Characterizing Defects in Infrastructure as Code

Infrastructure as code (IaC) is the practice of automatically configuring dependencies and managing infrastructure in information technology (IT) organizations. However, defects and security weaknesses in IaC scripts can have severe consequences such as creating wide-scale outages. Analysis of defects and security weaknesses in IaC scripts could reveal characteristics to mitigate defects and potential security weaknesses in IaC scripts. In my talk I will present the findings from two research projects that identify (i) properties in defective IaC scripts; and (iii) potential security weaknesses in IaC scripts. I will discuss the implications of my findings along with future research directions in emerging software engineering platforms such as internet of things.