The Seven Sins: Security Smells in Infrastructure as Code Scripts
https://akondrahman.github.io/files/papers/icse19_slic.pdf
Method
"We apply qualitative analysis on 1,726 IaC scripts to identify seven security smells. Next, we implement and validate a static analysis tool called Security Linter for Infrastructure as Code scripts (SLIC) to identify the occurrence of each smell in 15,232 IaC scripts collected from 293 open source repositories."
Population
"15,232 IaC scripts collected from 293 open source repositories"
What it does not show
Measures presence and developer acceptance, not realised harm — it does not show these smells caused a breach. No comparison group. Only about a tenth of bug reports drew any response, so the acceptance rate is a lower bound on a self-selected sample.
Akond Rahman, Chris Parnin, Laurie Williams
21,201 smell occurrences including 1,326 hard-coded passwords. Of 1,000 sampled occurrences reported to maintainers, 104 drew a response and 67 were accepted as real defects. Median smell lifetime 20 months, with one hard-coded secret persisting 98.
Tier II: Large-scale observational study of real open-source infrastructure code using a validated static analysis tool, with maintainer bug reports as a partial validity check. No control group and no measured incident outcomes.