Anti-Patterns in Infrastructure as Code

Abstract

RAHMAN, AKOND ASHFAQUE UR. Anti-patterns in Infrastructure as Code. (Under the direction of Laurie Williams). In continuous deployment, infrastructure as code (IaC) scripts are used by practitioners to create and manage an automated deployment pipeline that enables information technology (IT) organizations to release their software changes rapidly at scale. Low quality IaC scripts can have serious consequences, potentially leading to widespread system outages and service discrepancies. By systematically identifying which characteristics are correlated with low quality IaC scripts, we can identify anti-patterns i.e. recurring practices with negative consequences, which may help practitioners to take informed actions in creating and maintaining defect-free IaC scripts. The goal of this thesis is to help practitioners in increasing quality of IaC scripts by identifying development and security anti-patterns in the development of infrastructure as code scripts. Using open source repositories, we conduct five research studies and identify (i) defect categories in IaC scripts; (ii) operations that characterize defective IaC scripts; (iii) code properties that correlate with defective IaC scripts; (iv) development anti-patterns for IaC scripts; and (v) security anti-patterns in IaC scripts that are indicative of security weaknesses. From our conducted empirical studies, we observe defect category distribution of IaC scripts are different to that of general purpose programming languages. We observe three operations that characterize defective IaC scripts, namely file system operations, infrastructure provisioning, and user account management. We identify 10 source code properties that correlate with defective scripts, of which size and hard-coded strings as configuration values show the strongest correlation with defective scripts. We identify 13 development anti-patterns that are development activities, which correlate with defective scripts. We also identify 9 security anti-patterns i.e. coding patterns that are indicative of security weaknesses. We hope outcomes of the thesis i.e. findings, tools, and datasets will facilitate further research in the area of IaC.

Coding Practices and Recommendations of Spring Security for Enterprise Applications

“…The project is not a clone or copy of another existing project. [26], [27] Exploit protection CSRF attacks H 17 (6) Not using TLS for HTTP communication [22], [26], [28] Exploit protection Man-in-the-middle H 15…”

“…Insecure defaults (7) Using Bcrypt with insecure params [24] Authentication Brute-force H 11 (8) Using MD5 in remember me cookie [23], [28] Authentication Brute-force H N/A (9) Lack of req. throttling policy per API key [22], [33] Exploit protection DoS attacks L N/A (10) Absence of content security policy (CSP) [26] Exploit protection Code injection L N/A…”

Security Vulnerabilities in Infrastructure as Code: What, How Many, and Who?

“…In the realm of DevOps, Infrastructure as Code (IaC) has emerged as a pivotal technology, offering automation and codedriven management for infrastructure deployment and configuration. IaC empowers organizations to automate a wide array of tasks, encompassing installations, configurations, provisioning, and deployments across a spectrum of resources, including servers, operating systems, virtual machines, containers, and applications, whether on the cloud or on-premises environments [1]. As DevOps practices have gained widespread adoption, IaC has become an integral part of modern software development and deployment pipelines.…”

“…In our work, we further perform security testing on IaC core components using static analyzers. Additionally, other studies [1,11] have characterized IaC scripts properties. However, because our study case involves two more components, we could not rely on those characteristics only.…”

Plataforma colaborativa, distribuida, escalable y de bajo costo basada en microservicios, contenedores, dispositivos móviles y servicios en la Nube para tareas de cómputo intensivo

“…Figura 2.4 -Herramientas más utilizadas a la hora de realizar tareas de IaC en la actualidad. Fuente: Propia.El código debe desarrollarse y administrarse utilizando los mismos procesos que se aplican sobre cualquier otro desarrollo de software; por ejemplo, debe diseñarse, documentarse, probarse y almacenarse en un repositorio de control de versiones[RAH18b] [AWS17].Los operadores de sistemas de tecnología de la información (Ops) han empleado durante mucho tiempo este tipo de tareas a través de secuencias de comandos ad hoc de tareas, tecnología y prácticas de IaC. un cambio realizado durante el desarrollo, la integración o incluso en el entorno productivo, así como también para respaldar la recreación y depuración de problemas.2.4.3 -Integración y despliegue continuoEn la actualidad los sistemas de software se están volviendo cada vez más complejos y distribuidos, a menudo involucrando equipos de desarrollo multidisciplinarios que trabajan simultáneamente en diferentes componentes de un proyecto modular común[DEJ17].…”