WEBVTT

1
00:00.000 --> 00:05.000
So what I'm going to do is I'm going to create a basic dev sec ops pipeline.

2
00:05.000 --> 00:09.500
I'm going to leverage GitHub actions to actually do the build and the test.

3
00:09.500 --> 00:14.990
And then it's going to fail because I'm going to do something stupid, like hard

4
00:14.990 --> 00:21.160
code, a security password directly in the code and then run the test to

5
00:21.160 --> 00:26.450
actually break it saying, wait, you've detected a password directly in your

6
00:26.450 --> 00:27.000
code.

7
00:27.000 --> 00:31.910
So to do this, we're going to use GitHub. So I'm going to create a new empty
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:27.000 --> 00:31.910
So to do this, we're going to use GitHub. So I'm going to create a new empty

8
00:31.910 --> 00:33.000
GitHub repository.

9
00:33.000 --> 00:39.000
I'll call this score dev sec ops or something basic like this.

10
00:39.000 --> 00:45.000
And I'll say the description, which is optional dev sec ops example pipeline

11
00:45.000 --> 00:48.000
with security flaws.

12
00:48.000 --> 00:52.530
We'll leave this public so anyone who wants to can follow along and I'll go

13
00:52.530 --> 00:55.000
ahead and I'll create this repository.

14
00:55.000 --> 00:59.560
Now, I have to do some things to get my local computer synced up with this

15
00:59.560 --> 01:01.000
GitHub repository.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:59.560 --> 01:01.000
GitHub repository.

16
01:01.000 --> 01:04.610
So on my local computer, I'm going to move into my code folder, which is where

17
01:04.610 --> 01:10.000
I keep all of my projects, and I'm going to make a new directory.

18
01:10.000 --> 01:13.000
We'll call this dev sec ops, something like that.

19
01:13.000 --> 01:16.000
Now I'm going to move into dev sec ops.

20
01:16.000 --> 01:19.000
And if I type ls, we see nothing is in there right now.

21
01:19.000 --> 01:25.320
So I can initialize this whole repository by basically copying this whole block

22
01:25.320 --> 01:30.000
right here, and then pasting it in all as one command.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
01:25.320 --> 01:30.000
right here, and then pasting it in all as one command.

23
01:30.000 --> 01:35.000
Now it uses in my case, SSH keys from one password to authenticate to GitHub.

24
01:35.000 --> 01:39.510
In your case, it'll probably just work because that's how, you know, the basic

25
01:39.510 --> 01:42.000
environment doesn't worry about SSH keys.

26
01:42.000 --> 01:47.610
So now that I've got this up and running, if I jump back here and refresh, we

27
01:47.610 --> 01:52.000
should see now it has a read me file in place.

28
01:52.000 --> 01:53.000
Great.

29
01:53.000 --> 01:57.130
So what I'm going to do here in this folder is I'm going to open my code editor

30
01:57.130 --> 01:59.000
, which it's 2025.

31
01:59.000 --> 02:00.000
We use cursor now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:59.000 --> 02:00.000
We use cursor now.

32
02:00.000 --> 02:05.000
So I'll say cursor dot and that opens cursor in this folder.

33
02:05.000 --> 02:09.000
So I'll press enter here and it launches it right here.

34
02:09.000 --> 02:14.000
And I notice right here, I am in the dev sec ops folder.

35
02:14.000 --> 02:19.000
So there's some things that I need to do in order to turn this into my project.

36
02:19.000 --> 02:28.000
The first thing I'm going to do is I am going to create my new application.

37
02:28.000 --> 02:30.000
This is going to be a basic Python file.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
02:28.000 --> 02:30.000
This is going to be a basic Python file.

38
02:30.000 --> 02:32.000
I'll call it app.

39
02:32.000 --> 02:34.000
Oh, got to click up in here.

40
02:34.000 --> 02:36.000
Let's try to get new file.

41
02:36.000 --> 02:39.000
There we go app dot py.

42
02:39.000 --> 02:43.000
So now that I've got app dot py brought up here on the screen.

43
02:43.000 --> 02:45.000
Oh, jump back to cursor.

44
02:45.000 --> 02:47.000
I'm just going to paste in my block of code.

45
02:47.000 --> 02:49.000
You can see it's very basic.

46
02:49.000 --> 02:54.320
We're hard coding a password called hard coded password and our function

47
02:54.320 --> 02:57.000
returns that password to whatever calls it.

48
02:57.000 --> 02:59.000
This is the big problem.

49
02:59.000 --> 03:03.000
Obviously hard coding a secret is never okay.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:59.000 --> 03:03.000
Obviously hard coding a secret is never okay.

50
03:03.000 --> 03:05.000
So how do we detect this?

51
03:05.000 --> 03:09.000
Python has a library called bandit.

52
03:09.000 --> 03:14.350
You don't need to know this for the exam, but you should know that every

53
03:14.350 --> 03:21.740
programming language has security libraries that you can run against your code

54
03:21.740 --> 03:24.000
that detects security flaws.

55
03:24.000 --> 03:26.000
This is what bandit does.

56
03:26.000 --> 03:32.790
We say bandit inspect this file and find security flaws and bandit will find
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
03:26.000 --> 03:32.790
We say bandit inspect this file and find security flaws and bandit will find

57
03:32.790 --> 03:38.000
this hard coded password and fail my DevOps pipeline.

58
03:38.000 --> 03:40.000
So that's the idea.

59
03:40.000 --> 03:45.510
So with this right here, we've now got a application, even if it's the world's

60
03:45.510 --> 03:49.000
most basic application, that has a security flaw.

61
03:49.000 --> 03:55.670
So now what I need to do is I need to tell GitHub, hey, you're going to run a

62
03:55.670 --> 04:03.060
Python application and you need to install bandit and check the bandit results
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
03:55.670 --> 04:03.060
Python application and you need to install bandit and check the bandit results

63
04:03.060 --> 04:07.000
against this application when you go to run the pipeline.

64
04:07.000 --> 04:13.300
So to do this over here on the right hand side, we create a new folder called

65
04:13.300 --> 04:15.000
dot get hub.

66
04:15.000 --> 04:21.000
Then inside that folder, we create a new folder called workflows.

67
04:21.000 --> 04:24.000
This is where we define our CI CD pipelines.

68
04:24.000 --> 04:30.340
Then lastly, we put any YAML file in here and automatically GitHub is going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
04:24.000 --> 04:30.340
Then lastly, we put any YAML file in here and automatically GitHub is going to

69
04:30.340 --> 04:36.000
look for YAML files in that folder and perform whatever actions we tell it to.

70
04:36.000 --> 04:42.000
So I'll call this bandit test dot YAML.

71
04:42.000 --> 04:46.140
I'm going to go ahead and paste in my code here like this and you'll be able to

72
04:46.140 --> 04:48.000
see exactly what this does.

73
04:48.000 --> 04:51.000
We give it a name called bandit security scan.

74
04:51.000 --> 04:57.300
Whenever we push new code into this repository, in particular on the main

75
04:57.300 --> 05:02.000
branch, or whenever there's a pull request that's targeting the main branch,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
04:57.300 --> 05:02.000
branch, or whenever there's a pull request that's targeting the main branch,

76
05:02.000 --> 05:04.000
these jobs will run.

77
05:04.000 --> 05:09.640
The jobs name, we give it an arbitrary name like bandit scan, and we say this

78
05:09.640 --> 05:13.000
is going to run on the latest VM of Ubuntu.

79
05:13.000 --> 05:18.500
So when you run, make sure you're deploying, we're telling GitHub to run this

80
05:18.500 --> 05:20.000
on a new Ubuntu VM.

81
05:20.000 --> 05:22.000
It'll copy the code.

82
05:22.000 --> 05:27.000
It'll make sure it has Python version three dot 10 installed in it.

83
05:27.000 --> 05:30.000
And then it'll make sure it installs bandit in it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
05:27.000 --> 05:30.000
And then it'll make sure it installs bandit in it.

84
05:30.000 --> 05:33.000
Finally, it runs the bandit command.

85
05:33.000 --> 05:38.000
R means look in recursive folders or sub directories.

86
05:38.000 --> 05:43.000
LL means only look for high level security problems.

87
05:43.000 --> 05:45.000
I don't want to be alerted on small problems.

88
05:45.000 --> 05:49.000
I only want to know medium or high severity.

89
05:49.000 --> 05:55.040
And II means really only tell me if you're of a very high confidence that these

90
05:55.040 --> 05:59.000
detected problems are big time problems.

91
05:59.000 --> 06:05.110
At this point, whenever I push this new code into the main branch, GitHub will
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:59.000 --> 06:05.110
At this point, whenever I push this new code into the main branch, GitHub will

92
06:05.110 --> 06:10.960
automatically kick off the CI CD pipeline, and then we'll be able to see the

93
06:10.960 --> 06:14.000
results if it passed or failed this bandit run.

94
06:14.000 --> 06:17.000
So at this point, I'm going to stop.

95
06:17.000 --> 06:21.660
And in the next video, we'll explore what happens when I actually make the push

96
06:21.660 --> 06:22.000
.