敏捷和 DevOps 已被业界广泛采用。因此，将安全活动与工业实践（如持续集成（CI）流水线）相结合，对于尽早发现安全缺陷并满足监管机构的要求是必要的。在本文中，我们分析了企业驱动的开源软件（OSS）CI 流水线中的自动化安全活动。从长远来看，这将使我们能够更好地理解安全活动在多大程度上（或应该在多大程度上）成为自动化流水线的一部分。具体而言，我们挖掘了公开可用的 OSS 仓库，并对一部分项目维护者进行了调查，以更好地理解安全活动及其相关工具在其 CI 流水线中所扮演的角色。为了提高透明度并允许其他研究人员复现我们的研究（并从不同视角进行审视），我们进一步公开了我们的研究工件。我们的结果表明，企业驱动的 OSS 项目中的安全活动十分稀少，防护覆盖率相当低。在分析的 8,243 个项目中，只有 6.83% 的项目在其 CI 流水线中应用了安全自动化，尽管维护者认为安全性相当重要。这提醒业界持续关注第三方软件中的漏洞，并为我们在本文中概述的其他实践改进开辟了空间。
英文摘要：
Agile and DevOps are widely adopted by the industry. Hence, integrating security activities with industrial practices, such as continuous integration (CI) pipelines, is necessary to detect security flaws and adhere to regulators' demands early. In this paper, we analyze automated security activities in CI pipelines of enterprise-driven open source software (OSS). This shall allow us, in the long-run, to better understand the extent to which security activities are (or should be) part of automated pipelines. In particular, we mine publicly available OSS repositories and survey a sample of project maintainers to better understand the role that security activities and their related tools play in their CI pipelines. To increase transparency and allow other researchers to replicate our study (and to take different perspectives), we further disclose our research artefacts. Our results indicate that security activities in enterprise-driven OSS projects are scarce and protection coverage is rather low. Only 6.83% of the analyzed 8,243 projects apply security automation in their CI pipelines, even though maintainers consider security to be rather important. This alerts industry to keep the focus on vulnerabilities of 3rd Party software and it opens space for other improvements of practice which we outline in this manuscript.
Several studies have shown that automated support for different activities of the security patch management process has great potential for reducing delays in installing security patches. However, it is also important to understand how automation is used in practice, its limitations in meeting real-world needs and what practitioners really need, an area that has not been empirically investigated in the existing software engineering literature. This paper reports an empirical study aimed at investigating different aspects of automation for security patch management using semi-structured intervi…
Deploying cloud computing in an enterprise infrastructure bring significant security concerns. Successful implementation of cloud computing in an enterprise requires proper planning and understanding of emerging risks, threats, vulnerabilities, and possible countermeasures. We believe enterprise should analyze the company/organization security risks, threats, and available countermeasures before adopting this technology. In this paper, we have discussed security risks and concerns in cloud computing and enlightened steps that an enterprise can take to reduce security risks and protect their re…
The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely attack investigation over the monitoring data for uncovering the attack sequence. However, existing general-purpose query systems lack explicit language constructs for expressing key properties of major attack behaviors, and their semantics-agnostic design often produces inefficient execution plans for queries. To address these limitations, we build AIQL, a novel query system that is designed with novel types of domain…
Programmable Logic Controllers (PLCs) execute critical control software that drives Industrial Automation and Control Systems (IACS). PLCs can become easy targets for cyber-adversaries as they are resource-constrained and are usually built using legacy, less-capable security measures. Security attacks can significantly affect system availability, which is an essential requirement for IACS. We propose a method to make PLC applications more security-aware. Based on the well-known IEC 61499 function blocks standard for developing IACS software, our method allows designers to annotate critical par…
Internet of Things (IoT) has been rapidly growing in the past few years in all life disciplines. IoT provides automation and smart control to its users in different domains such as home automation, healthcare systems, automotive, and many more. Given the tremendous number of connected IoT devices, this growth leads to enormous automatic interactions among sizeable IoT apps in their environment, making IoT apps more intelligent and more enjoyable to their users. But some unforeseen interactions of IoT apps and any potential malicious behaviour can seriously cause insecure and unsafe consequence…
We offer an embedding of CPython that runs entirely in memory without "touching" the disk. This in-memory embedding can load Python scripts directly from memory instead these scripts having to be loaded from files on disk. Malware that resides only in memory is harder to detect or mitigate against. We intend for our work to be used by security researchers to rapidly develop and deploy offensive techniques that is difficult for security products to analyze given these instructions are in bytecode and only translated to machine-code by the interpreter immediately prior to execution. Our work hel…
This paper sets the context for the urgency for cyber autonomy, and the current gaps of the cyber security industry. A novel framework proposing four phases of maturity for full cyber autonomy will be discussed. The paper also reviews new and emerging cyber security automation techniques and tools, and discusses their impact on society, the perceived cyber security skills gap/shortage and national security. We will also be discussing the delicate balance between national security, human rights and ethics, and the potential demise of the manual penetration testing industry in the face of automa…
