Control and Data Flow in Security Smell Detection for Infrastructure as Code: Is It Worth the Effort?

Onderzoeksoutput: Conference paper

130 Downloads (Pure)

Samenvatting

Infrastructure as Code is the practice of developing and maintaining computing infrastructure through executable source code. Unfortunately, IaC has also brought about new cyber attack vectors. Prior work has therefore proposed static analyses that detect security smells in Infrastructure as Code files. However, they have so far remained at a shallow level, disregarding the control and data flow of the scripts under analysis, and may lack awareness of specific syntactic constructs. These limitations inhibit the quality of their results. To address these limitations, in this paper, we present GASEL, a novel security smell detector for the Ansible IaC language. It uses graph queries on program dependence graphs to detect 7 security smells. Our evaluation on an oracle of 243 real-world security smells and comparison against two state-of-the-art security smell detectors shows that awareness of syntax, control flow, and data flow enables our approach to substantially improve both precision and recall. We further question whether the additional effort required to develop and run such an approach is justified in practice. To this end, we investigate the prevalence of indirection through control and data flow in security smells across more than 15 000 Ansible scripts. We find that over 55% of security smells contain data-flow indirection, and over 32% require a whole-project analysis to detect. These findings motivate the need for deeper static analysis tools to detect security vulnerabilities in IaC.
Originele taal-2English
TitelProceedings of the 2023 IEEE/ACM 20th International Conference on Mining Software Repositories (MSR 2023)
UitgeverijIEEE
Pagina's534-545
Aantal pagina's12
ISBN van elektronische versie979-8-3503-1184-6
DOI's
StatusPublished - 15 mei 2023
Evenement20th International Conference on Mining Software Repositories - Melbourne Convention Exhibition Center, Melbourne, Australia
Duur: 15 mei 202316 mei 2023
https://conf.researchr.org/home/msr-2023

Publicatie series

NaamProceedings - 2023 IEEE/ACM 20th International Conference on Mining Software Repositories, MSR 2023

Conference

Conference20th International Conference on Mining Software Repositories
Verkorte titelMSR 2023
Land/RegioAustralia
StadMelbourne
Periode15/05/2316/05/23
Internet adres

Bibliografische nota

Funding Information:
This research was partially funded by the “Cybersecurity Initiative Flanders” project and the Research Foundation Flanders (FWO) under Grant No. 1SD4321N. We thank Arne Van Quickelberghe for his efforts to conduct an initial investigation that made this work possible.

Publisher Copyright:
© 2023 IEEE.

Copyright:
Copyright 2023 Elsevier B.V., All rights reserved.

Vingerafdruk

Duik in de onderzoeksthema's van 'Control and Data Flow in Security Smell Detection for Infrastructure as Code: Is It Worth the Effort?'. Samen vormen ze een unieke vingerafdruk.

Citeer dit