Security and the Twelve-Factor App - Step 3
A blog series by WhiteHat Security
August 06, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed dependencies as the second step of the Twelve-Factor App. It highlighted the importance of understanding which third party dependencies are in your code, and the benefit of using Software Composition Analysis (SCA) to provide in-depth visibility into the third-party and open source dependencies.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

This next chapter examines the security component of step three of the Twelve-Factor methodology — storing configurations within the environment. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Configurations in the Twelve-Factor App

The third factor of the Twelve-Factor App advises storing configurations in the environment. According to 12-factor.net, an app's configuration is everything that is likely to vary between deploys (staging, production, developer environments, etc.). This includes resource handles to the database, credentials to external services such as Amazon S3 or Twitter, and per-deploy values such as the canonical hostname for the deployment.

It goes on to explain that apps sometimes store configurations as constants in the code. This is a violation of Twelve-Factor, which requires strict separation of configuration from code. Configuration varies substantially across deploys, code does not. A litmus test for whether an app has all configuration correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.

Twelve-Factor encourages the externalizing of that information, but the security catch can lie in the security of the environment itself. For example, if a properties file is marked as ‘world readable', anyone with access to that system can begin to read production properties, which can include confidential credentials to backend services, secret keys and tokens.

Applying Security to Configurations

When externalizing it's very important to audit the environment. Identify and apply hardening guidelines to the environment and take the opportunity to leverage a third party security team to assess the environment.

Other processes that can be followed to maximize security include:

1. Request and configure your own server certificate. Whether it's issued from your organization or rom a trusted certificate authority (CA), a pre-configured domain certificate is a secure practice for web-based systems and also serves to prevent users from experiencing any browser warnings or other unpredicted activities.

2. Restricting file permissions. When loading your environment from a configuration file, it's best practice to set permissions that are only readable by the user/s running your application.

3. Deactivating the primary site administrator account. Some server managers have an account that requires specification when first creating a site. As it's not an operating system account, disabling it ensures that there isn't another means to administer the server manager, other than the group or role that's been specified in the identity store.

4. Describing the shared key for tokens. A string of encrypted information is a token, and the shared key is the cryptographic key used to generate the token. The more complex the shared key, the more difficult it is for a malicious user to break the encryption and figure out the shared key.

5. Using standardized queries. These offer better protection against SQL injection attacks.

6. Disabling the Services Directory. This action minimizes the risk of services being browsed, found in a web search or queried through HTML forms. It also provides increased protection against cross-site scripting (XSS) attacks.

7. Restricting cross-domain requests. These are used in my system attacks and it's therefore recommended to restrict the use of services to applications hosted just in trusted domains.

Read Security and the Twelve-Factor App - Step 4

Eric Sheridan is Chief Scientist at WhiteHat Security

The Latest

October 22, 2018

Embracing DevOps at enterprise scale requires a seismic shift in the way an organization plans, builds, tests, releases, and manages applications. Here are four ways to ensure your enterprise DevOps transformation is a success ...

October 18, 2018

Are applications teams prepared to manage the chaos arising from an ever-growing landscape of heterogeneous deployment types? A recent survey of application and operations professionals sought to better understand how the industry is shifting and what the future of DevOps might look like. Here is what the survey uncovered ...

October 16, 2018

More than half of organizations have a dedicated DevOps team to help them better implement agile strategies, accelerate release cycles and ensure continuous development. However, databases have a habit of holding DevOps back ...

October 15, 2018

Test Environment Management can save organizations close to $10,000 for each release, yet only four percent of large enterprises have fully integrated TEM processes into organizational DNA, according to the 2018 Test Environment Management Survey released by EMA and Plutora ...

October 11, 2018

Agile is indeed expanding across the enterprise and there was a significant jump from last year to this year in the percentage of respondents who indicated that all or almost all of their teams were agile, according to the State of Agile 2018 report from CollabNet ...

October 09, 2018

Adopting a modern application architecture is critical to business success and a significant driver of profit growth in today’s digital economy, according to the results of a global survey of IT and business executives released by CA Technologies and conducted by Frost & Sullivan ...

October 04, 2018

How do you integrate tools to enable shift-left performance? The following tools will simplify maintenance, can be managed in a centralized way, and provide an easy-to-use UI to comprehend results ...

October 03, 2018

Focusing at the API layer of an application can help enable a scalable testing practice that can be efficiently executed as part of an accelerated delivery process, and is a practice that can be adopted and enabled at the earliest possible stages of development — truly shifting left functional testing. But what about performance testing? How do we enable the shift left of nonfunctional testing? Here, we explore what this means and how to enable it in your organization ...

October 01, 2018

As businesses look to capitalize on the benefits offered by the cloud, we've seen the rise of the DevOps practice which, in common with the cloud, offers businesses the advantages of greater agility, speed, quality and efficiency. However, achieving this agility requires end-to-end visibility based on continuous monitoring of the developed applications as part of the software development life cycle ...

September 27, 2018

Imagine that you are tasked with architecting a mission-critical cloud application. Or migrating an on-premise app to the cloud. You may ask yourself, "how do the cloud savvy companies like Airbnb, Adobe, SalesForce, etc. build and manage their modern applications?" ...

Share this