基礎架構即程式碼 (Infrastructure as Code, IaC) 透過在程式碼中定義並管理基礎設施，實現自動化管理並提升操作效率。然而，IaC也引發了安全挑戰：IaC 設定伺服器會透過部署IaC腳本對受管理設備進行設定更新（即派送更新），當攻擊者入侵了IaC設定伺服器後，能夠將腳本中的惡意指令在無任何防禦措施的情況下派送至所有受管理設備中。此外，因IaC工具在派送更新時通常採用加密協定，入侵偵測系統難以偵測到惡意指令，導致受管理設備只能在發生資安事件後才能進行因應。
基於前述問題，本研究提出IaC設定管理安全閘道器，透過在IaC設定伺服器及受管理設備之間建立閘道器，使閘道器能夠動態監控IaC設定伺服器部署IaC腳本時傳送至受管理設備的派送封包，並利用封包解密技術對派送封包進行解密，以評估IaC腳本中是否含有安全威脅。同時在閘道器上裝設入侵偵測元件，當檢測到派送封包含有惡意行為，或偵測元件偵測到其他異常網路行為時，通過入侵偵測系統及時發出告警，以避免當攻擊者利用IaC設定伺服器部署惡意IaC腳本時，因無任何防禦及偵測措施，導致攻擊者能夠無聲無息滲透受管理設備的問題。

Infrastructure as Code (IaC) facilitates automated management and enhances operational efficiency by defining and managing infrastructure with code. However, IaC also introduces cyber security challenges. When IaC scripts are deployed to configure managed devices (i.e., apply updates), a compromised IaC configuration server could be exploited by attackers. This compromise allows them to deliver malicious instructions from the script to all managed devices without encountering any defenses. Additionally, as IaC tools often employ encrypted protocols for update delivery, intrusion detection systems face difficulties in detecting malicious commands, resulting in managed devices being reactive rather than proactive in response to security incidents.
To address the above concerns, we propose a Cyber Security Gateway design and implement for IaC Configuration Management. This gateway is strategically positioned between the IaC configuration server and the managed devices, enabling dynamic inspection of dispatch packets during the deployment of IaC scripts. With decryption techniques, it evaluates packet content for potential security threats. An incorporated intrusion detection system promptly triggers alerts if it identifies malicious activities in the decrypted packets or other abnormal network behaviors.

[1] L. Bass, I. Weber, and L. Zhu, DevOps: A Software Architect’s Perspective. New York, 2015.
[2] “Microsoft releases its second edition of Cyber Signals tracking ransomware’s new business model,” Microsoft News Center Hong Kong, Aug. 23, 2022. https://news.microsoft.com/en-hk/2022/08/23/microsoft-releases-its-second-edition-of-cyber-signals-tracking-ransomwares-new-business-model/ (accessed May 06, 2023).
[3] W. Hummer, F. Rosenberg, F. Oliveira, and T. Eilam, “Testing Idempotence for Infrastructure as Code,” Jan. 2013. doi: 10.1007/978-3-642-45065-5_19.
[4] K. Ikeshita, F. Ishikawa, and S. Honiden, “Test Suite Reduction in Idempotence Testing of Infrastructure as Code,” Jun. 2017, pp. 98–115. doi: 10.1007/978-3-319-61467-0_6.
[5] A. Rahman, C. Parnin, and L. Williams, “The Seven Sins: Security Smells in Infrastructure as Code Scripts,” in 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), May 2019, pp. 164–175. doi: 10.1109/ICSE.2019.00033.
[6] S. Dalla Palma, D. Di Nucci, F. Palomba, and D. A. Tamburri, “Toward a catalog of software quality metrics for infrastructure code,” J. Syst. Softw., vol. 170, p. 110726, Dec. 2020, doi: 10.1016/j.jss.2020.110726.
[7] M. Artac, T. Borovssak, E. Di Nitto, M. Guerriero, and D. A. Tamburri, “DevOps: Introducing Infrastructure-as-Code,” in 2017 IEEE/ACM 39th International Conference on Software Engineering Companion (ICSE-C), May 2017, pp. 497–498. doi: 10.1109/ICSE-C.2017.162.
[8] Y. Jiang and B. Adams, “Co-evolution of Infrastructure and Source Code - An Empirical Study,” in 2015 IEEE/ACM 12th Working Conference on Mining Software Repositories, May 2015, pp. 45–55. doi: 10.1109/MSR.2015.12.
[9] J. Humble and D. Farley, Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation. Upper Saddle River, NJ, 2010.
[10] R. Opdebeeck, A. Zerouali, C. Velázquez-Rodríguez, and C. D. Roover, “Does Infrastructure as Code Adhere to Semantic Versioning? An Analysis of Ansible Role Evolution,” in 2020 IEEE 20th International Working Conference on Source Code Analysis and Manipulation (SCAM), Sep. 2020, pp. 238–248. doi: 10.1109/SCAM51674.2020.00032.
[11] A. Rahman, A. Partho, P. Morrison, and L. Williams, “What Questions Do Programmers Ask about Configuration as Code?,” in 2018 IEEE/ACM 4th International Workshop on Rapid Continuous Software Engineering (RCoSE), May 2018, pp. 16–22.
[12] R. Shambaugh, A. Weiss, and A. Guha, “Rehearsal: A Configuration Verification Tool for Puppet.” arXiv, May 17, 2016. doi: 10.48550/arXiv.1509.05100.
[13] O. Hanappi, W. Hummer, and S. Dustdar, “Asserting reliable convergence for configuration management scripts,” in Proceedings of the 2016 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications, in OOPSLA 2016. New York, NY, USA: Association for Computing Machinery, Oct. 2016, pp. 328–343. doi: 10.1145/2983990.2984000.
[14] J. Shah, D. Dubaria, and J. Widhalm, “A Survey of DevOps tools for Networking,” in 2018 9th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), Jan. 2018, pp. 185–188. doi: 10.1109/UEMCON.2018.8796814.
[15] J. Turnbull and J. McCune, Pro Puppet. Apress, 2011.
[16] M. Taylor and S. Vargo, Learning Chef: A Guide to Configuration Management and Automation. Sebastopol, CA, 2013.
[17] A. Abdullahi, “Top 8 Infrastructure as Code (IaC) Tools for 2023,” Geekflare, Feb. 21, 2023. https://geekflare.com/infrastructure-as-code-iac-tools/ (accessed Jul. 27, 2023).
[18] “How to Choose an Infrastructure-as-Code Tool for Your Project,” Encora. https://www.encora.com/insights/how-to-choose-an-infrastructure-as-code-tool-for-your-project (accessed Jul. 29, 2023).
[19] “Infrastructure as Code Tools to Boost Your Productivity in 2023.” https://www.xenonstack.com/blog/infrastructure-as-code-tools (accessed Jul. 29, 2023).
[20] Michael Langford, “Top 5 Infrastructure as Code (IaC) Security Challenges,” Trend Micro, Apr. 20, 2023. https://www.trendmicro.com/en_us/devops/22/g/infrastructure-as-code-iac-security.html (accessed May 06, 2023).
[21] R. Khan, K. McLaughlin, B. Kang, D. Laverty, and S. Sezer, “A Seamless Cloud Migration Approach to Secure Distributed Legacy Industrial SCADA Systems,” in 2020 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), Feb. 2020, pp. 1–5. doi: 10.1109/ISGT45199.2020.9087760.
[22] R. Khan, K. Mclaughlin, D. Laverty, and S. Sezer, “Design and Implementation of Security Gateway for Synchrophasor Based Real-Time Control and Monitoring in Smart Grid,” IEEE Access, vol. 5, pp. 11626–11644, 2017, doi: 10.1109/ACCESS.2017.2716440.