MICS Capstone Project Spring 2023

Build a Secure IaC (BaSIC)

Team members:

Problem Statement

The increasing adoption of Infrastructure as Code (IaC) for managing and automating IT infrastructure has led to a greater need for secure IaC solutions. IaC enables organizations to quickly provision and manage infrastructure resources, but it also creates new security risks. Traditional security practices are not designed to address the unique security challenges posed by IaC.

Many IaC solutions on the market lack adequate security features and fail to address critical security concerns, such as access control, credential management, and encryption. This leaves organizations vulnerable to attacks that can result in data breaches, system downtime, and financial losses. There is no unified resource for developers to reference IaC code samples and security suggestions for all available languages and platforms.

To address these challenges, there is a need for a secure IaC product that provides robust security features to protect infrastructure resources managed through IaC. This product should provide comprehensive security controls for all stages of the IaC lifecycle, from development to deployment, and should integrate with existing security tools and processes. It should also be easy to use and configure, so that organizations can adopt it quickly without requiring extensive security expertise.

Enter BaSIC

BaSIC provides simplicity and serves as a resource for developers to bridge knowledge gaps and get a comprehensive overview of the services offered by various cloud providers. Filtering and suggesting relevant CIS benchmarks and security policies based on the service the user is working with, BaSIC saves developers the hassle of going through security documentation. The platform incorporates a fillable box for developers to edit the boilerplate code we provide and leverages several open source tools to scan user code for security vulnerabilities.