Security and the Twelve-Factor App - Step 4
A blog series by WhiteHat Security
September 12, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series examined the security component of step three of the Twelve-Factor methodology — storing config in the environment — with a key focus on the importance of auditing the environment when externalizing. This means identifying and applying hardening guidelines to the environment, and taking the opportunity to leverage a third party security team to assess the environment.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

Start with Security and the Twelve-Factor App - Step 3

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages.

Defining Backing Services in the Twelve-Factor App

The fourth factor of the Twelve-Factor methodology advises treating backing services as attached resources. It describes backing services as anything that’s outside of your app that may be treated as a resource, for example datastores, messaging/queuing systems, SMTP services for outbound email and caching services.

According to Twelve-Factor, backing services like the database are traditionally managed by the same systems administrators as the app’s runtime deploy. Additionally, the app may also have services provided and managed by third parties. What’s key here is that the code for a twelve-factor app makes no distinction between local and third party services. From the app’s point of view, both are attached resources, which means that a deploy of the twelve-factor app should be able to interchange a local MySQL database with one managed by a third party without any changes to the app’s code.

The rationale is that resources can be attached to and detached from deploys at will. Twelve-Factor shares this example: “If the app’s database is misbehaving due to a hardware issue, the app’s administrator might spin up a new database server restored from a recent backup. The current production database could be detached, and the new database attached — all without any code changes.”

Applying Security to Backing Services

Treating backing services as attached resources helps to encourage encapsulated development and smaller programs for example, but from a security perspective, backing services can also inadvertently encapsulate vulnerabilities.

It’s important to keep the following in mind:

1. You assume their risk

Understand the security posture of the backing service and write code as if it is being attacked, or is attacking you. This is important because at some point in the application’s normal business operation, it will either send or receive sensitive data from the backing service.

If the backing service contains a vulnerability that is exploited, this means that the application’s sensitive data (including customer data) is subject to exposure. Even though you may not have written or built that backing service, ultimately the responsibility is still yours should it be exploited.

2. Secure your communications

Establish all connections using Transport Layer Security (TLS), a cryptographic protocol that provides communications security over a computer network. Authenticate to the backing service using a least privileged account i.e. an account that has only the minimum set of permissions or privileges necessary for it to complete its task.

For example, consider iOS or Android-based mobile devices. When logging into these devices, using a pin number, we are usually logging in with a personal account, which has limited capabilities and permissions. More specifically, it’s not possible to obtain system level privileges on iOS or Android devices. unless we jailbreak those devices. Apple and Google designed these products so that the users (as well as the applications) have enough capabilities to carry out basic tasks but restrict the ability of the user to perform system level tasks.

This analogy is similar to backing services. When we connect and authenticate to a backing service, we are using an account that has just enough permission to carry out the functionality that the application needs. As an example, assume the application needs to connect to a Postgres database. The solution involves creating a separate Postgres account for the application with only the necessary privileges.

3. Resource security abstraction

Encapsulate security checks within the Resource abstraction, and limit the need for users of the Resource abstraction to be security aware.

Read Security and the Twelve-Factor App - Step 5

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

March 26, 2020

Redgate’s new SQL Monitor now ensures that DevOps teams can monitor and track deployments at all times.

March 26, 2020

Split Software announced a two-way data integration with Google Analytics that can instantly detect performance issues caused by new features.

March 26, 2020

Cloudreach earned the Kubernetes on Microsoft Azure advanced specialization.

March 25, 2020

Informatica updated its Intelligent Data Platform, powered by Informatica's AI-powered CLAIRE engine, with advanced intelligence and automation capabilities, enabling enterprises to accelerate cloud analytics modernization, drive better customer experiences, and properly govern and manage all their data.

March 25, 2020

Datical released Targeted Rollback capabilities for Liquibase, the rapidly growing open-source tool that helps application developers track, version and deploy database schema changes quickly and safely.

March 25, 2020

HashiCorp raised $175 million in Series E funding, at a company valuation of $5.1 billion.

March 24, 2020

Sysdig launched PromCat.io.

March 24, 2020

Sonatype announced expanded language coverage within Nexus Lifecycle to include Conan (C/C++), Composer (PHP), and RubyGems (Ruby), including the ability to create and contextually enforce policies.

March 24, 2020

Swimlane joined the Chronicle Index Partner program as part of a broader industry effort to help customers improve visibility of and response to cyber threats.

March 23, 2020

Portshift introduced Kubei Open Source container scanning software.

March 23, 2020

Perspecta achieved Amazon Web Services (AWS) DevOps Competency status.

March 23, 2020

Talend announced the availability of Talend Cloud in Microsoft Azure Marketplace, an online store providing applications and services for use on Azure.

March 19, 2020

DevOps Institute, a global member-based association for advancing the human elements of DevOps, announced eight Virtual SKILup Day micro-conferences starting April 30, 2020.

March 19, 2020

Oteemo, an enterprise DevSecOps and Cloud Native Transformation consultancy, launched an enterprise kubernetes and cloud native learning program.

March 19, 2020

Spectro Cloud, an enterprise cloud-native infrastructure company, emerged from stealth and unveiled its first product: Spectro Cloud.