The DOI matches its Crossref record; 31 of the 31 references it cites were found in a registry or an index.
Securing Infrastructure as Code (IaC) through DevSecOps:A Comprehensive Risk Management Framework
Abstract
Despite the evident advantages of Infrastructure as Code (IaC) in software development, the nature of bugs and potential threats arising from its implementation remains subject to ongoing investigation. The formulation of a list, enumerating potential threats during the IaC process remains an unattained goal. However, it is not enough to recounting IaC threats only, it is imperative for Development (Dev), Security (Sec), and Operations (Ops) teams to synergistically collaborate from early developmental stages to conduct thorough risks’ analysis, estimation, and mitigation procedures concerning IaC-related risks. Moreover, adhering to security standards and risk management framework throughout the IaC lifecycle will enhance the overall security of the deployment process. A risk management framework for IaC is essential. The extant risk management and threat modeling methodologies may necessitate tailoring to effectively protect the Software Development Lifecycle (SDLC) from IaC misuse. This research aims to identify threats that threaten IaC lifecycle or arise from the utilization of IaC. In addition, it tries to integrate IaC practices with the DevSecOps culture to devise a robust risk management framework and prescribe pertinent practices conducive to fostering secure IaC implementation.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“While the paper provides a strong conceptual foundation, it does not present empirical results or practical evaluations of the proposed framework, making it difficult to assess its effectiveness in varied organisational settings.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [57]
Citations
Cites
A survey on security challenges in cloud computing: issues, threats, and solutions
Tabrizchi, H., & Rafsanjani, M. K. (2020) · The Journal of Supercomputing · doi:10.1007/s11227-020-03213-1 · Cited by 540
The Seven Sins: Security Smells in Infrastructure as Code Scripts
Rahman, A., Parnin, C., & Williams, L. A. (2019) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse.2019.00033 · Cited by 234
A systematic mapping study of infrastructure as code research
Rahman, A., Mahdavi-Hezaveh, R., & Williams, L. A. (2018) · Information and Software Technology · doi:10.1016/j.infsof.2018.12.004 · Cited by 222
Securing the Internet of Things (IoT): A Security Taxonomy for IoT
Rizvi, S., Kurtz, A., Pfeffer, J. R., & Rizvi, M. R. (2018) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2018.00034 · Cited by 152
Adoption, Support, and Challenges of Infrastructure-as-Code: Insights from Industry
Guerriero, M., Garriga, M., Tamburri, D. A., & Palomba, F. (2019) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme.2019.00092 · Cited by 144
Continuous deployment at Facebook and OANDA
Savor, T., Douglas, M., Gentili, M., Williams, L. A., Beck, K. L., & Stumm, M. (2016) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/2889160.2889223 · Cited by 140
Security and Privacy Issues in Cloud, Fog and Edge Computing
Parikh, S., Dave, D., Patel, R., & Doshi, N. (2019) · Procedia Computer Science · doi:10.1016/j.procs.2019.11.018 · Cited by 119
From Monolithic Systems to Microservices: A Comparative Study of Performance
Tapia, F., Mora, M. Á. C., Fuertes, W., Aules, H., Castro, E. G. F., & Toulkeridis, T. (2020) · Applied Sciences · doi:10.3390/app10175797 · Cited by 105
IoT Network Security: Threats, Risks, and a Data-Driven Defense Framework
Wheelus, C., & Xingquan Zhu, A. (2020) · IoT · doi:10.3390/iot1020016 · Cited by 100
Rangnau, T., Buijtenen, R. V., Fransen, F., & Türkmen, F. (2020) · IEEE International Enterprise Distributed Object Computing Conference (EDOC) · doi:10.1109/edoc49727.2020.00026 · Cited by 99
Research works printed but not linked: 9
- Sharma, 2017, DevOps For Dummies
- Gasiba, Raising Security Awareness of Cloud Deployments using Infrastructure as Code through CyberSecurity Challenges
- Chiodi, 2020, Cloud Threat Report: Putting the Sec in DevOps
- 2022, 2022 vulnerability statistics report
- 2020, 2020 Vulnerability Statistics Report
- 2018, NIST SP 800-37, Risk Management Framework for Information Systems and Organizations
- Lu, 2014, An analysis and comparison of cloud data center energy efficient resource managemen technology, International Journal of ServicesComputing, 2, 32
- 2021, OWASP Top 10 - A05:2021 – Security Misconfiguration
- Rentrop, Shadow IT Management and Control of unofficial IT
Cited by
Sorted by citations
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8
Metadata
- Authors
- Zeini, A., Lennon, R. G., & Lennon, P.
- Affiliations
- Atlantic Technological University (IE)
- ORCID
- Lennon, Ruth G.
- Venue
- 2023 Cyber Research Conference - Ireland (Cyber-RCI)
- Publisher
- IEEE
- Published
- 2023-11-24
- Pages
- 1-11
- OpenAlex
- W4402633633
- Cited by
- 4
- References
- 31
- Citations by year
- 2026: 2 · 2025: 2
- FWCI
- 1.03
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Cyber Research Conference - Ireland (Cyber-RCI) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- infrastructure as code, DevSecOps, risk management framework, threat modeling, software development lifecycle, security standards, risk mitigation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Securing Infrastructure as Code (IaC) through DevSecOps:A Comprehensive Risk Management Framework. https://app.cochat.ai/papers/10.1109/cyber-rci59474.2023.10671452
- The paper
- Zeini, A., Lennon, R. G., & Lennon, P. (2023). Securing Infrastructure as Code (IaC) through DevSecOps:A Comprehensive Risk Management Framework. 2023 Cyber Research Conference - Ireland (Cyber-RCI). https://doi.org/10.1109/cyber-rci59474.2023.10671452
