Practical DevSecOps Professional - Self-paced

Course subjects

Introduction to DevOps and DevSecOps

• What is DevOps?

• DevOps Building Blocks – People, Process and Technology

• DevOps Principles – Culture, Automation, Measurement and Sharing (CAMS)

• Benefits of DevOps – Speed, Reliability, Availability, Scalability, Automation, Cost and Visibility

• What is Continuous Integration and Continuous Deployment?

• Continuous Integration to Continuous Deployment to Continuous Delivery

• Continuous Delivery vs Continuous Deployment

• General workflow of CI/CD pipeline

• Blue/Green deployment strategy

• Achieving full automation

• Designing a CI/CD pipeline for a web application

• Common Challenges faced when using DevOps principle

• Case studies on DevOps of cutting edge technology at Facebook, Amazon, and Google

• Demo: A full enterprise-grade DevSecOps Pipeline

Introduction to the Tools of the Trade

• Github/Gitlab/Bitbucket

• Docker

• Docker Registry

• Ansible

• Jenkins/Travis/Gitlab CI/Bitbucket

• Gauntlt

• Inspec

• Bandit/retireJS/Nmap

• Hands-on Lab: Use Vagrant to practice Infrastructure as a Code

• Hands-on Lab: Building a CI Pipeline using Jenkins/Travis and GitHub/Bitbucket

• Hands-on Lab: Use the above tools to create a complete CI/CD pipeline

Secure SDLC and CI/CD Pipeline

• What is Secure SDLC?

• Secure SDLC Activities and Security Gates

• Security Requirements (Requirements)

• Threat Modelling (Design)

• Static Analysis and Secure by Default (Implementation)

• Dynamic Analysis (Testing)

• OS Hardening, Web/Application Hardening (Deploy)

• Security Monitoring/Compliance (Maintain)

• DevSecOps Maturity Model (DSOMM)

• Maturity levels and tasks involved

• 4-axes in DSOMM

• How to go from Maturity Level 1 to Maturity Level 4

• Best practices for Maturity Level 1

• Considerations for Maturity Level 2

• Challenges in Maturity Level 3

• Dream of achieving Maturity Level 2

• Using tools of the trade to do the above activities in CI/CD

• Embedding Security as part of CI/CD pipeline

• DevSecOps and challenges with Pentesting and Vulnerability Assessment

• Hands-on Lab: Create a CI/CD pipeline suitable for modern applications

• Hands-on Lab: Manage the findings in a fully automated pipeline

Software Component Analysis (SCA) in CI/CD Pipeline

• What is Software Component Analysis?

• Software Component Analysis and its challenges

• What to look for in an SCA solution (free or commercial)

• Embedding SCA tools like OWASP Dependency Checker, Safety, RetireJs, and NPM Audit, Snyk into the pipeline

• Demo: using OWASP Dependency Checker to scan third party component vulnerabilities in Java® Code Base

• Hands-on Lab: using RetireJS and NPM to scan third party component vulnerabilities in JavaScript Code Base

• Hands-on Lab: using Safety/pip to scan third party component vulnerabilities in Python Code Base

SAST (Static Analysis) in CI/CD Pipeline

• What is Static Application Security Testing?

• Static Analysis and its challenges

• Embedding SAST tools into the pipeline

• Secrets scanning to prevent secret exposure in the code

• Writing custom checks to catch secrets leakage in an organisation

• Hands-on Lab: using SpotBugs to scan Java code

• Hands-on Lab: using Trufflehog/Gitrob to scan for secrets in CI/CD pipeline

• Hands-on Lab: using brakeman/bandit to scan Ruby on Rails and Python Code Base

DAST (Dynamic Analysis) in CI/CD Pipeline

• What is Dynamic Application Security Testing?

• Dynamic Analysis and its challenges (Session Management, AJAX Crawling)

• Embedding DAST tools like ZAP and Burp Suite into the pipeline

• SSL misconfiguration testing

• Server Misconfiguration Testing like secret folders and files

• Sqlmap testing for SQL Injection vulnerabilities

• Hands-on Lab: using ZAP to configure per commit/weekly/monthly scans

• Demo: using Burp Suite to configure per commit/weekly/monthly scans

Infrastructure as Code and Its Security

• What is Infrastructure as Code and its benefits?

• Platform + Infrastructure Definition + Configuration Management

• Introduction to Ansible

• Benefits of Ansible

• Push and Pull based configuration management systems

• Modules, tasks, roles, and Playbooks

• Tools and Services which helps to achieve IaaC

• Hands-on Lab: Vagrant, Docker, and Ansible

• Hands-on Lab: Using Ansible to create Golden images and harden infrastructure

Compliance as Code

• Different approaches to handle compliance requirements at DevOps scale

• Using configuration management to achieve compliance

• Manage compliance using Inspec/OpenScap at Scale

• Hands-on Lab: Create an Inspec profile to create compliance checks for your organisation

• Hands-on Lab: Use Inspec profile to scale compliance

Vulnerability Management with Custom Tools

• Approaches to manage the vulnerabilities in the organisation

• Hands-on Lab: Using Defect Dojo for vulnerability management