Security and the Twelve-Factor App - Step 5
A blog series by WhiteHat Security
October 29, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series examined the security component of step four of the Twelve-Factor methodology - backing services. Twelve-Factor suggests treating these as attached resources, but from a security standpoint it's important to understand the security posture of the backing service, as well as proactively securing communications and encapsulating security checks within the Resource abstraction.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

Start with Security and the Twelve-Factor App - Step 3

Start with Security and the Twelve-Factor App - Step 4

This next chapter highlights the build, release and run stages within the app-building process, which step 5 recommends separating.

Defining Build, Release, Run in the Twelve-Factor App

Factor 5 of the Twelve-Factor App relates more to processes and advises strictly separating the build and run stages. The emphasis is on identifying and separating each stage of app development, and encouraging automation between each so as to accelerate the process.

To explain in more detail, a codebase is transformed into a (non-development) deploy through three stages:

■ The build stage is a transform which converts a code repository into an executable bundle known as a build. Using a version of the code at a commit specified by the deployment process, the build stage fetches vendors dependencies and compiles binaries and assets.

■ The release stage takes the build produced by the build stage and combines it with the deploy's current configuration. The resulting release contains both the build and the configuration and is ready for immediate execution in the execution environment.

■ The run stage (also known as “runtime”) runs the app in the execution environment, by launching some set of the app's processes against a selected release.

The twelve-factor app uses strict separation between the build, release, and run stages.

Applying Security to the Build, Release, Run Stages

From a security point of view, keep in mind these key activities during the build, release and run stages:

Build - enforce security policy. The Build Stage is responsible for automating enforce of the security policy, and breaking builds that fail the said policy.

Release - security go/no-go. The Release Stage should provide a consolidated view of the application's risk, thereby allowing for a "go/no-go" decision with respect to Release.

Run - production protection. The Run Stage should provide capabilities to reduce business impact of exploited vulnerability (whether known or unknown).

Read Security and the Twelve-Factor App - Step 6 about processes, which encourages executing the app as one or more stateless processes by using small programs that communicate over the network, and the security implications of this step.

Eric Sheridan is Chief Scientist at WhiteHat Security
Share this

Industry News

September 21, 2023

Red Hat and Oracle announced the expansion of their alliance to offer customers a greater choice in deploying applications on Oracle Cloud Infrastructure (OCI). As part of the expanded collaboration, Red Hat OpenShift, the industry’s leading hybrid cloud application platform powered by Kubernetes for architecting, building, and deploying cloud-native applications, will be supported and certified to run on OCI.

September 21, 2023

Harness announced the availability of Gitness™, a freely available, fully open source Git platform that brings a new era of collaboration, speed, security, and intelligence to software development.

September 20, 2023

Oracle announced new application development capabilities to enable developers to rapidly build and deploy applications on Oracle Cloud Infrastructure (OCI).

September 20, 2023

Sonar announced zero-configuration, automatic analysis for programming languages C and C++ within SonarCloud.

September 20, 2023

DataStax announced a new JSON API for Astra DB – the database-as-a-service built on the open source Apache Cassandra® – delivering on one of the most highly requested user features, and providing a seamless experience for Javascript developers building AI applications.

September 19, 2023

Oracle announced the availability of Java 21.

September 19, 2023

Mirantis launched Lens AppIQ, available directly in Lens Desktop and as (Software as a Service) SaaS.

September 19, 2023

Buildkite announced the company has entered into a definitive agreement to acquire Packagecloud, a cloud-based software package management platform, in an all stock deal.

September 19, 2023

CrowdStrike has agreed to acquire Bionic, a provider of Application Security Posture Management (ASPM).

September 18, 2023

Perforce Software announces BlazeMeter's Test Data Pro, the latest addition to its continuous testing platform.

September 18, 2023

CloudBees announced a new cloud native DevSecOps platform that places platform engineers and developer experience front and center.

September 18, 2023

Akuity announced a new open source tool, Kargo, to implement change promotions across many application life cycle stages using GitOps principles.

September 14, 2023

CloudBees announced significant performance and scalability breakthroughs for Jenkins® with new updates to its CloudBees Continuous Integration (CI) software.