Segurança Shift-Left em Sistemas de Saúde Digital: Avaliação com Ferramentas Automatizadas em Python

Abstract

This project presents a practical approach to applying Shift-Left security strategies in the context of digital health, with an emphasis on electronic health record systems. The research provides the theoretical foundation for application security and demonstrates the importance of secure development from the initial stages of the software devel- opment lifecycle. To address this issue, a REST API simulating an electronic health records module was developed in Python, into which intentional vulnerabilities (SQL Injection, BOLA/IDOR, and Broken Authentication) were inserted for study purposes. The effectiveness of the Shift-Left strategies was evaluated through the application of Static Application Security Testing (SAST) tools, such as Bandit, and Dynamic Applica- tion Security Testing (DAST), by means of scripts developed with Pytest. Additionally, a continuous integration and continuous delivery (CI/CD) pipeline was implemented using GitHub Actions, which automated the execution of these tests, validating the approach’s ability to proactively detect and block insecure code. The results show that anticipating security practices contributes to the development of more robust and resilient applications. This work establishes a methodological foundation that aligns technical secure development practices with the requirements of the Brazilian General Data Protection Law (LGPD) and Federal Medical Council (CFM) Resolution No. 2,314/2022, promoting the integration between software engineering and regulatory compliance in the digital health sector.