Practical DevSecOps Expert - Self-paced

Course subjects

Overview of DevSecOps

• DevOps Building Blocks – People, Process and Technology

• DevOps Principles – Culture, Automation, Measurement and Sharing (CAMS)

• Benefits of DevOps – Speed, Reliability, Availability, Scalability, Automation, Cost and Visibility

• Overview of the DevSecOps critical toolchain

• Repository management tools

• Continuous Integration and Continuous Deployment tools

• Infrastructure as Code (IaC) tools

• Communication and sharing tools

• Security as Code (SaC) tools

• Overview of secure SDLC and CI/CD

• Review of security activities in secure SDLC

• Continuous Integration and Continuous Deployment

• How to move from DevSecOps Maturity Model (DSOMM) Level 2 to Level 4

• Best practices and considerations for Maturity Level 3

• Best practices and considerations for Maturity Level 4

• Security automation and its limits

• DSOMM level 3 and level 4 challenges and solutions

Security Requirements and Threat Modelling (TM)

• What is Threat Modelling?

• STRIDE vs DREAD approaches

• Threat modelling and its challenges

• Classical threat modelling tools and how they fit in CI/CD pipeline

• Hands-on Lab: Automate security requirements as code

• Hands-on Lab: using ThreatSpec to do Threat Modelling as Code

• Hands-on Lab: using BDD security to codify threats

Advanced Static Analysis (SAST) in CI/CD Pipeline

• Why pre-commit hooks are not a good fit in DevSecOps

• Writing custom rules to weed out false positives and improve the quality of the results

• Various approaches to write custom rules in free and paid tools

• Regular expressions

• Abstract Syntax Trees

• Graphs (Data and Control Flow analysis)

• Hands-on Lab: Writing custom checks in the bandit for your enterprise applications

Advanced Dynamic Analysis (DAST) in CI/CD Pipeline

• Embedding DAST tools into the pipeline

• Leveraging QA/Performance automation to drive DAST scans

• Using Swagger (OpenAPI) and ZAP to scan APIs iteratively. Ways to handle custom authentications for ZAP Scanner

• Using Zest Language to provide better coverage for DAST scans

• Hands-on Lab: using ZAP, Selenium, and Zest to configure in-depth scans

• Hands-on Lab: using Burp Suite Pro to configure per commit/weekly/monthly scans

Note: Students need to bring their Burp Suite Pro License to use in CI/CD

Runtime Analysis (RASP/IAST) in CI/CD Pipeline

• What is Runtime Analysis Application Security Testing?

• Differences between RASP and IAST

• Runtime Analysis and challenges

• RASP/IAST and its suitability in CI/CD pipeline

• Hands-on Lab: A commercial implementation of the IAST tool

Infrastructure as Code (IaC) and Its Security

• Configuration management (Ansible) security

• Users/Privileges/Keys – Ansible Vault vs Tower

• Challenges with Ansible Vault in CI/CD pipeline

• Introduction to Packer

• Benefits of Packer

• Templates, builders, provisioners, and post processors

• Packer for continuous security in DevOps Pipelines

• Tools and Services for practicing IaaC (Packer, Ansible, and Docker)

• Hands-on Lab: Using Ansible to harden on-prem/cloud machines for PCI DSS

• Hands-on Lab: Create hardened Golden images using Packer and Ansible

Container (Docker) Security

• What is Docker?

• Docker vs Vagrant

• Basics of Docker and its challenges

• Vulnerabilities in images (Public and Private)

• Denial of service attacks

• Privilege escalation methods in Docker

• Security misconfigurations

• Container Security

• Content Trust and Integrity checks

• Capabilities and namespaces in Docker

• Segregating Networks

• Kernel Hardening using SecComp and AppArmor

• Static Analysis of container (Docker) images

• Dynamic Analysis of container hosts and daemons

• Hands-on Lab: Scanning docker images using Clair and its APIs

• Hands-on Lab: Auditing Docker daemon and host for security issues

Secrets Management on Mutable and Immutable Infrastructure

• Managing secrets in traditional infrastructure

• Managing secrets in containers at Scale

• Secret Management in Cloud

• Version Control systems and Secrets

• Environment Variables and Configuration files

• Docker, Immutable systems and its security challenges

• Secrets management with Hashicorp Vault and Consul

• Hands-on Lab: Securely store Encryption keys and other secrets using Vault/Consul

Advanced Vulnerability Management

• Approaches to manage the vulnerabilities in the organisation

• False positives and False Negatives

• Culture and Vulnerability Management

• Creating different metrics for CXOs, devs and security teams

• Hands-on Lab: Using Defect Dojo for vulnerability management