CI/CD DevSecOps Lab

---

Description

This project demonstrates my implementation of a CI/CD pipeline integrated with security tools to ensure secure software development practices. I worked on a fork of the DevSecOps Crash Course PyGoat repository, focusing on incorporating Static Application Security Testing (SAST) and container image scanning into the development lifecycle.

---

Languages and Utilities Used

• Python
• Docker
• Bandit (Static Application Security Testing Tool)

Environments Used

• Ubuntu (GitHub Actions)
• Docker Hub

---

Key Components

• Static Application Security Testing (SAST): Implemented a CI job to analyze Python code using Bandit, identifying potential security vulnerabilities in the application.
• Container Image Scanning: Built a Docker image and scanned it for vulnerabilities using Docker Scout to ensure secure container deployment.
• CI/CD Automation: Configured GitHub Actions to automate the security scans, ensuring they run on every push to the repository.
• Artifact Management: Collected and stored Bandit scan results for further review and auditing.

---

Key Learnings

• Static Code Analysis: Gained hands-on experience with Bandit for detecting security vulnerabilities in Python applications.
• Container Security: Learned how to use Docker Scout to analyze and address vulnerabilities in container images.
• CI/CD Best Practices: Understood the importance of automating security checks to catch vulnerabilities early in the development process.
• Tool Integration: Successfully integrated security tools into a CI/CD pipeline using GitHub Actions.

---

Challenges Overcome

• Setting up Bandit: Ensured proper configuration of Bandit to produce actionable security reports.
• Docker Scout Setup: Troubleshot issues related to Docker Scout installation and scanning processes.
• Managing Secrets in CI: Configured GitHub repository secrets for secure Docker Hub authentication.
• Pipeline Debugging: Resolved errors related to GitHub Actions syntax and step execution during pipeline creation.

Walk-Through:

Initial Code to Trigger the Pipeline on any Push:

Configuring SAST Scan:

Bandit Scann Results:

Now Configuring Bandit Scan to ignore low severity issues:

Generate Scan Report and Export as a JSON file:

Bandit Scan Report JSON file:

Configuring Image Scanning with Docker Scout:

Creating 2 Secert repos to store my Docker Uname and Passwer so I can reference them in the pipeline:

Docker Login Command Reffercing the Secert Values: