Security and the Twelve-Factor App - Step 4
A blog series by WhiteHat Security
September 12, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series examined the security component of step three of the Twelve-Factor methodology — storing config in the environment — with a key focus on the importance of auditing the environment when externalizing. This means identifying and applying hardening guidelines to the environment, and taking the opportunity to leverage a third party security team to assess the environment.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

Start with Security and the Twelve-Factor App - Step 3

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Backing Services in the Twelve-Factor App

The fourth factor of the Twelve-Factor methodology advises treating backing services as attached resources. It describes backing services as anything that’s outside of your app that may be treated as a resource, for example datastores, messaging/queuing systems, SMTP services for outbound email and caching services.

According to Twelve-Factor, backing services like the database are traditionally managed by the same systems administrators as the app’s runtime deploy. Additionally, the app may also have services provided and managed by third parties. What’s key here is that the code for a twelve-factor app makes no distinction between local and third party services. From the app’s point of view, both are attached resources, which means that a deploy of the twelve-factor app should be able to interchange a local MySQL database with one managed by a third party without any changes to the app’s code.

The rationale is that resources can be attached to and detached from deploys at will. Twelve-Factor shares this example: “If the app’s database is misbehaving due to a hardware issue, the app’s administrator might spin up a new database server restored from a recent backup. The current production database could be detached, and the new database attached — all without any code changes.”

Applying Security to Backing Services

Treating backing services as attached resources helps to encourage encapsulated development and smaller programs for example, but from a security perspective, backing services can also inadvertently encapsulate vulnerabilities.

It’s important to keep the following in mind:

1. You assume their risk

Understand the security posture of the backing service and write code as if it is being attacked, or is attacking you. This is important because at some point in the application’s normal business operation, it will either send or receive sensitive data from the backing service.

If the backing service contains a vulnerability that is exploited, this means that the application’s sensitive data (including customer data) is subject to exposure. Even though you may not have written or built that backing service, ultimately the responsibility is still yours should it be exploited.

2. Secure your communications

Establish all connections using Transport Layer Security (TLS), a cryptographic protocol that provides communications security over a computer network. Authenticate to the backing service using a least privileged account i.e. an account that has only the minimum set of permissions or privileges necessary for it to complete its task.

For example, consider iOS or Android-based mobile devices. When logging into these devices, using a pin number, we are usually logging in with a personal account, which has limited capabilities and permissions. More specifically, it’s not possible to obtain system level privileges on iOS or Android devices. unless we jailbreak those devices. Apple and Google designed these products so that the users (as well as the applications) have enough capabilities to carry out basic tasks but restrict the ability of the user to perform system level tasks.

This analogy is similar to backing services. When we connect and authenticate to a backing service, we are using an account that has just enough permission to carry out the functionality that the application needs. As an example, assume the application needs to connect to a Postgres database. The solution involves creating a separate Postgres account for the application with only the necessary privileges.

3. Resource security abstraction

Encapsulate security checks within the Resource abstraction, and limit the need for users of the Resource abstraction to be security aware.

Read Security and the Twelve-Factor App - Step 5

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

July 09, 2020

ShiftLeft released a new version of NextGen Static Analysis (NG SAST), including new workflows, purpose-built for developers that significantly improve security, while enhancing productivity.

July 09, 2020

RunSafe Security announced a partnership with JFrog that will enable RunSafe to supercharge binary protections via a simple plugin that JFrog users can deploy within their Artifactory repositories and instantly protect binaries and containers.

July 09, 2020

LeanIX closed $80 million in Series D funding led by new investor Goldman Sachs Growth.

July 08, 2020

Afi.ai introduced Afi Data Platform, a cloud-based replication and resiliency service that helps to monitor, predict downtime and recover K8s applications.

July 08, 2020

D2iQ announced the release of Conductor, a new interactive learning platform that enables enterprises to access hands-on cloud native courses and training.

July 08, 2020

SUSE entered into a definitive agreement to acquire Rancher Labs.

July 07, 2020

Micro Focus announced AI-powered enhancements to the intelligent testing capabilities of the UFT Family, a unified set of solutions designed to reduce the overall complexity of automating the functional testing processes.

July 07, 2020

Push Technology announced the launch of a new Service API capability for Diffusion Cloud, Push’s Real-Time API Management Cloud Platform.

July 07, 2020

Lightrun exited stealth and announced $4M in seed funding for the first complete continuous debugging and observability platform for production applications.

July 01, 2020

JFrog announced the launch of ChartCenter, a free, security-focused central repository of Helm charts for the community.

July 01, 2020

Kong announced a significant upgrade to open source Kuma, Kuma 0.6, available today.

July 01, 2020

Compuware Corporation, a BMC company, announced new capabilities that further automate and integrate test data and test case execution, empowering IT teams to achieve high-performance application development quality, velocity and efficiency.

June 30, 2020

Couchbase announced the general availability of Couchbase Cloud, a fully-managed Database-as-a-Service (DBaaS).

June 30, 2020

Split Software announced new capabilities designed to accelerate the adoption of feature flags in large-scale organizations.

June 30, 2020

WhiteHat Security announced a discounted Web + Mobile Application Security bundle to help organizations secure the digital future.