About the course
Transform your software development lifecycle into a secure and efficient engine with our comprehensive DevSecOps training. This course goes beyond theory, providing you with a deep understanding of the core principles that underpin successful DevSecOps adoption. Discover the tangible benefits of integrating security seamlessly by "shifting left" - from accelerated delivery cycles to reduced risk.
You'll gain practical knowledge of key practices and the tools that empower automation, vulnerability management, and enhanced collaboration across development, security, and operations teams.
By the course's conclusion, you'll be equipped with the strategic insights and actionable skills to champion and implement DevSecOps within your organization, ultimately leading to the rapid and secure delivery of high-quality software.
This two-day training course will cover the fundamentals of DevSecOps, in a practical sense: the main focus will be on technologies and tools.
Online and in-house face-to-face options are available - as part of a wider customised training programme, or as a standalone workshop, on-site at your offices or at one of many flexible meeting spaces in the UK and around the World.
-
- Set up a DevSecOps platform and CI/CD pipeline for a web application
- Select the correct type of security test
- Design a CI/CD pipeline that generates Docker images containing security testing tools
- Scan for secrets in repositories
- Design a plan to phase out known secrets in repositories
- Scan source code for security vulnerabilities
- Scan source code to check for outdated third party libraries
- Scan a running web application for security vulnerabilities
- Scan a Docker image for security vulnerabilities and misconfigurations
- Triage vulnerabilities in applications
- Perform a threat modeling excercise
-
This essential DevSecOps training is designed for professionals who play a role in the modern software development and delivery lifecycle and are looking to integrate security seamlessly. It will be highly valuable for:
Software Developers: Eager to understand how to build security into their code from the outset and collaborate effectively with security teams.
Security Engineers and Architects: Seeking to integrate security practices earlier in the SDLC and automate security controls within development pipelines.
DevOps Engineers: Responsible for streamlining and automating the software delivery process and looking to incorporate security considerations.
IT Managers and Leaders: Overseeing software development and delivery teams and aiming to improve security posture and efficiency.
QA Engineers and Testers: Interested in understanding and implementing security testing practices within the CI/CD pipeline.
System Administrators: Involved in deploying and managing applications and looking to understand the security implications of the development process.
Anyone involved in the SDLC: Including project managers, business analysts, and release engineers who want to understand and contribute to a more secure development process.
-
While this course provides a comprehensive introduction to DevSecOps principles and practices, a foundational understanding in the following areas will be beneficial:
Basic understanding of the Software Development Lifecycle (SDLC): Familiarity with the different stages of software development (e.g., planning, design, coding, testing, deployment).
Familiarity with basic security concepts: A general awareness of common security vulnerabilities and security practices.
Exposure to either development or operations practices: Understanding the fundamentals of software development or IT operations will be helpful for grasping the integration aspects of DevSecOps.
No prior deep security expertise or specific tool knowledge is strictly required. The course will introduce the necessary concepts and tools in a practical manner.
-
This DevSecOps course is available for private / custom delivery for your team - as an in-house face-to-face workshop at your location of choice, or as online instructor-led training via MS Teams (or your own preferred platform).
Get in touch to find out how we can deliver tailored training which focuses on your project requirements and learning goals.
-
The Fundamental Principles of DevSecOps
(Secure) Software Design Life Cycle - SSDLC / SDLC
Development and testing
Delivery
Deployment
Types of Security Testing
Risk assessment
Dynamic testing
Container scanning
Vulnerability scanning
Setting up a Local Lab Environment
Docker-compose
GitLab
SonarQube
Creating a Security Testing Tool Chest
Common security testing tools
Choosing the right tool for your stack
Scanning for Secrets in Source Code
When and why you need scanning in your SDLC
Git secret scanning
Secret scanning tools
Static Application Security Testing (SAST)
Why Static Analysis is important
SAST tools
SAST reporting good practices
Understanding Software Composition Analysis (SCA)
Should you blindly trust Open Source code? (you can probably guess the answer)
What is a Bill of Materials? (BOM)
Scanning for Outdated Third Party Libraries
Automated SCA tools
Dynamic Application Security Testing (DAST)
What is "black-box" testing?
Input / output validation
Common Authentication issues
Dynamic security scanner
Fuzzers
Attack Proxies
Container Image Scanning
What to look for:
Misconfigured containers
Obsolete libraries
Out-of-date OS patches
Compliance Validations
Triaging Software Vulnerabilities
Confidentiality, Integrity, Availability (CIA)
Automated tools
Log analysis
Threat Modeling basics
Analysing and understanding:
What is the system's purpose
Who would want to obstruct that purpose
What attack vectors are available
What mitigations can your team undertake
Security maturity models
Benefits of a maturity model
OWASP DevSecOps Maturity Model (DSOMM)
Industry security frameworks
Frameworks for you to consider
Implementing security frameworks in your workflow
Migrating from DevOps to DevSecOps
Adopting the Security-First Mindset
Dealing with Silos
Security Champions
Regular and frequent research and education
Implement continuous improvement processes
Applying DevSecOps in Practice
Exploring your next steps
-
https://owasp.org/ - home of the Open Worldwide Application Security Project
https://www.docker.com/products/docker-desktop/ - Docker Engine you can run locally
https://podman.io/ - free open source Docker alternative
https://about.gitlab.com/ - get a free GitLab trial here
https://www.sonarsource.com/products/sonarqube/downloads/ - home of SonarQube
Trusted by
