{"id":"https://openalex.org/W4402633633","doi":"https://doi.org/10.1109/cyber-rci59474.2023.10671452","title":"Securing Infrastructure as Code (IaC) through DevSecOps:A Comprehensive Risk Management Framework","display_name":"Securing Infrastructure as Code (IaC) through DevSecOps:A Comprehensive Risk Management Framework","publication_year":2023,"publication_date":"2023-11-24","ids":{"openalex":"https://openalex.org/W4402633633","doi":"https://doi.org/10.1109/cyber-rci59474.2023.10671452"},"language":"en","primary_location":{"id":"doi:10.1109/cyber-rci59474.2023.10671452","doi":"https://doi.org/10.1109/cyber-rci59474.2023.10671452","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cyber-rci59474.2023.10671452","pdf_url":null,"source":{"id":"https://openalex.org/S7407086194","display_name":"Cyber Research Conference - Ireland (Cyber-RCI)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 Cyber Research Conference - Ireland (Cyber-RCI)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5092567698","display_name":"Ammar Zeini","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4387152698","display_name":"Atlantic Technological University","ror":"https://ror.org/0458dap48","country_code":"IE","type":"education","lineage":["https://openalex.org/I4387152698"]}],"countries":["IE"],"is_corresponding":false,"raw_author_name":"Ammar Zeini","raw_affiliation_strings":["Atlantic Technological University,Dept. of Computing,Letterkenny,Ireland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Atlantic Technological University,Dept. of Computing,Letterkenny,Ireland","institution_ids":["https://openalex.org/I4387152698"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054962729","display_name":"Ruth G. Lennon","orcid":"https://orcid.org/0000-0001-9917-2889","observed_orcids":["https://orcid.org/0000-0001-9917-2889"]},"institutions":[{"id":"https://openalex.org/I4387152698","display_name":"Atlantic Technological University","ror":"https://ror.org/0458dap48","country_code":"IE","type":"education","lineage":["https://openalex.org/I4387152698"]}],"countries":["IE"],"is_corresponding":false,"raw_author_name":"Ruth G. Lennon","raw_affiliation_strings":["Atlantic Technological University,Dept. of Computing,Letterkenny,Ireland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Atlantic Technological University,Dept. of Computing,Letterkenny,Ireland","institution_ids":["https://openalex.org/I4387152698"]}]},{"author_position":"last","author":{"id":null,"display_name":"Patrick Lennon","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4387152698","display_name":"Atlantic Technological University","ror":"https://ror.org/0458dap48","country_code":"IE","type":"education","lineage":["https://openalex.org/I4387152698"]}],"countries":["IE"],"is_corresponding":false,"raw_author_name":"Patrick Lennon","raw_affiliation_strings":["Atlantic Technological University,Dept. of Computing,Letterkenny,Ireland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Atlantic Technological University,Dept. of Computing,Letterkenny,Ireland","institution_ids":["https://openalex.org/I4387152698"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4387152698"],"apc_list":null,"apc_paid":null,"fwci":0.7573,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.68436852,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"11"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.7333999872207642,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.7333999872207642,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.06449999660253525,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.05130000039935112,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/infrastructure-as-code","display_name":"infrastructure as code","score":0.9950000047683716},{"id":"https://openalex.org/keywords/devsecops","display_name":"DevSecOps","score":0.9980000257492065},{"id":"https://openalex.org/keywords/risk-management-framework","display_name":"risk management framework","score":0.9279999732971191},{"id":"https://openalex.org/keywords/threat-modeling","display_name":"threat modeling","score":0.9179999828338623},{"id":"https://openalex.org/keywords/software-development-lifecycle","display_name":"software development lifecycle","score":0.75},{"id":"https://openalex.org/keywords/security-standards","display_name":"security standards","score":0.5239999890327454},{"id":"https://openalex.org/keywords/risk-reduction","display_name":"risk mitigation","score":0.5370000004768372}],"concepts":[{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.6296578645706177},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5850479006767273},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.49463269114494324},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.46542757749557495},{"id":"https://openalex.org/C164403151","wikidata":"https://www.wikidata.org/wiki/Q7336280","display_name":"Risk management framework","level":4,"score":0.4286995530128479},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.3771595358848572},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3694770336151123},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.282418429851532},{"id":"https://openalex.org/C95609273","wikidata":"https://www.wikidata.org/wiki/Q5975208","display_name":"IT risk management","level":3,"score":0.2102440893650055},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.13230574131011963},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.06771913170814514},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cyber-rci59474.2023.10671452","doi":"https://doi.org/10.1109/cyber-rci59474.2023.10671452","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cyber-rci59474.2023.10671452","pdf_url":null,"source":{"id":"https://openalex.org/S7407086194","display_name":"Cyber Research Conference - Ireland (Cyber-RCI)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 Cyber Research Conference - Ireland (Cyber-RCI)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.5378999710083008}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W130537682","https://openalex.org/W2006743912","https://openalex.org/W2406372219","https://openalex.org/W2734894858","https://openalex.org/W2742897094","https://openalex.org/W2883411629","https://openalex.org/W2889856241","https://openalex.org/W2907854211","https://openalex.org/W2955656327","https://openalex.org/W2982485630","https://openalex.org/W2990046387","https://openalex.org/W2993710525","https://openalex.org/W3001443755","https://openalex.org/W3008629209","https://openalex.org/W3014907911","https://openalex.org/W3041762618","https://openalex.org/W3080543622","https://openalex.org/W3090625769","https://openalex.org/W3093136448","https://openalex.org/W3093836561","https://openalex.org/W3094198941","https://openalex.org/W3104902066","https://openalex.org/W3118657661","https://openalex.org/W3123154329","https://openalex.org/W3194619007","https://openalex.org/W3200708172","https://openalex.org/W3203768218","https://openalex.org/W3205818000","https://openalex.org/W4229334140","https://openalex.org/W4240298750","https://openalex.org/W4246467737","https://openalex.org/W4308078918","https://openalex.org/W4385385658"],"related_works":["https://openalex.org/W4385385658","https://openalex.org/W7127168642","https://openalex.org/W7208753246","https://openalex.org/W4312191397","https://openalex.org/W4415034147","https://openalex.org/W4313131486","https://openalex.org/W7128203671","https://openalex.org/W7222978855","https://openalex.org/W7223103939","https://openalex.org/W7164480078"],"abstract_inverted_index":{"Despite":[0],"the":[1,12,37,95,100,104,129,150,163],"evident":[2],"advantages":[3],"of":[4,14,30,103,152],"Infrastructure":[5],"as":[6],"Code":[7],"(IaC)":[8],"in":[9],"software":[10],"development,":[11],"nature":[13],"bugs":[15],"and":[16,62,79,90,119,173],"potential":[17,34],"threats":[18,35,52,142],"arising":[19],"from":[20,69,134,149],"its":[21],"implementation":[22],"remains":[23,40],"subject":[24],"to":[25,49,66,73,87,126,140,158,166,178],"ongoing":[26],"investigation.":[27],"The":[28,115],"formulation":[29],"a":[31,168],"list,":[32],"enumerating":[33],"during":[36],"IaC":[38,51,96,112,135,145,160,181],"process":[39],"an":[41],"unattained":[42],"goal.":[43],"However,":[44],"it":[45,54,156],"is":[46,55,113],"not":[47],"enough":[48],"recounting":[50],"only,":[53],"imperative":[56],"for":[57,111],"Development":[58,131],"(Dev),":[59],"Security":[60],"(Sec),":[61],"Operations":[63],"(Ops)":[64],"teams":[65],"synergistically":[67],"collaborate":[68],"early":[70],"developmental":[71],"stages":[72],"conduct":[74],"thorough":[75],"risks\u2019":[76],"analysis,":[77],"estimation,":[78],"mitigation":[80],"procedures":[81],"concerning":[82],"IaC-related":[83],"risks.":[84],"Moreover,":[85],"adhering":[86],"security":[88,102],"standards":[89],"risk":[91,108,117,170],"management":[92,109,118,171],"framework":[93,110,172],"throughout":[94],"lifecycle":[97,146],"will":[98],"enhance":[99],"overall":[101],"deployment":[105],"process.":[106],"A":[107],"essential.":[114],"extant":[116],"threat":[120],"modeling":[121],"methodologies":[122],"may":[123],"necessitate":[124],"tailoring":[125],"effectively":[127],"protect":[128],"Software":[130],"Lifecycle":[132],"(SDLC)":[133],"misuse.":[136],"This":[137],"research":[138],"aims":[139],"identify":[141],"that":[143],"threaten":[144],"or":[147],"arise":[148],"utilization":[151],"IaC.":[153],"In":[154],"addition,":[155],"tries":[157],"integrate":[159],"practices":[161,176],"with":[162],"DevSecOps":[164],"culture":[165],"devise":[167],"robust":[169],"prescribe":[174],"pertinent":[175],"conducive":[177],"fostering":[179],"secure":[180],"implementation.":[182]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2024-09-20T00:00:00"}