So this is what it looks like right now. I've got an empty repository with the
exception of ReadMe and if I look under Actions, I don't have any actions or
workflows that have been defined. But on my local computer, I've made code and
I've defined an action. So when I push this up in the GitHub, that's gonna kick
off the action and run the bandit test. So I'm gonna go into source control
here.
I'm going to queue up all of these changes and we're gonna make this commit.
And we're gonna say push our first test to GitHub. I'll say commit. We're gonna WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're gonna say push our first test to GitHub. I'll say commit. We're gonna
sign it with my SSH keys and then this sync will push that up into GitHub. So
now when I jump back into GitHub and refresh, we see now I've got the
workflows and the code and actions should now be running. Sure enough, the
orange right here indicates that it's currently running. If I give it a click,
we see that it's now working through the process and boom, it was able to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we see that it's now working through the process and boom, it was able to
successfully complete this. When I jump into Bandit scan, we're gonna take a
look at what it did. Let's look under run Bandit and interestingly, it detected
this as a low severity item with medium confidence. And that's largely because
of how Bandit is constructed to think of things as like hard-coded passwords
as low severity. And you're thinking to yourself, well that sounds pretty bad,
but WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but
what it really thinks is more severe is any action that allows the user to
potentially take over the computer itself. So when I jump back to cursor and to
my
application, I may paste in something like evaluate user input, allowing users
to type their own commands for the operating system directly in to your
front end application. So just by creating this function that will take user
input and use eval, that's going to return this as a high severity flag item. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
input and use eval, that's going to return this as a high severity flag item.
So I'm going to go ahead and make this change, we'll go ahead and say add high
risk operation, we'll commit that change and push it. And this will kick off a
new GitHub action run. Now we've added high risk operation and it's going to be
running in the background. So we'll let it run. This will only take a few
seconds
because it's installing the pip environment. And then when it's done, we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because it's installing the pip environment. And then when it's done, we'll
see, oh look, now we've got a failure. And this is exactly what we were hoping
to
see. Now that we have a medium risk operation with high confidence problem,
this is going to fail the entire pipeline. So at no point is the pipeline
allowed
to progress to building artifacts, shipping code and delivering it to end
infrastructure, nor is it attempting to deploy new resources in the cloud WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
infrastructure, nor is it attempting to deploy new resources in the cloud
either.
This is why dev sec ops exists. This was not a heavy lift, was it? To integrate
something like bandit, if I jump back here, to integrate something like bandit
for Python applications was really just telling it install bandit and run a
bandit scan. These four lines of code is all it took to start scanning for
severe issues with Python applications. It's similar for other programming WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
severe issues with Python applications. It's similar for other programming
languages like JavaScript. They also have their own security frameworks built
into it. There are dozens of different ways to integrate security into a DevOps
pipeline. And this is one of the easiest examples to wrap your head around. At
this point, you're probably able to describe exactly what a dev sec ops
pipeline is, because we covered what a DevOps pipeline is and what CI CD is.
Then we saw how security can be integrated into it and how a good measure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we saw how security can be integrated into it and how a good measure
of security can actually fail pipelines before we start delivering vulnerable
code to our production systems. I hope this has been informative for you and I
like to thank you for viewing.