Security and the Twelve-Factor App - Step 5
A blog series by WhiteHat Security
October 29, 2018

Eric Sheridan
WhiteHat Security

The previous chapter in this WhiteHat Security series examined the security component of step four of the Twelve-Factor methodology - backing services. Twelve-Factor suggests treating these as attached resources, but from a security standpoint it's important to understand the security posture of the backing service, as well as proactively securing communications and encapsulating security checks within the Resource abstraction.

Start with Security and the Twelve-Factor App - Step 1

Start with Security and the Twelve-Factor App - Step 2

Start with Security and the Twelve-Factor App - Step 3

Start with Security and the Twelve-Factor App - Step 4

This next chapter highlights the build, release and run stages within the app-building process, which step 5 recommends separating.

Defining Build, Release, Run in the Twelve-Factor App

Factor 5 of the Twelve-Factor App relates more to processes and advises strictly separating the build and run stages. The emphasis is on identifying and separating each stage of app development, and encouraging automation between each so as to accelerate the process.

To explain in more detail, a codebase is transformed into a (non-development) deploy through three stages:

■ The build stage is a transform which converts a code repository into an executable bundle known as a build. Using a version of the code at a commit specified by the deployment process, the build stage fetches vendors dependencies and compiles binaries and assets.

■ The release stage takes the build produced by the build stage and combines it with the deploy's current configuration. The resulting release contains both the build and the configuration and is ready for immediate execution in the execution environment.

■ The run stage (also known as “runtime”) runs the app in the execution environment, by launching some set of the app's processes against a selected release.

The twelve-factor app uses strict separation between the build, release, and run stages.

Applying Security to the Build, Release, Run Stages

From a security point of view, keep in mind these key activities during the build, release and run stages:

Build - enforce security policy. The Build Stage is responsible for automating enforce of the security policy, and breaking builds that fail the said policy.

Release - security go/no-go. The Release Stage should provide a consolidated view of the application's risk, thereby allowing for a "go/no-go" decision with respect to Release.

Run - production protection. The Run Stage should provide capabilities to reduce business impact of exploited vulnerability (whether known or unknown).

In the next blog we will talk about Step 6 - Processes, which encourages executing the app as one or more stateless processes by using small programs that communicate over the network, and the security implications of this step.

Eric Sheridan is Chief Scientist at WhiteHat Security

The Latest

January 22, 2019

In 2019, competitive disruption will drive remaining laggards to a DevOps boiling point. As the industry moves to the plateau of productivity with DevOps automation and standard tooling, laggard executives will reach a management crisis point that will force actions ...

January 17, 2019

To better align business and IT objectives, enterprise organizations should focus on the core "problems" that individual business units face today in driving out real consumer value. Until the roadblocks and inhibitors — and, ultimately, the resultant technical debt — are removed from the equation, large enterprise organizations will continue struggling to succeed ...

January 16, 2019

Technical debt is what results when legacy platforms or highly integrated and dependent systems and processes inhibit large enterprise organizations from meeting the needs of internal business stakeholders. In many cases, the core objectives that drive real, monetizable business value are not aligned to the esoteric IT goals of "automation" and "Agile development." This creates a fundamental disconnect between business and IT ...

January 14, 2019

Budget season is an important time of the year for businesses because it gives senior IT and security leaders time to reflect on what went right this year and what initiatives need to be given priority in the new year. Recent research from Threat Stack shows security budgets are expected to increase by 19 percent over the next two years, but business leaders are still facing challenges determining where to allocate this budget in the face of rapidly evolving infrastructure ...

January 10, 2019

As organizations of all sizes are embracing hybrid and multi-cloud infrastructures, they are experiencing the many benefits of a more agile, distributed and high-speed environment where new applications and services can be built and delivered in days and weeks, rather than months and years. But as the adoption of these next generation architectures continues to grow, so do the complexities of securing the cloud workloads running on them ...

January 09, 2019

DEVOPSdigest invited DevOps experts for their predictions on how DevOps and related technologies will evolve and impact business in 2019. Part 9, the final installment, covers microservices, containers and APIs ...

January 08, 2019

DEVOPSdigest invited DevOps experts for their predictions on how DevOps and related technologies will evolve and impact business in 2019. Part 8, covers microservices and containers ...

January 07, 2019

DEVOPSdigest invited DevOps experts for their predictions on how DevOps and related technologies will evolve and impact business in 2019. Part 7, covers the Cloud ...

December 20, 2018

DEVOPSdigest invited DevOps experts for their predictions on how DevOps and related technologies will evolve and impact business in 2019. Part 6, covers DevOps Analytics, including AI and Machine Learning ...

December 19, 2018

DEVOPSdigest invited DevOps experts for their predictions on how DevOps and related technologies will evolve and impact business in 2019. Part 5 is all about testing ...

Share this