Análisis correlacional entre métricas de proceso y defectos de seguridad en scripts de infraestructura como código (IaC)

Abstract

Infrastructure as Code (IaC) is fundamental in DevOps practice and is important to make sure that IaC scripts are security defects free so we can avoid introduce security weakness to the technological infrastructure or systems managed. To accomplish this goal is necessary to identify associated factors with these kinds of anomalies and fix each one. This work executes a correlational analysis with process metrics, related to software defects in source code, and security defects in IaC scripts, so we can find out the correlation level between these variables and know whether process metrics are factors correlated to security defects in scripts Puppet. Puppet repositories are downloaded from GitHub to collect process metrics and security defects are identified using static code analysis. Results allow to know that process metrics such number of revisions, number of authors revisions, number of modified lines, average number of modified lines per revision, scripts age, and security defects such admin by default, empty password, hard-coded secret, invalid IP address binding, suspicious comment, HTTP without TLS and weak cryptography algorithm, are very low correlated, with Spearman coefficient equal or less than 0.23.