Security and the Twelve-Factor App - Step 3
A blog series by WhiteHat Security
August 06, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series discussed dependencies as the second step of the Twelve-Factor App. It highlighted the importance of understanding which third party dependencies are in your code, and the benefit of using Software Composition Analysis (SCA) to provide in-depth visibility into the third-party and open source dependencies.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

This next chapter examines the security component of step three of the Twelve-Factor methodology — storing configurations within the environment. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Configurations in the Twelve-Factor App

The third factor of the Twelve-Factor App advises storing configurations in the environment. According to 12-factor.net, an app's configuration is everything that is likely to vary between deploys (staging, production, developer environments, etc.). This includes resource handles to the database, credentials to external services such as Amazon S3 or Twitter, and per-deploy values such as the canonical hostname for the deployment.

It goes on to explain that apps sometimes store configurations as constants in the code. This is a violation of Twelve-Factor, which requires strict separation of configuration from code. Configuration varies substantially across deploys, code does not. A litmus test for whether an app has all configuration correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.

Twelve-Factor encourages the externalizing of that information, but the security catch can lie in the security of the environment itself. For example, if a properties file is marked as ‘world readable', anyone with access to that system can begin to read production properties, which can include confidential credentials to backend services, secret keys and tokens.

Applying Security to Configurations

When externalizing it's very important to audit the environment. Identify and apply hardening guidelines to the environment and take the opportunity to leverage a third party security team to assess the environment.

Other processes that can be followed to maximize security include:

1. Request and configure your own server certificate. Whether it's issued from your organization or rom a trusted certificate authority (CA), a pre-configured domain certificate is a secure practice for web-based systems and also serves to prevent users from experiencing any browser warnings or other unpredicted activities.

2. Restricting file permissions. When loading your environment from a configuration file, it's best practice to set permissions that are only readable by the user/s running your application.

3. Deactivating the primary site administrator account. Some server managers have an account that requires specification when first creating a site. As it's not an operating system account, disabling it ensures that there isn't another means to administer the server manager, other than the group or role that's been specified in the identity store.

4. Describing the shared key for tokens. A string of encrypted information is a token, and the shared key is the cryptographic key used to generate the token. The more complex the shared key, the more difficult it is for a malicious user to break the encryption and figure out the shared key.

5. Using standardized queries. These offer better protection against SQL injection attacks.

6. Disabling the Services Directory. This action minimizes the risk of services being browsed, found in a web search or queried through HTML forms. It also provides increased protection against cross-site scripting (XSS) attacks.

7. Restricting cross-domain requests. These are used in my system attacks and it's therefore recommended to restrict the use of services to applications hosted just in trusted domains.

Read Security and the Twelve-Factor App - Step 4

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

February 13, 2020

CyberArk announced the CyberArk Blueprint for Privileged Access Management Success, designed to help customers take a future-proof, phased and measurable approach to reducing privilege-related risk.

February 13, 2020

Cloudentity announced a partnership with Signal Sciences to provide a holistic approach for enterprise companies looking to secure their web applications and APIs.

February 13, 2020

OutSystems announced that the Portuguese government has agreed to co-finance €5.1 million through the Portugal 2020 economic development program for a pair of innovative research and development programs led by OutSystems.

February 12, 2020

Tata Consultancy Services (TCS) launched Jile 4.0, a major release of its on-the-cloud enterprise Agile DevOps platform that enables software teams to manage, automate and measure the end-to-end software delivery value stream from ideation to deployment.

February 12, 2020

Synopsys announced that on Feb. 18 it will release a major update to the Polaris Software Integrity Platform to extend its static application security testing (SAST) and software composition analysis (SCA) capabilities to the developer's desktop through the native integration of the Code Sight IDE plugin.

February 12, 2020

Tufin announced the availability of Tufin SecureCloud, a security policy automation service for enterprises needing to gain visibility and control of the security posture of their cloud-native and hybrid cloud environments.

February 11, 2020

Applause released its new Applause Accessibility Tool that automatically finds and fixes key accessibility issues earlier in the software development lifecycle.

February 11, 2020

Chef announced a new channel program specifically designed to ensure that partners and customers are able to take maximum advantage of Chef’s 100 percent open source business model.

February 11, 2020

IT Revolution announced the first round of speakers for DevOps Enterprise Summit London 2020.

February 10, 2020

Dynatrace announced new enhancements to its support for Kubernetes.

February 06, 2020

DevOps Institute announced its newly revamped Global Education Partner Program.

February 06, 2020

Automox raised $30 million in Series B funding.

February 05, 2020

Couchbase introduced Couchbase Cloud, a fully-managed Database-as-a-Service (DBaaS).

February 05, 2020

Univa announced the general availability of Navops Launch 2.0, its flagship cloud-automation platform, designed to help enterprises simplify the migration of HPC and AI workloads to their choice of cloud.

February 05, 2020

Fugue announced a Team plan to help cloud engineering teams collaborate and innovate faster and more securely.