from development to deployment.

May 16, 2024

GitLab announced new innovations in GitLab 17 to streamline how organizations build, test, secure, and deploy software.

May 16, 2024

Kobiton announced the beta release of mobile test management, a new feature within its test automation platform.

May 15, 2024

Gearset announced its new CI/CD solution, Long Term Projects in Pipelines.