Options
On the understandability of design-level security practices in infrastructure-as-code scripts and deployment architectures
Citation Link: https://doi.org/10.15480/882.14169
Publikationstyp
Journal Article
Date Issued
2024-12-26
Sprache
English
TORE-DOI
Volume
34
Issue
1
Article Number
6
Citation
ACM Transactions on Software Engineering and Methodology 34 (1): 6 (2024)
Publisher DOI
Publisher
Association for Computing Machinery (ACM)
Peer Reviewed
true
Infrastructure as Code (IaC) automates IT infrastructure deployment, which is particularly beneficial for continuous releases, for instance, in the context of microservices and cloud systems. Despite its flexibility in application architecture, neglecting security can lead to vulnerabilities. The lack of comprehensive architectural security guidelines for IaC poses challenges in adhering to best practices. We studied how developers interpret IaC scripts (source code) in two IaC technologies, Ansible and Terraform, compared to semi-formal IaC deployment architecture models and metrics regarding design-level security understanding. In a controlled experiment involving ninety-four participants, we assessed the understandability of IaC-based deployment architectures through source code inspection compared to semi-formal representations in models and metrics.
We hypothesized that providing semi-formal IaC deployment architecture models and metrics as supplementary material would significantly improve the comprehension of IaC security-related practices, as measured by task correctness. Our findings suggest that semi-formal IaC deployment architecture models and metrics as supplementary material enhance the understandability of IaC security-related practices without significantly increasing duration. We also observed a significant correlation between task correctness and duration when models and metrics were provided.
We hypothesized that providing semi-formal IaC deployment architecture models and metrics as supplementary material would significantly improve the comprehension of IaC security-related practices, as measured by task correctness. Our findings suggest that semi-formal IaC deployment architecture models and metrics as supplementary material enhance the understandability of IaC security-related practices without significantly increasing duration. We also observed a significant correlation between task correctness and duration when models and metrics were provided.
Subjects
Infrastructure as code
modeling
best practices
controlled experiment
empirical software engineering
DDC Class
005: Computer Programming, Programs, Data and Security
Publication version
publishedVersion
Loading...
Name
3691630.pdf
Type
Main Article
Size
8.96 MB
Format
Adobe PDF