Now showing1 - 2 of 2
- Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , On the understandability of design-level security practices in infrastructure-as-code scripts and deployment architectures(Association for Computing Machinery (ACM), 2024-12-26); ; ; ; Infrastructure as Code (IaC) automates IT infrastructure deployment, which is particularly beneficial for continuous releases, for instance, in the context of microservices and cloud systems. Despite its flexibility in application architecture, neglecting security can lead to vulnerabilities. The lack of comprehensive architectural security guidelines for IaC poses challenges in adhering to best practices. We studied how developers interpret IaC scripts (source code) in two IaC technologies, Ansible and Terraform, compared to semi-formal IaC deployment architecture models and metrics regarding design-level security understanding. In a controlled experiment involving ninety-four participants, we assessed the understandability of IaC-based deployment architectures through source code inspection compared to semi-formal representations in models and metrics. We hypothesized that providing semi-formal IaC deployment architecture models and metrics as supplementary material would significantly improve the comprehension of IaC security-related practices, as measured by task correctness. Our findings suggest that semi-formal IaC deployment architecture models and metrics as supplementary material enhance the understandability of IaC security-related practices without significantly increasing duration. We also observed a significant correlation between task correctness and duration when models and metrics were provided.Publicationtype: Journal Article18 37 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , CATMA: Conformance Analysis Tool for Microservice Applications(Association for Computing Machinery (ACM), 2024-04); ; ; ; The microservice architecture allows developers to divide the core functionality of their software system into multiple smaller services. However, this architectural style also makes it harder for them to debug and assess whether the system's deployment conforms to its implementation. We present CATMA, an automated tool that detects non-conformances between the system's deployment and implementation. It automatically visualizes and generates potential interpretations for the detected discrepancies. Our evaluation of CATMA shows promising results in terms of performance and providing useful insights. CATMA is available at https://cyberanalytics. nl/catma.github.io/, and a demonstration video is available at https://youtu.be/WKP1hG-TDKc.Publicationtype: Conference Paper22 65