English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Infrastructure as Code (IaC) is the process of managing IT infrastructure viaprogrammable configuration files (also called IaC scripts). Like other softwareartifacts, IaC scripts may contain security smells, which are coding patternsthat can result in security weaknesses. Automated analysis tools to detectsecurity smells in IaC scripts exist, but they focus on specific technologiessuch as Puppet, Ansible, or Chef. This means that when the detection of a newsmell is implemented in one of the tools, it is not immediately available forthe technologies supported by the other tools -- the only option is toduplicate the effort.  This paper presents an approach that enables consistent security smelldetection across different IaC technologies. We conduct a large-scale empiricalstudy that analyzes security smells on three large datasets containing 196,755IaC scripts and 12,281,251 LOC. We show that all categories of security smellsare identified across all datasets and we identify some smells that mightaffect many IaC projects. To conduct this study, we developed GLITCH, a newtechnology-agnostic framework that enables automated polyglot smell detectionby transforming IaC scripts into an intermediate representation, on whichdifferent security smell detectors can be defined. GLITCH currently supportsthe detection of nine different security smells in scripts written in Ansible,Chef, or Puppet. We compare GLITCH with state-of-the-art security smelldetectors. The results obtained not only show that GLITCH can reduce the effortof writing security smell analyses for multiple IaC technologies, but also thatit has higher precision and recall than the current state-of-the-art tools.

GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code