🔒 Code Scanning Python Tutorial - DevSecOps Industrial

Welcome to the Enhanced Code Scanning Python Tutorial! This tutorial demonstrates how to set up comprehensive security analysis using GitHub Advanced Security: Code Scanning, along with a complete DevSecOps pipeline for industrial environments. The repository contains intentional vulnerabilities for educational purposes and demonstrates secure coding practices.

🏭 Industrial Context

This tutorial is specifically designed for paper manufacturing environments that use SCADA systems, IoT sensors, and data collection APIs. The security practices demonstrated here are crucial for protecting industrial control systems and ensuring operational continuity.

📋 What You'll Learn

🔍 Security Analysis

SAST (Static Application Security Testing) with Bandit
Dependency Scanning with pip-audit and Safety
Container Hardening with Docker Bench for Security
Fail-Fast Pipeline implementation

🛡️ Secure Coding Practices

SQL Injection Prevention using parameterized queries
Authentication Security with proper credential management
Input Validation and sanitization techniques
Command Injection Prevention with safe execution methods

🚀 DevSecOps Pipeline

Automated Security Checks in CI/CD
Vulnerability Management with proper reporting
Industrial Security Standards compliance
Continuous Monitoring implementation

🎯 Tutorial Objectives

Primary Goals

Identify vulnerabilities in industrial microservices
Apply secure coding practices to fix identified issues
Implement DevSecOps pipeline with fail-fast mechanism
Generate comprehensive security reports for compliance

Learning Outcomes

Understand CWE (Common Weakness Enumeration) classifications
Map vulnerabilities to OWASP Top 10 categories
Implement industrial-grade security controls
Create automated security validation processes

🚀 Getting Started

Prerequisites

GitHub account with access to Advanced Security features
Basic understanding of Python development
Familiarity with industrial control systems (SCADA)

Quick Setup

Clone the repository

git clone https://github.com/thalesfb/demo-python.git

Navigate to the repository

cd demo-python

Setup environment and run security analysis

# For Linux/Mac
./setup/setup_env.sh
./run_security_analysis.sh

# For Windows
./setup/setup_env.ps1
./run_security_analysis.ps1

📖 Tutorial Instructions

🔗 Fork this Repository

Begin by forking this repository.

Important: Make sure you uncheck "Copy the main branch only" to get all branches including the vulnerable new-feature branch.

🔒 Enable Code Scanning

Security Tab

Click on the Security tab in your forked repository.

Set up Code Scanning

Click Set up code scanning to configure security analysis.

Setup Workflow

Click the Setup this workflow button by CodeQL Analysis.

This creates a GitHub Actions Workflow file with CodeQL already configured. Since Python is an interpreted language, no additional compile flags are needed.

Enhanced Security: This tutorial also includes additional security tools beyond CodeQL:

Bandit for SAST analysis
pip-audit for dependency scanning
Safety for additional security checks
Docker Bench for container hardening

⚙️ Enhanced DevSecOps Pipeline

Industrial-Grade Security Pipeline

The enhanced pipeline includes multiple security layers:

# .github/workflows/devsecops-pipeline.yml
name: 🔒 Pipeline DevSecOps - Análise de Segurança Completa

jobs:
  security-analysis:
    steps:
      - 🔍 SAST Analysis (Bandit)
      - 📦 Dependency Scanning (pip-audit)
      - 🐳 Container Hardening (Docker Bench)
      - 🚨 Fail-Fast Validation
      - 📊 Security Reports Generation

Pipeline Features

Fail-Fast Mechanism: Pipeline stops on critical vulnerabilities
Comprehensive Reporting: Detailed security analysis reports
Industrial Compliance: Meets IEC 62443 and NIST standards
Automated Remediation: Suggests fixes for common issues

Click Start Commit → Commit this file to commit the enhanced security pipeline.

🔄 Workflow Triggers

Automated Security Checks

The pipeline triggers on multiple events to ensure continuous security monitoring:

Push to main/develop: Immediate security validation
Pull requests: Pre-merge security checks
Scheduled scans: Weekly comprehensive analysis
Manual triggers: On-demand security audits

Industrial Benefits:

Prevents vulnerable code from reaching production
Ensures compliance with security policies
Provides audit trails for regulatory requirements
Maintains operational security standards

📊 GitHub Actions Progress

Real-Time Security Monitoring

Monitor the security analysis progress in real-time:

Click Actions tab → CodeQL
Select the specific workflow run
View detailed progress of each security check

Enhanced Monitoring Features:

Real-time vulnerability detection
Severity-based alerting
Compliance status tracking
Remediation progress monitoring

🚨 Security Issues Analysis

Once the workflow completes, navigate to Security → Code Scanning Alerts. You should see security alerts including "Query built from user-controlled sources" and other industrial-relevant vulnerabilities.

Comprehensive Security Alert View

Clicking on any security alert provides detailed information:

Enhanced Alert Information:

CWE Classification: Industry-standard vulnerability categorization
OWASP Top 10 Mapping: Relates to broader security frameworks
Industrial Impact Assessment: Specific risks to SCADA systems
Remediation Guidance: Step-by-step fix instructions
Compliance Notes: Regulatory requirements affected

Detailed Security Description

Click Show more for comprehensive vulnerability details:

Full Security Analysis

Industrial Context Added:

Impact on production systems
Risk to operational continuity
Compliance implications
Recommended mitigations

🛣️ Vulnerability Path Analysis

Data Flow Tracing

CodeQL Analysis traces data flow from source to sink, showing exactly how vulnerabilities can be exploited:

Click show paths to visualize the vulnerability path:

Detailed Path Visualization

Industrial Security Insights:

Data flow through SCADA systems
Sensor data manipulation risks
Control system access paths
Production parameter vulnerabilities

🔧 Fix Security Vulnerabilities

Secure Coding Implementation

To fix the identified vulnerabilities, we implement secure coding practices:

SQL Injection Fix: Use parameterized queries
Authentication Fix: Implement secure credential management
Input Validation: Add proper sanitization
Command Execution: Use safe execution methods

Click on the Code tab and edit the file routes.py in the server folder, replacing the content with the secure version from fixme.

Click Create a new branch for this commit and start a pull request, name the branch fix-security-vulnerabilities, and create the Pull Request.

Enhanced Pull Request Security Check

In the Pull Request, you'll see comprehensive security analysis:

Security Validation Results

After the workflow completes, click Details by the Code Scanning Results / CodeQL status check:

Vulnerability Remediation Confirmation

Notice that Code Scanning detects that this Pull Request fixes multiple vulnerabilities:

Merge the Pull Request. After merging, another workflow will scan the repository for any remaining vulnerabilities.

Closed Security Alerts

Navigate back to the Security tab and click Closed. Notice that all security alerts now show as resolved:

Complete Traceability

Click on any security alert to see detailed remediation information:

Enhanced Traceability Features:

Complete fix history
Remediation timeline
Compliance validation
Audit trail documentation

🧪 Introduce Security Vulnerabilities

Testing Security Detection

Now let's explore how the enhanced pipeline detects new vulnerabilities:

A branch called new-feature introduces new functionality but also security vulnerabilities. Open a Pull Request comparing new-feature to main:

Go to the Pull Request tab
Select "New Pull Request"
Create the PR with:
- base repository: <YOUR FORK>
- head repository: <YOUR FORK>
- base: main
- compare: new-feature
If you don't see the new-feature branch, change the head repository: octodemo/advanced-security-python

Enhanced Security Detection

The pipeline will detect multiple security issues:

Detailed Vulnerability Analysis

Click on the "Files Changed" tab to see comprehensive security annotations:

Enhanced Developer Experience:

Inline security suggestions
Automated fix recommendations
Compliance guidance
Risk assessment details

📊 Security Analysis Results

🔍 Vulnerability Summary

CWE ID	Vulnerability	Severity	OWASP Top 10	Industrial Risk	Status
CWE-89	SQL Injection	🔴 HIGH	A01	Critical - Data manipulation	✅ Fixed
CWE-287	Improper Authentication	🔴 HIGH	A02	Critical - Unauthorized access	✅ Fixed
CWE-78	OS Command Injection	🔴 HIGH	A01	Critical - System compromise	✅ Fixed
CWE-79	Cross-Site Scripting	🟡 MEDIUM	A03	High - Code injection	✅ Fixed
CWE-200	Information Exposure	🟡 MEDIUM	A06	High - Data leakage	✅ Fixed

📈 Pipeline Metrics

SAST Coverage: 100% of Python files analyzed
Dependency Scanning: All packages validated
Container Hardening: Docker security checks passed
Fail-Fast: Successfully blocks vulnerable deployments
Test Coverage: 96% with security-focused tests

🏭 Industrial Security Implementation

🔒 Enhanced Security Features

1. Industrial-Grade Authentication

# Secure authentication for SCADA systems
class IndustrialAuth:
    def __init__(self):
        self.mfa_required = True
        self.session_timeout = 30  # minutes
        self.max_attempts = 3
        self.lockout_duration = 15  # minutes

2. Secure Data Collection

# Safe sensor data collection
def collect_sensor_data(sensor_id: str) -> dict:
    # Parameterized queries prevent SQL injection
    query = "SELECT * FROM sensors WHERE id = %s"
    return execute_safe_query(query, (sensor_id,))

3. Command Execution Safety

# Safe command execution for industrial systems
def safe_system_command(command: str) -> dict:
    # Whitelist of allowed commands
    allowed_commands = ['status', 'health', 'ping']
    if command not in allowed_commands:
        raise SecurityException("Command not allowed")

🛡️ Compliance Standards

IEC 62443: Industrial automation and control systems security
NIST Cybersecurity Framework: Comprehensive security controls
OWASP Top 10: Web application security standards
ISO 27001: Information security management

📋 Documentation

📖 Security Reports

Vulnerability Report: Comprehensive vulnerability analysis
Corrections Implemented: Detailed fix documentation
Pipeline Evidence: DevSecOps pipeline validation
Mitigation Plan: Industrial security roadmap

🔧 Configuration Files

.bandit: SAST analysis configuration
requirements.txt: Security tool dependencies
.github/workflows/devsecops-pipeline.yml: Complete DevSecOps pipeline
check_vulnerabilities.py: Fail-fast validation script

🚀 Next Steps

🎓 Learning Path

Basic Security: Understand common vulnerabilities
Secure Coding: Implement defensive programming practices
DevSecOps: Automate security in CI/CD pipelines
Industrial Security: Apply security to SCADA systems
Compliance: Meet regulatory requirements

🔗 Additional Resources

📞 Enterprise Support

Ready to implement advanced security features for your industrial environment? Optimizr for comprehensive security solutions.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🔒 Enhanced Security Tutorial
🏭 Industrial Context: Paper Manufacturing & SCADA Systems
📅 Updated: August 2025
👨‍🎓 Academic Project: Security of Systems in Computer Science Course

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
images		images
server		server
setup		setup
templates		templates
.bandit		.bandit
.gitignore		.gitignore
Dockerfile		Dockerfile
LICENSE		LICENSE
Pipfile		Pipfile
Pipfile.lock		Pipfile.lock
README.md		README.md
check_vulnerabilities.py		check_vulnerabilities.py
fixme		fixme
requirements.txt		requirements.txt
run_security_analysis.ps1		run_security_analysis.ps1
run_security_analysis.sh		run_security_analysis.sh

Latest commit

History

Folders and files

Repository files navigation