{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T17:16:35Z","timestamp":1783790195374,"version":"3.55.0"},"reference-count":75,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2024,12,26]],"date-time":"2024-12-26T00:00:00Z","timestamp":1735171200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2025,1,31]]},"abstract":"<jats:p>Infrastructure as Code (IaC) automates IT infrastructure deployment, which is particularly beneficial for continuous releases, for instance, in the context of microservices and cloud systems. Despite its flexibility in application architecture, neglecting security can lead to vulnerabilities. The lack of comprehensive architectural security guidelines for IaC poses challenges in adhering to best practices. We studied how developers interpret IaC scripts (source code) in two IaC technologies, Ansible and Terraform, compared to semi-formal IaC deployment architecture models and metrics regarding design-level security understanding. In a controlled experiment involving ninety-four participants, we assessed the understandability of IaC-based deployment architectures through source code inspection compared to semi-formal representations in models and metrics.<\/jats:p>\n          <jats:p>\n            We hypothesized that providing semi-formal IaC deployment architecture models and metrics as supplementary material would significantly improve the comprehension of IaC security-related practices, as measured by task\n            <jats:italic>correctness<\/jats:italic>\n            . Our findings suggest that semi-formal IaC deployment architecture models and metrics as supplementary material enhance the understandability of IaC security-related practices without significantly increasing\n            <jats:italic>duration<\/jats:italic>\n            . We also observed a significant correlation between task\n            <jats:italic>correctness<\/jats:italic>\n            and\n            <jats:italic>duration<\/jats:italic>\n            when models and metrics were provided.\n          <\/jats:p>","DOI":"10.1145\/3691630","type":"journal-article","created":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T13:58:53Z","timestamp":1726063133000},"page":"1-37","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["On the Understandability of Design-Level Security Practices in Infrastructure-as-Code Scripts and Deployment Architectures"],"prefix":"10.1145","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7997-905X","authenticated-orcid":false,"given":"Evangelos","family":"Ntentos","sequence":"first","affiliation":[{"name":"University of Vienna, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-7258-7425","authenticated-orcid":false,"given":"Nicole Elisabeth","family":"Lueger","sequence":"additional","affiliation":[{"name":"University of Vienna, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0516-3274","authenticated-orcid":false,"given":"Georg","family":"Simhandl","sequence":"additional","affiliation":[{"name":"University of Vienna, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6233-2591","authenticated-orcid":false,"given":"Uwe","family":"Zdun","sequence":"additional","affiliation":[{"name":"University of Vienna, Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8605-615X","authenticated-orcid":false,"given":"Simon","family":"Schneider","sequence":"additional","affiliation":[{"name":"Institute of Software Security, Hamburg University of Technology, Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3591-7671","authenticated-orcid":false,"given":"Riccardo","family":"Scandariato","sequence":"additional","affiliation":[{"name":"Institute of Software Security, Hamburg University of Technology, Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-9599-0580","authenticated-orcid":false,"given":"Nicol\u00e1s E.","family":"D\u00edaz Ferreyra","sequence":"additional","affiliation":[{"name":"Institute of Software Security, Hamburg University of Technology, Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,26]]},"reference":[{"key":"e_1_3_2_2_2","volume-title":"Infrastructure as Code: Dynamic Systems for the Cloud","author":"Morris K.","year":"2020","unstructured":"K. Morris. 2020. Infrastructure as Code: Dynamic Systems for the Cloud. Vol. 2. O\u2019Reilly."},{"key":"e_1_3_2_3_2","volume-title":"Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation","author":"Humble J.","year":"2010","unstructured":"J. Humble and D. Farley. 2010. Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation. Addison-Wesley Professional."},{"key":"e_1_3_2_4_2","volume-title":"Release It! Design and Deploy Production-Ready Software","author":"Nygard M.","year":"2007","unstructured":"M. Nygard. 2007. Release It! Design and Deploy Production-Ready Software. Pragmatic Bookshelf."},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-C.2017.162"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.54287\/gujsa.1373305"},{"key":"e_1_3_2_7_2","first-page":"524","volume-title":"Proceedings of the IEEE World Congress on Services","author":"Sengupta S.","year":"2011","unstructured":"S. Sengupta, V. Kaulgud, and V. S. Sharma. 2011. Cloud computing security\u2013trends and research directions. In Proceedings of the IEEE World Congress on Services. IEEE, 524\u2013531."},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2019.00092"},{"key":"e_1_3_2_9_2","first-page":"171","volume-title":"Proceedings of the Inernational Conference on Ubiquitous Security","author":"Iosif A.-C.","year":"2021","unstructured":"A.-C. Iosif, T. E. Gasiba, T. Zhao, U. Lechner, and M. Pinto-Albuquerque. 2021. A large-scale study on the security vulnerabilities of cloud deployments. In Proceedings of the Inernational Conference on Ubiquitous Security. Springer, 171\u2013188."},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00033"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2021.106593"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3408897"},{"key":"e_1_3_2_13_2","unstructured":"IEEE Computer Society. 2004. Avoiding the Top 10 Software Security De-Sign Flaws. Retrieved from https:\/\/ieeecs-media.computer.org\/media\/technical-activities\/CYBSI\/docs\/Top-10-Flaws.pdf"},{"key":"e_1_3_2_14_2","unstructured":"OWASP. 2021. Top 10 Vulnerabilities. Retrieved from https:\/\/owasp.org\/www-project-top-ten\/"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901761"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/QUATIC.2018.00040"},{"key":"e_1_3_2_17_2","unstructured":"AWS Documentation. 2021. Security Groups for Your VPC. Retrieved from https:\/\/docs.aws.amazon.com\/vpc\/latest\/userguide\/VPC_SecurityGroups.html"},{"key":"e_1_3_2_18_2","unstructured":"OWASP Cheat Sheet Series. 2021. Authentication Cheat Sheet. Retrieved from https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Authentication_Cheat_Sheet.html#logging-and-monitoring"},{"key":"e_1_3_2_19_2","unstructured":"OWASP Cheat Sheet Series. 2021. Transport Layer Protection Cheat Sheett. Retrieved from https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Transport_Layer_Protection_Cheat_Sheet.html#ssl-vs-tls"},{"key":"e_1_3_2_20_2","unstructured":"OWASP Cheat Sheet Series. 2021. Infrastructure as Code Security Cheatsheet. Retrieved from https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Infrastructure_as_Code_Security_Cheat_Sheet.html"},{"key":"e_1_3_2_21_2","unstructured":"Cloud Security Alliance. 2018. Continuous Monitoring in the Cloud. Retrieved from https:\/\/cloudsecurityalliance.org\/blog\/2018\/06\/11\/continuous-monitoring-in-the-cloud\/"},{"key":"e_1_3_2_22_2","unstructured":"Cloud Security Alliance. 2021. Five Approaches for Securing Identity in Cloud Infrastructure. Retrieved from https:\/\/cloudsecurityalliance.org\/blog\/2021\/05\/20\/five-approaches-for-securing-identity-in-cloud-infrastructure\/"},{"key":"e_1_3_2_23_2","unstructured":"A. Verdet M. Hamdaqa L. Da Silva and F. Khomh. 2023. Exploring security practices in infrastructure as code: An empirical study. arXiv:2308.03952. Retrieved from https:\/\/arxiv.org\/abs\/2308.03952"},{"key":"e_1_3_2_24_2","volume-title":"A Comparison between Terraform and Ansible on Their Impact Upon the Lifecycle and Security Management for Modifiable Cloud Infrastructures in OpenStack","author":"Gurbatov G.","year":"2022","unstructured":"G. Gurbatov. 2022. A Comparison between Terraform and Ansible on Their Impact Upon the Lifecycle and Security Management for Modifiable Cloud Infrastructures in OpenStack. Master Thesis. Faculty of Computing, Blekinge Institute of Technology, Sweden."},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/SCC55611.2022.00029"},{"key":"e_1_3_2_26_2","unstructured":"Okta. 2021. Token-Based Authentication. Retrieved from https:\/\/www.okta.com\/identity-101\/what-is-token-based-authentication\/"},{"key":"e_1_3_2_27_2","unstructured":"Google Cloud. 2021. Using API Keys. Retrieved from https:\/\/cloud.google.com\/docs\/authentication\/api-keys"},{"key":"e_1_3_2_28_2","unstructured":"auth0Docs. 2021. Single Sign-On (SSO). Retrieved from https:\/\/auth0.com\/docs\/authenticate\/single-sign-on"},{"key":"e_1_3_2_29_2","unstructured":"The Security Skeptic. 2021. Firewall Best Practices \u2013 Egress Traffic Filtering. Retrieved from https:\/\/securityskeptic.typepad.com\/the-security-skeptic\/firewall-best-practices-egress-traffic-filtering.html"},{"key":"e_1_3_2_30_2","unstructured":"kubernetes Documentation. 2021. Ingress Traffic Control. Retrieved from https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/ingress\/"},{"key":"e_1_3_2_31_2","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1007\/978-3-319-69035-3_29","volume-title":"Service-Oriented Computing","author":"Zdun U.","year":"2017","unstructured":"U. Zdun, E. Navarro, and F. Leymann. 2017. Ensuring and assessing architecture conformance to microservice decomposition patterns. In Service-Oriented Computing. M. Maximilien, A. Vallecillo, J. Wang, and M. Oriol (Eds.), Springer International Publishing, Cham, 411\u2013429."},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-84800-044-5_8"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2002.1027796"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-29044-2"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4757-3304-4"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-016-9437-5"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jebo.2011.08.009"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1026586415054"},{"key":"e_1_3_2_39_2","first-page":"95","volume-title":"Proceedings of the 7th International Conference on Empirical Assessment & Evaluation in Software Engineering","author":"Runeson P.","year":"2003","unstructured":"P. Runeson. 2003. Using students as experiment subjects \u2013 An analysis on graduate and freshmen student data. In Proceedings of the 7th International Conference on Empirical Assessment & Evaluation in Software Engineering, 95\u2013102."},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1145\/1414004.1414055"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.82"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9523-3"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-012-9208-x"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/QUATIC.2014.19"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/3306608"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2018.2859926"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2021.110987"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-08076-0_2"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1080\/10447318.2018.1543084"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compedu.2018.09.020"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1093\/biomet\/52.3-4.591"},{"key":"e_1_3_2_52_2","article-title":"Power comparisons of Shapiro-Wilk, Kolmogorov-Smirnov, Lilliefors and Anderson-Darling tests","volume":"2","author":"Razali N. M.","year":"2011","unstructured":"N. M. Razali and B. Yap. 2011. Power comparisons of Shapiro-Wilk, Kolmogorov-Smirnov, Lilliefors and Anderson-Darling tests. Journal of Statistical Modeling & Analytics 2 (01 2011).","journal-title":"Journal of Statistical Modeling & Analytics"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1954.10501232"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1967.10482916"},{"key":"e_1_3_2_55_2","first-page":"89","article-title":"Sulla determinazione empirica di una legge didistribuzione","volume":"4","author":"Kolmogorov A. N.","year":"1933","unstructured":"A. N. Kolmogorov. 1933. Sulla determinazione empirica di una legge didistribuzione. Giorn Dell\u2019inst Ital Degli Att 4 (1933), 89\u201391.","journal-title":"Giorn Dell\u2019inst Ital Degli Att"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.3102\/00346543052003340"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.114.3.494"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1037\/1082-989X.7.4.485"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1037\/1082-989X.9.2.183"},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1207\/s15327906mbr3103_4"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.2307\/2346101"},{"key":"e_1_3_2_62_2","first-page":"3","article-title":"Teoria statistica delle classi e calcolo delle probabilita","volume":"8","author":"Bonferroni C.","year":"1936","unstructured":"C. Bonferroni. 1936. Teoria statistica delle classi e calcolo delle probabilita. Pubblicazioni del R Istituto Superiore di Scienze Economiche e Commerciali di Firenze 8 (1936), 3\u201362.","journal-title":"Pubblicazioni del R Istituto Superiore di Scienze Economiche e Commerciali di Firenze"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1961.10482090"},{"key":"e_1_3_2_64_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3265962"},{"key":"e_1_3_2_65_2","first-page":"143","article-title":"Automatic reliability testing for cluster management controllers","author":"Sun X.","year":"2022","unstructured":"X. Sun, W. Luo, J. Tyler, A. Ganesan, R. Alagappan, M. Gasch, L. Suresh, and T. Xu. 2022. Automatic reliability testing for cluster management controllers. In Proceedings of the 16th USENIX Symposium on Operating Systems Design and Implementation (OSDI \u201922), 143\u2013159.","journal-title":"Proceedings of the 16th USENIX Symposium on Operating Systems Design and Implementation (OSDI \u201922)"},{"key":"e_1_3_2_66_2","article-title":"Toward a catalog of software quality metrics for infrastructure code","volume":"170","author":"Palma S. D.","year":"2020","unstructured":"S. D. Palma, D. Di Nucci, F. Palomba, and D. A. Tamburri. 2020. Toward a catalog of software quality metrics for infrastructure code. Journal of Systems and Software 170 (2020), 110726.","journal-title":"Journal of Systems and Software"},{"key":"e_1_3_2_67_2","first-page":"2352","article-title":"AnsibleMetrics: A python library for measuring infrastructure-as-code blueprints in ansible","volume":"12","author":"Palma S. D.","year":"2020","unstructured":"S. D. Palma, D. Di Nucci, and D. A. Tamburri. 2020. AnsibleMetrics: A python library for measuring infrastructure-as-code blueprints in ansible. SoftwareX 12 (2020), 100633. 2352\u20137110","journal-title":"SoftwareX"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58135-0_12"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1145\/3405962.3405979"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380384"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2018.8330206"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1145\/3005714"},{"key":"e_1_3_2_73_2","first-page":"167","article-title":"Experimental analysis of textual and graphical representations for software architecture design","author":"Heijstek Werner","year":"2011","unstructured":"Werner Heijstek, Thomas K\u00fchne, and Michel R. V. Chaudron. 2011. Experimental analysis of textual and graphical representations for software architecture design. Proceedings of the International Symposium on Empirical Software Engineering and Measurement, 167\u2013176.","journal-title":"Proceedings of the International Symposium on Empirical Software Engineering and Measurement"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-019-09797-4"},{"key":"e_1_3_2_75_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70004-5_2"},{"key":"e_1_3_2_76_2","doi-asserted-by":"publisher","DOI":"10.1109\/EmpiRE.2014.6890113"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3691630","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3691630","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:09:40Z","timestamp":1750295380000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3691630"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,26]]},"references-count":75,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1,31]]}},"alternative-id":["10.1145\/3691630"],"URL":"https:\/\/doi.org\/10.1145\/3691630","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,12,26]]},"assertion":[{"value":"2023-12-19","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-07-09","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-12-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}