Check Point® Software Technologies Ltd. has been recognized as a leader in The Forrester Wave™: Zero Trust Platform Providers, Q3 2023 report.
The previous blog in this WhiteHat Security series highlighted the individual build, release and run stages within the app-building process, and the appropriate security posture to incorporate within each of these phases.
Start with Security and the Twelve-Factor App - Step 1
Start with Security and the Twelve-Factor App - Step 2
Start with Security and the Twelve-Factor App - Step 3
Start with Security and the Twelve-Factor App - Step 4
Start with Security and the Twelve-Factor App - Step 5
Step 6 of the Twelve-Factor App methodology encourages executing the app as one or more stateless processes. Here is some actionable security-focused advice which developers and ops engineers can follow during the SaaS build and operations stages.
Defining Processes in the Twelve-Factor App
In this sixth step, the Twelve-Factor methodology encourages executing the app as one or more stateless processes by using small programs that communicate over the network. In other words Twelve-factor processes are stateless and contained in a shared-nothing (SN) architecture, a distributed-computing architecture in which each node is independent and self-sufficient, and there is no single point of contention across the system. More specifically, none of the nodes share memory or disk storage. The benefits of SN architecture include eliminating any single point of failure, allowing self-healing capabilities. and providing an advantage in offering non-disruptive upgrade.
Many organizations are undertaking a “re-platforming” journey, in which the overarching platform is broken up into smaller programs that are more service focused, enabling changes to be made more quickly.
Applying Security to Step 6
Unfortunately, a major security drawback of this journey is that when you start to break up a big building block into smaller pieces, the attack surface increases. This means there are more places where requests can be sent to your infrastructure, which equates to more opportunities to send an attack. Assumptions about how code would be invoked by their callers will change when migrating to service oriented architectures, and some of those changes impact security. By way of example, consider the WhiteHat Security 2018 Stats Report. This report compared vulnerability related security metrics between monolith and microservices architectures and found that for every 100KLOC, monolith applications had 39 vulnerabilities whereas microservices had 180 vulnerabilities. Be mindful of legacy code that is being exposed over the network as you break up your app into services, as such code may have been written without security in mind.
Read Security and the Twelve-Factor App - Step 7, which focuses on exporting services via port binding, and what to apply from a security point of view.
Industry News
Red Hat and Oracle announced the expansion of their alliance to offer customers a greater choice in deploying applications on Oracle Cloud Infrastructure (OCI). As part of the expanded collaboration, Red Hat OpenShift, the industry’s leading hybrid cloud application platform powered by Kubernetes for architecting, building, and deploying cloud-native applications, will be supported and certified to run on OCI.
Harness announced the availability of Gitness™, a freely available, fully open source Git platform that brings a new era of collaboration, speed, security, and intelligence to software development.
Oracle announced new application development capabilities to enable developers to rapidly build and deploy applications on Oracle Cloud Infrastructure (OCI).
Sonar announced zero-configuration, automatic analysis for programming languages C and C++ within SonarCloud.
DataStax announced a new JSON API for Astra DB – the database-as-a-service built on the open source Apache Cassandra® – delivering on one of the most highly requested user features, and providing a seamless experience for Javascript developers building AI applications.
Mirantis launched Lens AppIQ, available directly in Lens Desktop and as (Software as a Service) SaaS.
Buildkite announced the company has entered into a definitive agreement to acquire Packagecloud, a cloud-based software package management platform, in an all stock deal.
CrowdStrike has agreed to acquire Bionic, a provider of Application Security Posture Management (ASPM).
Perforce Software announces BlazeMeter's Test Data Pro, the latest addition to its continuous testing platform.
CloudBees announced a new cloud native DevSecOps platform that places platform engineers and developer experience front and center.
Akuity announced a new open source tool, Kargo, to implement change promotions across many application life cycle stages using GitOps principles.
Check Point® Software Technologies Ltd. announced that it has been recognized on Newsweek’s inaugural list of the World’s Most Trustworthy Companies 2023.
CloudBees announced significant performance and scalability breakthroughs for Jenkins® with new updates to its CloudBees Continuous Integration (CI) software.