Security Smells in Ansible and Chef Scripts

Context: Security smells are recurring coding patterns that are indicative of security weakness and require further inspection. As infrastructure as code (IaC) scripts, such as Ansible and Chef scripts, are used to provision cloud-based servers and systems at scale, security smells in IaC scripts could be used to enable malicious users to exploit vulnerabilities in the provisioned systems. Goal: The goal of this article is to help practitioners avoid insecure coding practices while developing infrastructure as code scripts through an empirical study of security smells in Ansible and Chef scripts. Methodology: We conduct a replication study where we apply qualitative analysis with 1,956 IaC scripts to identify security smells for IaC scripts written in two languages: Ansible and Chef. We construct a static analysis tool called Security Linter for Ansible and Chef scripts (SLAC) to automatically identify security smells in 50,323 scripts collected from 813 open source software repositories. We also submit bug reports for 1,000 randomly selected smell occurrences. Results: We identify two security smells not reported in prior work: missing default in case statement and no integrity check. By applying SLAC we identify 46,600 occurrences of security smells that include 7,849 hard-coded passwords. We observe agreement for 65 of the responded 94 bug reports, which suggests the relevance of security smells for Ansible and Chef scripts amongst practitioners. Conclusion: We observe security smells to be prevalent in Ansible and Chef scripts, similarly to that of the Puppet scripts. We recommend practitioners to rigorously inspect the presence of the identified security smells in Ansible and Chef scripts using (i) code review, and (ii) static analysis tools.

Philanthropic Partnerships

This chapter explores corporate philanthropy. From the higher education side, the process includes developing strategy, developing a case statement (i.e., a justification of needs and wants), research and prospect identification, communication and verification of interest, cultivating the friendship or relationship, making the ask, tracking and using resources, and thanking and recognition. From the corporate side, philanthropy may be bifurcated as altruistic and benevolent or as strategic and instrumental fulfilling societal expectations, town-and-gown functionality, or community goodwill. A range of motives exist for both the academy and businesses in these interorganizational relationships—typically economic, social, or environmental. Ethics plays a role in these dynamic interactions on the individual, organizational, and institutional levels.

Laying the Groundwork for Developing International Community Guidelines to Effectively Share and Reuse Digital Data Quality Information – Case Statement, Workshop Summary Report, and Path Forward

This document provides background for and summarizes main takeaways of a workshop held virtually to kick off the development of community guidelines for consistently curating and representing dataset quality information in a way that is in line with the FAIR principles.