Characterizing Co-located Insecure Coding Patterns in Infrastructure as Code Scripts
Characterizing Co-located Insecure Coding Patterns in Infrastructure as Code Scripts
复制标题
将基础设施中的共置不安全编码模式表征为代码脚本
DOI：
10.1145/3417113.3422154
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
A. Rahman
中科院分区：
文献类型：
--
作者：
Farzana Ahamed Bhuiyan;A. Rahman
内容：不安全的编码模式（ICP）（例如硬编码密码）可能会无意中作为代码（IaC）脚本引入基础设施中，从而为恶意用户提供攻击所提供的计算基础设施的机会。由于执行代码审查是资源密集型的，因此，在脚本中一起出现的ICP可以帮助从业者优先考虑他们的审查工作，并减轻IaC脚本中的ICP。目的：本文的目标是通过对基础设施即代码（IaC）脚本中的协同定位不安全编码模式进行实证研究，帮助从业者优先考虑基础设施即代码（IaC）脚本的代码审查工作。方法学：我们分别从Mozilla、Openstack和Wikimedia三个组织收集了1613、2764和2845个Puppet脚本进行实证研究。我们应用关联规则挖掘来识别IaC脚本中的共址ICP。结果：我们观察到17.9%，32.9%和26.7%的脚本分别包含Mozilla，Openstack和Wikimedia的托管ICP。最常见的同址ICP类别是硬编码的机密和可疑评论。结论：从业者可以通过审查包含共存ICP的脚本来优先考虑IaC脚本的代码审查工作。
Context: Insecure coding patterns (ICPs), such as hard-coded passwords can be inadvertently introduced in infrastructure as code (IaC) scripts, providing malicious users the opportunity to attack provisioned computing infrastructure. As performing code reviews is resource-intensive, a characterization of co-located ICPs, i.e., ICPs that occur together in a script can help practitioners to prioritize their review efforts and mitigate ICPs in IaC scripts. Objective: The goal of this paper is to help practitioners in prioritizing code review efforts for infrastructure as code (IaC) scripts by conducting an empirical study of co-located insecure coding patterns in IaC scripts. Methodology: We conduct an empirical study with 1613, 2764 and 2845 Puppet scripts respectively collected from three organizations namely, Mozilla, Openstack, and Wikimedia. We apply association rule mining to identify co-located ICPs in IaC scripts. Results: We observe 17.9%, 32.9%, and 26.7% of the scripts to include colocated ICPs respectively, for Mozilla, Openstack, and Wikimedia. The most frequent co-located ICP category is hard-coded secret and suspicious comment. Conclusion: Practitioners can prioritize code review efforts for IaC scripts by reviewing scripts that include co-located ICPs.