DevSecOps (Fundamental to Advance)
- Description
- Curriculum
- Reviews
This course integrates security practices into the DevOps pipeline, emphasizing continuous security and collaboration among development, security, and operations teams. Explore strategies for automating security testing, vulnerability assessment, and compliance checks throughout the software development lifecycle (SDLC). Learn to implement security controls using tools like Docker, Kubernetes, and Jenkins to ensure secure containerization and deployment. Gain insights into threat modeling, secure coding practices, and incident response, equipping you to address security challenges proactively. Ideal for DevOps engineers, security professionals, and developers aiming to enhance the security posture of applications while maintaining agility and efficiency in delivery pipelines.
-
1
Introduction to DevOps- What is DevOps?
- History and Evolution
- Key principles and practices (CI/CD, automation, collaboration)
- Benefits of DevOps
- Challenges with traditional IT
-
2
Lab Setup
- Setting up a basic development environment
- Version control (Git) basics
- Introduction to cloud platforms (AWS,GCP)
-
3
Introduction to DevSecOps
- The need for DevSecOps
- Shifting security left
- Key components of DevSecOps
- Benefits of DevSecOps
-
4
DevOps Lifecycle
- Deep dive into CI/CD pipeline stages
- Roles and responsibilities in a DevOps team
- Collaboration and communication
-
5
Infrastructure as Code (IaC)
- Introduction to IaC tools (Terraform, CloudFormation)
- Benefits of IaC
- Security considerations in IaC
-
6
Configuration Management
- Ansible, Puppet
- Role-based access control (RBAC)
- Security best practices
-
10
Continuous Integration (CI)
- CI tools (GITHUB ACTIONS CI/CD)
- Build automation
- Unit and integration testing
- Security testing in CI (SAST, SCA)
-
11
Continuous Delivery (CD)
- CD pipelines
- Deployment strategies
- Canary deployments, blue-green deployments
- Security testing in CD (DAST, penetration testing)
-
12
Secrets Management
- Importance of secret management
- Secret management tools (Vault, AWS Secrets Manager,GKMS)
- Best practices for handling secrets
-
13
Cloud Security
- AWS security best practices
- IAM and access control
- Cloud security posture management (CSPM)
- Cloud workload protection platform (CWPP)
-
14
Container Security
- Container security challenges
- Image scanning and vulnerability management
- Runtime protection
-
15
Compliance as Code (CaC)
- Introduction to CaC
- Integrating compliance checks into CI/CD pipeline
- Compliance frameworks (PCI DSS, HIPAA, GDPR)
-
16
DevSecOps Metrics and KPIs
- Measuring DevSecOps success
- Key performance indicators (KPIs)
- Reporting and dashboards
