Implementing DevSecOps
Official partner
Linux Foundation
Course Description
This course begins by laying the foundation of DevSecOps, explaining the principles, practices, cultural aspects and tooling landscape. It then goes on to show you how to incorporate various practices into the Continuous Delivery pipeline: perform Software Composition Analysis (SCA) and add it to the Continuous Integration pipeline, perform static code analysis and project gating using SAST tools, implement security best practices while writing Dockerfiles to build images, scan container images for vulnerability, perform Dynamic Application Software Testing (DAST) on a live environment, set up a centralized vulnerability management system to provide visibility and alerting, and build a cloud native DevSecOps pipeline. You will also use IaC effectively to enforce compliance, collect logs, analyze events to provide detection and monitoring of security issues, and learn to address cloud and container related risks. In order to make adoption of DevSecOps practices frictionless, this course focuses on usage of mostly open source software, at the same time providing enough flexibility to plug in a commercial alternative to match the implementation environment.
Course Summary
Course Introduction
What Is DevSecOps?
Setting Up the Lab Environment
Building a DevOps Pipeline
Securing the Supply Chain with SCA
Static Application Security Testing (SAST)
Auditing Container Images
Secure Deployment and Dynamic Application Security Testing (DAST)
System Security Auditing with IAC
Securing Kubernetes Deployments
Secrets Management with Vault
Runtime Security Monitoring and Remediation
Prerequisites for this course
To make the most out of this course, you will need to:
Have working knowledge of Linux operating systems and the command line interface, Git, Docker, and Kubernetes.
Know how to build CI/CD pipelines, write Infrastructure-as-Code (IaC), run Ansible Playbooks, and understand observability concepts such as log management and monitoring.
Audience for this course
This course is designed for software developers, site reliability engineers, and DevOps practitioners looking to speed up delivery of more secure code. To make the most of this course, learners must have working knowledge of Linux operating systems and the command line interface, Git, Docker, and Kubernetes. They must also know how to build CI/CD pipelines, write Infrastructure-as-Code (IaC), run Ansible Playbooks, and understand observability concepts such as log management and monitoring.