DevSecOps Training
This 2-day intermediate course will show you how to automate security in a fast-paced DevOps environment using various open-source tools and scripts. We have delivered this training for Virtual OWASP AppSec Days Conference to an overwhelmingly positive response.
You will be able to:
- Access to cloud DevSecOps-Lab for 24 hours post end of the training for further hands-on practice to each delegate.
- The attendees will also receive a DevSecOps-Lab VM (designed by the NotSoSecure team) containing all the code, scripts and tools that are used for building the entire DevSecOps pipeline.
You will receive:
A full understanding of how to tackle security issues and a DevSecOps-Lab VM (designed by the NotSoSecure team) containing all the code, scripts and tools that are used for building the entire DevSecOps pipeline.
Who Should Take This Class?
DevOps engineers, security and solutions architects, system administrators will strongly benefit from this course as it will give you a holistic approach towards application security.
If you have a background in IT or related to software development, whether a developer or a manager, you can attend this course to get an insight about DevOps and DevSecOps.
Details of the course content:
LAB SETUP
- Online Lab Setup
- Offline Lab Instructions
INTRODUCTION TO DEVOPS
- What is DevOps?
- Lab: DevOps Pipeline
INTRODUCTION TO DEVSECOPS
- Challenges for Security in DevOps
- DevOps Threat Model
- DevSecOps – Why, What and How?
- Vulnerability Management
CONTINUOUS INTEGRATION
- Pre-Commit Hooks
- Introduction to Talisman
- Lab: Running Talisman
- Lab: Create your own regexes for Talisman
- Secrets Management
- Introduction to HashiCorp Vault
- Demo: Vault Commands
CONTINUOUS DELIVERY
- Software Composition Analysis (SCA)
- Introduction to Dependency-Check
- Lab: Run Dependency-Check pipeline
- Lab: Fix issues reported by Dependency-Check
- Static Analysis Security Testing (SAST)
- Introduction to Semgrep
- Lab: Run Semgrep pipeline
- Lab: Create your own Semgrep Rules
- Lab: Fix Issues reported by Semgrep
- Dynamic Analysis Security Testing (DAST)
- Introduction to OWASP ZAP
- Demo: Creating ZAP Context File
- Lab: Run ZAP in pipeline
INFRASTRUCTURE AS CODE
- Vulnerability Assessment (VA)
- Introduction to OpenVAS
- Lab: Run OpenVAS pipeline
- Container Security (CS)
- Introduction to Trivy
- Lab: Run Trivy in Pipeline
- Lab: Improvise Docker base image
- Compliance as Code (CaC)
- Introduction to Inspec
- Lab: Run Inspec in Pipeline
- Lab: Improvise Docker compliancy controls
CONTINUOUS MONITORING
- Logging
- Introduction to the ELK Stack
- Lab: View Logs in Kibana
- Alerting
- Introduction to ElastAlert and ModSecurity
- Lab: View Alerts in Kibana
- Monitoring
- Lab: Create Attack Dashboards in Kibana
DEVSECOPS IN AWS
- DevOps on Cloud Native AWS
- AWS Threat Landscape
- DevSecOps in Cloud Native AWS
DEVSECOPS CHALLENGES AND ENABLERS
- Challenges with DevSecOps
- Building DevSecOps Culture
- Security Champions
- Case Studies
- Where do we Begin?
- DevSecOps Maturity Model
Sorry! It looks like we haven’t updated our dates for the class you selected yet. There’s a quick way to find out. Contact us at 502.265.3057 or email info@training4it.com
Request a Date