[{“box”:0,”content”:”[if 992 equals=”Open Access”]n
n
Open Access
nn
n
n[/if 992]n
n
n
n
n
n
Yamuna Mundru, Manas Kumar Yogi
n
- n t
n
n
n[/foreach]
n
n[if 2099 not_equal=”Yes”]n
- [foreach 286] [if 1175 not_equal=””]n t
- Assistant Professor, Assistant Professor Computer Science and Engineering-AI & ML Department, Pragati Engineering College (Autonomous), Surampalem, Computer Science and Engineering-AI & ML Department, Pragati Engineering College (Autonomous), Surampalem Andhra Pradesh, Andhra Pradesh India, India
n[/if 1175][/foreach]
n[/if 2099][if 2099 equals=”Yes”][/if 2099]n
Abstract
nThis investigative research delves into secure coding practices within shell scripting, aiming to reduce prevalent security vulnerabilities and improve the overall security stance of shell scripts. It emphasizes three key areas: static analysis, dynamic analysis, and manual code review. Through static analysis, the code structure, usage of unsafe functions, and potential vulnerabilities are examined without executing the script. Dynamic analysis entails running the script in controlled settings to detect runtime vulnerabilities and behaviors. Manual code review entails an in-depth inspection of code logic, input validation, and error handling. The study compares its findings with established secure coding guidelines, including input validation, proper quoting, error handling, and the principle of least privilege. The effectiveness of recommended best practices and mitigation strategies is assessed through practical implementation and testing. By following these methodologies, developers can identify and address security vulnerabilities in shell scripts, ensuring the integrity, confidentiality, and availability of systems and data.
n
Keywords: Shell scripts, secure, coding, weakness, incidents, attack
n[if 424 equals=”Regular Issue”][This article belongs to Journal of Advances in Shell Programming(joasp)]
n
n
n
n
n
nn
nn[if 992 equals=”Open Access”] Full Text PDF Download[/if 992] n[if 992 not_equal=”Open Access”]
[/if 992]nnnn[if 379 not_equal=””]nBrowse Figures
n
n[/if 379]n
References
n[if 1104 equals=””]n
- Dai T, Karve A, Koper G, Zeng S. Automatically detecting risky scripts in infrastructure code. InProceedings of the 11th ACM Symposium on Cloud Computing 2020 Oct 12 (pp. 358–371).
- Graff M, Van Wyk KR. Secure coding: principles and practices. ” O’Reilly Media, Inc.”; 2003.
- Seacord RC. The CERT C secure coding standard. Pearson Education; 2008 Oct 14.
- Payne BR, Walker AR. Motivating secure coding practices in a freshman-level programming course. InInfoSecCD 2014 Oct 11 (pp. 1–1).
- Payne BR, Walker AR. Motivating secure coding practices in a freshman-level programming course. InInfoSecCD 2014 Oct 11 (pp. 1–1).
- Rahman A, Rahman MR, Parnin C, Williams L. Security smells in ansible and chef scripts: A replication study. ACM Transactions on Software Engineering and Methodology (TOSEM). 2021 Jan 20;30(1):1–31.
- Wheeler DA. Secure programming for Linux and Unix HOWTO. 1999.
- Bosman E, Bos H. Framing signals-a return to portable shellcode. In2014 IEEE Symposium on Security and Privacy 2014 May 18 (pp. 243–258). IEEE.
- Ferrer F, More A. Towards Secure Scripting Development. InIII Workshop de Seguridad Informática (WSegI 2011)(XL JAIIO, Córdoba, 29 de agosto al 2 de septiembre de 2011) 2011.
- Rights RF. Secure Coding. Practical steps to defend your web apps. 2007.
- Ferrer F, More A. Towards Secure Scripting Development. InIII Workshop de Seguridad Informática (WSegI 2011)(XL JAIIO, Córdoba, 29 de agosto al 2 de septiembre de 2011) 2011.
- Aderhold M, Cuéllar J, Mantel H, Sudbrock H. Exemplary formalization of secure coding guidelines. TU Darmstadt and Siemens AG, Tech. Rep. 2010 Mar;3.
- Ankolekar VL. Application Development Technology and Tools: Vulnerabilities and threat management with secure programming practices, a defense in-depth approach. Option. 2003 Nov 10;1:10.
- Hortlund A. Security smells in open-source infrastructure as code scripts: A replication study. 2021.
nn[/if 1104][if 1104 not_equal=””]n
- [foreach 1102]n t
- [if 1106 equals=””], [/if 1106][if 1106 not_equal=””],[/if 1106]
n[/foreach]
n[/if 1104]
nn
nn[if 1114 equals=”Yes”]n
n[/if 1114]
n
n
n
n
n
| Volume | 11 | |
| [if 424 equals=”Regular Issue”]Issue[/if 424][if 424 equals=”Special Issue”]Special Issue[/if 424] [if 424 equals=”Conference”][/if 424] | 01 | |
| Received | April 24, 2024 | |
| Accepted | May 7, 2024 | |
| Published | May 16, 2024 |
n
n
n
n
n
n function myFunction2() {n var x = document.getElementById(“browsefigure”);n if (x.style.display === “block”) {n x.style.display = “none”;n }n else { x.style.display = “Block”; }n }n document.querySelector(“.prevBtn”).addEventListener(“click”, () => {n changeSlides(-1);n });n document.querySelector(“.nextBtn”).addEventListener(“click”, () => {n changeSlides(1);n });n var slideIndex = 1;n showSlides(slideIndex);n function changeSlides(n) {n showSlides((slideIndex += n));n }n function currentSlide(n) {n showSlides((slideIndex = n));n }n function showSlides(n) {n var i;n var slides = document.getElementsByClassName(“Slide”);n var dots = document.getElementsByClassName(“Navdot”);n if (n > slides.length) { slideIndex = 1; }n if (n (item.style.display = “none”));n Array.from(dots).forEach(n item => (item.className = item.className.replace(” selected”, “”))n );n slides[slideIndex – 1].style.display = “block”;n dots[slideIndex – 1].className += ” selected”;n }n”}]