Vulnerabilities in infrastructure as code: what, how many, and who?
Vulnerabilities in infrastructure as code: what, how many, and who?
Aicha War,Alioune Diallo,2 Authors,Tégawendé F. Bissyandé
2025 · DOI: 10.1007/s10664-025-10672-8
Empirical Software Engineering · 8 Citations
TLDR
The study uncovers that IaC components are plagued by exploitable vulnerabilities that span all ten categories of security bugs outlined in the OWASP Top 10 2021, and proposes that IT teams need to foster stronger collaboration across DevOps profiles and break down the boundaries with security operators to enhance Infrastructure as Code’s security posture through the adoption of DevSecOps practices.