M7 infracstructure as code (IAC)

This is the second to the last module in the ALAMOSE workshop

https://sites.google.com/view/alamose-v1/m7-iac?authuser=0

 

M7-SECURITY WEAKNESS IN INFRASTRUCTURE AS CODE (IAC) SCRIPTS

Infrastructure as code (IAC)

automated resource management

Common security weakness in IAC
  misconfigurations such as hard coded password
  hardcoded secrets such as API keys

 guessable user: admin, root, ubutnu
 parts are open (micro services API and search engine etc)

 resources (database) accessible from outside etc

 did not hide server and tech stack information

Glitch https://github.com/sr-lab/GLITCH 

Glitch is a framework which detects IAC smells automatically

detects different security smells written in Ansible, Puppert of Chef

M7-SECURITY WEAKNESS IN INFRASTRUCTURE AS CODE (IAC) SCRIPTS

Description

Identifying security weaknesses, such as hard-coded passwords, hard coded secrets, weak crypto, full permission in of files etc in chef, puppet, ansible, terraform, SaltStack scripts, which are used to automatically set up and manage the infrastructure of technology systems is called infrastructure as code (IaC).

Courses Where This Module Is Integrated

• Software Quality Assurance (Auburn University, Spring 2023, Fall 2023)

Activities 

Pre-lab Content Dissemination

A security weakness is an error, a flaw such as an insecure coding pattern that can lead to vulnerability. A security weakness, such as a hard-coded secret, can be propagated to other parts of the program. A flow analysis is a process to identify how security weaknesses, such as insecure coding patterns in a program, can propagate security weaknesses within a software system.

In-class Hands-on Experience(using Mac)

1. Install Python by brew install python if you have not installed it in your machine.

2. Download or clone the source code of GLITCH: https://github.com/sr-lab/GLITCH

3. Go to this directory via terminal

4. Install the tools using the commands as follows

brew install poetry

poetry install

5. Create an YAML file named test.yaml and paste the following source code in the file and save it.

---

- name: create an app with full permission

  file:

    path: /app

    owner: foo

    group: foo

    mode: "0777"

6. Run the tool using the command

poetry run glitch --tech ansible --csv test.yaml

Post Lab Experience

The use of specific keywords such as hack, fixme, todo, bug, later, and bug in comments can reveal missing security functionality and the presence of bugs (CWE-546). In the following figure, we demonstrated steps for automatically identifying suspicious comments in Ansible scripts.

 

 

cyber career pathway tool

https://niccs.us-cert.gov/workforce-development/cyber-career-pathways

SFS information

 78.   During the past 12 months, please indicate which Department level Federal agencies in which your SFS program partnered and describe the activity (e.g., worked on a "real world" project or research for publication or presentation, invited agency as guest speaker, gave presentation at agency, networked in an informal setting, placed SFS students for internships or permanent positions upon graduation). Listed below are the Department level Federal agencies.

Department of Agriculture

Department of Commerce – Bureau of Economic Analysis

Department of Commerce – Federal Trade Commission

Department of Commerce – National Institute of Standards & Technology

Department of Defense – Air Force/Air Force Material Command

Department of Defense – Air Force/Air Force Research Laboratory

Department of Defense – Army/Army CIO

Department of Defense – Army/Army Cyber Command and Second Army

Department of Defense – Army/Army Knowledge Leaders Program

Department of Defense – Army/Army Research Laboratory

Department of Defense – Army/Communications-Electronics Research, Development, and Engineering Center (CERDEC)

Department of Defense – Army/Engineering Research and Development Center (ERDC)

Department of Defense – Army/Intelligence Security Command (INSCOM)

Department of Defense – Army/US Army Corps of Engineers

Department of Defense - Defense Information Systems Agency

Department of Defense - Defense Intelligence Agency

Department of Defense - National Geospatial-Intelligence Agency

Department of Defense - National Security Agency

Department of Defense – Navy/Naval Air Systems Command (NAVAIR)

Department of Defense – Navy/Naval Criminal Investigative Service (NCIS)

Department of Defense – Navy/Naval Oceanographic Office

Department of Defense – Navy/Naval Post Graduate School

Department of Defense – Navy/Naval Research Laboratory

Department of Defense – Navy/Naval Sea Systems Command (NAVSEA)

Department of Defense – Navy/Office of Naval Research

Department of Defense – Navy/Space and Naval Warfare Systems Command (SPAWAR)

Department of Defense - Other DoD sub-agency

Department of Education

Department of Energy (if you partnered with the FFRDC, please select the FFRDC in question #78 below)

Department of Health and Human Services

Department of Homeland Security - Customs & Border Protection

Department of Homeland Security - Cybersecurity and Infrastructure Security Agency

Department of Homeland Security - Other DHS sub-agency

Department of Housing and Urban Development

Department of Interior

Department of Justice - Federal Bureau of Investigations

Department of Justice - Office of the Chief Information Officer

Department of Justice - Other DOJ sub-agency

Department of Labor

Department of State

Department of Transportation

Department of Treasury

Department of Veterans Affairs

 (Enter up to 2000 characters)

79.   During the past 12 months, please indicate which independent agencies in which your SFS program partnered and describe the activity (e.g., worked on a "real world" project or research for publication or presentation, invited agency as guest speaker, gave presentation at agency, networked in an informal setting, placed SFS students for internships or permanent positions upon graduation). Listed below are the Independent Federal agencies.

Administrative Conference of the United States

African Development Foundation

Central Intelligence Agency

Commission on Civil Rights

Commission on Presidential Scholars

Commission on Security and Cooperation in Europe

Consumer Financial Protection Bureau

Corporation for National and Community Service

Defense Nuclear Facilities Safety Board

Denali Commission

Environmental Protection Agency

Equal Employment Opportunity Commission

Export-Import Bank of the United States

Farm Credit Administration

Executive Office of the President

Federal Communications Commission

Federal Deposit Insurance Corporation

Federal Election Commission

Federal Housing Finance Agency

Federal Labor Relations Authority

Federal Maritime Commission

Federal Mediation and Conciliation Service

Federal Mine Safety and Health Review Commission

Federal Reserve System

Federal Retirement Thrift Investment Board

Federal Trade Commission

General Accountability Office

General Services Administration

Institute of Museum and Library Services

Inter-American Foundation

Merit Systems Protection Board

Millennium Challenge Corporation

National Aeronautics and Space Administration

National Archives and Records Administration

National Capital Planning Commission

National Credit Union Administration

National Endowment for the Humanities

National Labor Relations Board

National Mediation Board

National Railroad Passenger Corporation

National Science Foundation

National Transportation Safety Board

Nuclear Regulatory Commission

Occupational Safety and Health Review Commission

Office of Government Ethics

Office of Personnel Management

Office of Special Counsel

Office of the Director of National Intelligence

Overseas Private Investment Corporation

Peace Corps

Pension Benefit Guaranty Corporation

Postal Regulatory Commission

Privacy and Civil Liberties Oversight Board

Railroad Retirement Board

Securities and Exchange Commission

Selective Service System

Small Business Administration

Smithsonian Institution

Social Security Administration

Surface Transportation Board

Tennessee Valley Authority

U.S. Agency for Global Media

U.S. Agency for International Development

U.S. Commodity Futures Trading Commission

U.S. International Trade Commission

U.S. Nuclear Regulatory Commission

U.S. Postal Service

U.S. Trade and Development Agency

U.S. Courts

U.S. Senate 80.   During the past 12 months, please indicate which Federally Funded Research Development Centers (FFRDC) in which your SFS program partnered and describe the activity (e.g., worked on a "real world" project or research for publication or presentation, invited FFRDC as guest speaker, gave presentation at FFRDC, networked in an informal setting, placed SFS students for internships or permanent positions upon graduation). Listed below are the FFRDCs. Aerospace Corporation Ames Laboratory Argonne National Laboratory Arroyo Center Brookhaven National Laboratory Center for Advanced Aviation System Development Center for Communications and Computing Center for Enterprise Modernization Center for Naval Analyses Center for Nuclear Waste Regulatory Analyses CMS Alliance to Modernize Healthcare Fermi National Accelerator Laboratory Frederick National Laboratory for Cancer Research Homeland Security Operational Analysis Center Homeland Security Systems Engineering and Development Institute  Idaho National Laboratory Institute for Defense Analyses Jet Propulsion Laboratory Johns Hopkins Applied Physics Laboratory Judiciary Engineering and Modernization Center Lawrence Berkeley National Laboratory Lawrence Livermore National Laboratory Lincoln Laboratory Los Alamos National Laboratory MITRE Corporation National Biodefense Analysis and Countermeasures Center National Center for Atmospheric Research National Cybersecurity Center of Excellence National Defense Research Institute National Optical Astronomy Observatory National Radio Astronomy Observatory National Renewable Energy Laboratory National Security Engineering Center National Solar Observatory Oak Ridge National Laboratory Pacific Northwest National Laboratory  Princeton Plasma Physics Laboratory Project Air Force Sandia National Laboratories Savannah River National Laboratory  Science and Technology Policy Institute SLAC National Accelerator Laboratory Software Engineering Institute Systems and Analyses Center  (Enter up to 2000 characters)  81.   During the past 12 months, please indicate which city, county, state, or tribal organizations in which your SFS program partnered and describe the activity (e.g., worked on a "real world" project or research for publication or presentation, invited organization as guest speaker, gave presentation at organization, networked in an informal setting, placed SFS students for internships or permanent positions upon graduation). (Enter up to 2000 characters)

QUESTIONNAIRE FOR NATIONAL SECURITY POSITIONS

Standard Form 86 Revised November 2016 U.S. Office of Personnel Management 5 CFR Parts 731, 732, and 736

QUESTIONNAIRE FOR NATIONAL SECURITY POSITIONS

https://www.opm.gov/Forms/pdf_fill/SF86.pdf