EtusivuHae koulutuksiaDevSecOps

DevSecOps

DevSecOps has been described as 'security as code', 'a marriage of DevOps and Security' and 'Shifting security to the left'. Traditional security approaches are inefficient and largely ineffective for organisations using Agile, DevOps and Cloud - as illustrated by the massive amount of recent data breaches. DevSecOps is a new approach which embeds security to each DevOps team, with automated security testing at all stages of the software development lifecycle. Security infrastructure, policies, controls, compliance, audit and even secure operations are all coded and automated, with almost no manual processes.
This three day hands-on course begins with an overview of the DevSecOps approach, framework and DevSecOps toolkit, then looks at application security, the elements of a secure software development lifecycle, and the use of automated application security tests as part of the continuous integration / continuous deployment pipeline. Next we move on to cloud security, infrastructure as code, and potential security issues which can arise from the agile DevOps process. We cover the implementation of security controls as code, ranging from security policies, secrets management, encryption, identity and access management, to logging, monitoring and alerting. Containers and serverless architectures are introduced and potential security issues highlighted, with a review of container security technologies. A DevSecOps approach is used to integrate automated security tests and mitigate security risks. Continuous compliance as code is covered, using different approaches and appropriate DevSecOps tools for prevention, detection and remediation, leading to the concept of audit as code.
A new model for Security Operations is presented with security incident identification, management and response as code, making use of big data analysis, artificial intelligence and machine learning, alongside more traditional techniques such as signature detection and threat intelligence feeds. Finally, we look at the people aspect of DevSecOps, moving away from technology and code, to organisational and cultural aspects, skills development, team effectiveness and recruitment approaches.
The course is delivered through presentations, practical demonstrations and labs. You will gain practical hands-on experience of DevSecOps tools, automated security tests and serverless applications. You will implement security improvements to infrastructure as code, and deploy continuous compliance tools to provide ongoing security assurance for a cloud environment.
Due to the interactive nature of the course and labs, it will be delivered on site at QA training centres and is not suitable for online learning.

Koulutusmuoto
Remote

Kesto
2 päivää

Hinta
1511 €

Hands-on training to automate security into a fast-paced DevOps environment using various open-source tools and scripts.

Modern enterprises are implementing the technical and cultural changes required to embrace DevOps methodology by introducing practices such Continuous Integration (CI), Continuous Delivery (CD), Continuous Monitoring (CM) and Infrastructure as Code (IaC). DevSecOps extends DevOps by introducing security in each of these practices giving a certain level of security assurance in the final product. In this training, we will demonstrate using our state-of-the-art DevSecOps Lab as to how to inject security in CI, CD, CM and IaC.

This is a complete hands-on training with attendees requiring only a browser to complete the entire training. Attendees will receive the DevSecOps Lab built using Vagrant and Ansible comprising of various open-source tools and scripts to help the DevOps engineers in automating security within their CI/CD pipeline.

The attendees will receive a DevSecOps-Lab VM (designed by the NotSoSecure team) containing all the code, scripts and tools that are used for building the entire DevSecOps pipeline.

Learning outcomes

  • Understand how to tackle security issues in a fast-moving DevOps environment
  • Identify tools/solutions and develop processes to create a secure by default infrastructure
  • Utilize the integration scripts and tools provided in the DevSecOps Lab to create your own DevSecOps pipeline

Prerequisites

Anybody with a background in IT or related to software development whether a developer or a manager can attend this course to get an insight about DevOps and DevSecOps.

Course Content

Day 1

Lab Setup

  • Online Lab Setup
  • Offline Lab Instructions

Introduction to DevOps

  • What is DevOps?
  • Lab : DevOps Pipeline

Introduction to DevSecOps

  • Challenges for Security in DevOps
  • DevOps Threat Model
  • DevSecOps – Why, What and How?
  • Vulnerability Management

Continuous Integration

Pre-Commit Hooks

  • Introduction to Talisman
    • Lab : Running Talisman
    • Lab : Create your own regexes for Talisman

Secrets Management

  • Introduction to HashiCorp Vault
  • Demo : Vault Commands

Continuous Delivery

  • Software Composition Analysis (SCA)
    • Introduction to Dependency-Check
    • Lab : Run Dependency-Check pipeline
    • Lab : Fix issues reported by Dependency-Check
  • Static Analysis Security Testing (SAST)
    • Introduction to Semgrep
    • Lab : Run Semgrep pipeline
    • Lab : Create your own Semgrep Rules
    • Lab : Fix Issues reported by Semgrep
  • Dynamic Analysis Security Testing (DAST)
    • Introduction to OWASP ZAP
    • Demo : Creating ZAP Context File
    • Lab : Run ZAP in pipeline

Day 2

Infrastructure As Code

  • Vulnerability Assessment (VA)
    • Introduction to OpenVAS
    • Lab : Run OpenVAS pipeline
  • Container Security (CS)
    • Introduction to Trivy
    • Lab : Run Trivy in Pipeline
    • Lab : Improvise Docker base image
  • Compliance as Code (CaC)
    • Introduction to Inspec
    • Lab : Run Inspec in Pipeline
    • Lab : Improvise Docker compliancy controls

Continuous Monitoring

  • Logging
    • Introduction to the ELK Stack
    • Lab : View Logs in Kibana
  • Alerting
    • Introduction to ElastAlert and ModSecurity
    • Lab : View Alerts in Kibana
  • Monitoring
    • Lab : Create Attack Dashboards in Kibana

DevSecOps in AWS

  • DevOps on Cloud Native AWS
  • AWS Threat Landscape
  • DevSecOps in Cloud Native AWS

DevSecOps Challenges and Enablers

  • Challenges with DevSecOps
  • Building DevSecOps Culture
  • Security Champions
  • Case Studies
  • Where do we Begin?
  • DevSecOps Maturity Model