EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Certified DevSecOps Professional

Course outline

3 days
Discuss this programme →

Duration

3 days

Course Objective

We all have heard about DevSecOps, Shifting Left, Rugged DevOps but there are no clear examples or frameworks available for security professionals to implement in their organization. This hands-on course will teach you exactly that, tools and techniques to embed security as part of the DevOps pipeline. We will learn how unicorns like Google, Facebook, Amazon, Etsy handle security at scale and what we can learn from them to mature our security programs.

In DevSecOps Professional training you will learn how to handle security at scale using DevSecOps practices. We will start off with the basics of the DevOps, DevSecOps and move towards advanced concepts such as Security as Code,

Compliance as Code, Configuration management, Infrastructure as code, etc.

Course Syllabus

The CDP course takes you through the series of stages and maturity levels to mature an organization into a DevSecOps shop. We will cover the following topics as part of the course.

  • Introduction to DevOps and DevSecOps
  • Introduction to the Tools of the trade
  • Secure SDLC and CI/CD pipeline
  • Software Component Analysis (SCA)
  • Static Analysis(SAST) in CI/CD pipeline.
  • Dynamic Analysis(DAST) in CI/CD pipeline.
  • Infrastructure as Code and its security.
  • Vulnerability Management with custom tools

What will students learn?

The students will learn how to:

  • Gain a solid foundation of the CI/CD pipelines, DevOps, and Secure SDLC.
  • Learn to understand and apply the principles, values, and practices that enable DevSecOps.
  • Learn to create a culture of sharing and collaboration among various organizational stakeholders and departments.
  • Understand the critical parts of DevSecOps processes, tools, and techniques.
  • Create and maintain DevSecOps pipelines using SCA, SAST, DAST, Infrastructure as Code, Compliance as Code, and Security as code best practices.
  • Ensure the hardening and compliance of infrastructure according to the organization's policies.
  • Learn to consolidate and centrally manage security results from multiple automation and tooling from a CI/CD pipeline.
  • Plan and mature an organization's DevSecOps program.

Who should take this course?

This course is aimed at anyone who is looking to embed security as part of agile/cloud/DevOps environments like Developers, DevOps Engineers, Security Professionals, Penetration Testers, and IT managers.

What students will be provided?

  • Course Manual
  • Course Videos and Checklists
  • 30+ Guided Exercises
  • 60 days Online Lab Access
  • Access to a dedicated slack channel
  • One exam attempt for Certified DevSecOps Professional Certification

Student Prerequisites

There are no required prerequisites to attend the course however the students will benefit from having basic knowledge about Linux commands like ls, cd, mkdir, etc., and application Security practices like OWASP Top 10.

Software and Hardware Requirements

Our lab platform uses the state of the art technologies, so you would need the following to connect to the lab environment.

  • 1. Laptop / PC with decent specs, at least 4GB of RAM, and a modern CPU.
  • 2. A modern browser like Chrome/Firefox/Safari

DAY 1

9:00am - 10:30am

1) INTRODUCTION TO DEVOPS AND DEVSECOPS

  • What is DevOps?
  • DevOps Building Blocks- People, Process, and Technology.
  • DevOps Principles – Culture, Automation, Measurement and Sharing (CAMS)
  • Benefits of DevOps – Speed, Reliability, Availability, Scalability, Automation, Cost, and Visibility.
  • What is Continuous Integration and Continuous Deployment?.
  • Continuous Integration to Continuous Deployment to Continuous Delivery.
  • Continuous Delivery vs. Continuous Deployment.
  • General workflow of CI/CD pipeline.
  • Blue/Green deployment strategy
  • Achieving full automation.
  • Designing a CI/CD pipeline for a web application.
  • Common Challenges faced when using the DevOps principle.
  • Case studies on DevOps of cutting edge technology at Facebook, Amazon, and Google
  • Demo: Advanced enterprise-grade DevSecOps Pipeline.

10:30am - 10:45am Morning Break

10:45am - 12:30pm

2) DEVSECOPS TOOLS OF THE TRADE

  • Github/Gitlab/BitBucket
  • Vagrant
  • Docker
  • Ansible
  • Jenkins/Travis/Gitlab CI/Bitbucket
  • Gauntlt
  • AWS
  • Inspec

12:30pm - 1:30pm Lunch Break

1:30pm - 3:30pm

  • Hands-On Labs: Use Vagrant to practice Infrastructure as a Code
  • Hands-On Labs: Building a CI Pipeline using Jenkins/Travis and Github/Bitbucket.
  • Hands-On Labs: Use the above tools to create a complete CI/CD pipeline.

3:30pm - 3:45pm Afternoon Break

3:45pm - 5:00pm

3) SECURE SDLC AND CI/CD PIPELINE

  • What is Secure SDLC
  • Secure SDLC Activities and Security Gates
  • Security Requirements ( Requirements)
  • Threat Modelling (Design)
  • Static Analysis and Secure by Default ( Implementation)
  • Dynamic Analysis(Testing)
  • OS Hardening, Web/Application Hardening (Deploy)
  • Security Monitoring/Compliance (Maintain)
  • DevSecOps Maturity Model (DSOMM)
  • Hands-on: Create a CI/CD pipeline suitable for modern applications.
  • Hands-on: Manage the findings in a fully automated pipeline.

DAY 2

9:00am - 10:30am

4) SOFTWARE COMPONENT ANALYSIS(CSA) IN CI/CD PIPELINE

  • What is Software Component Analysis?
  • Software Component Analysis and challenges.
  • What to look in an SCA solution (Free or Commercial).
  • Embedding SCA tools like OWASP Dependency Checker, Safety, RetireJS, and NPM Audit, Snyk into the pipeline.
  • Demo: using OWASP Dependency Checker to scan third-party component vulnerabilities in Java Code Base.

10:30am - 10:45am Morning Break

10:45am - 12:30pm

  • Hands-On Labs: using RetireJS and NPM to scan third-party component vulnerabilities in Javascript Code Base.
  • Hands-On Labs: using Safety/pip to scan third-party component vulnerabilities in Python Code Base.SWOT analysis of SAST technology

12:30pm - 1:30pm Lunch Break

1:30pm - 3:30pm

5) STATIC ANALYSIS(SAST) IN CI/CD PIPELINE

  • What is Static Application Security Testing?
  • Static Analysis and challenges.
  • Embedding SAST tools like Fortify, Checkmarx, find bugs into the pipeline.
  • Secrets scanning to prevent secret exposure in the code.
  • Writing custom checks to catch secrets leakage in an organization.

3:30pm - 3:45pm Afternoon Break

3:45pm - 5:00pm

  • Hands-On Labs: using SpotBugs to scan Java code.
  • Hands-On Labs: using Trufflehog/Gitrob to scan for secrets in CI/CD pipeline.
  • Hands-On Labs: using brakeman/bandit to scan Ruby on Rails and Python Code Base.

DAY 3

9:00am - 10:30am

6) DAST (Dynamic Analysis) in CI/CD pipeline

  • What is Dynamic Application Security Testing?
  • Dynamic Analysis and Its challenges ( Session Management, AJAX Crawling)
  • Embedding DAST tools like ZAP into the pipeline.
  • SSL misconfiguration testing
  • Server Misconfiguration Testing like secret folders and files.
  • Sqlmap testing for SQL Injection vulnerabilities.
  • Hands-On Labs: using ZAP to configure per commit/weekly/monthly scans.
  • Demo: using Burp Suite to configure per commit/weekly/monthly scans.

10:30am - 10:45am Morning Break

10:45am - 12:30pm

7) INFRASTRUCTURE AS CODE(IAC) AND ITS SECURITY

  • What is Infrastructure as Code and its benefits
  • Introduction to Ansible
  • Benefits of Ansible
  • Push and Pull Model
  • Modules, tasks, roles, and Playbooks
  • Ansible for continuous security in DevOps Pipelines
  • Tools and Services for practicing IaaC ( Packer + Ansible + Docker )

12:30pm - 1:30pm Lunch Break

1:30pm - 3:30pm

  • Hands-On Labs: Using Ansible to harden on-prem/cloud machines for PCI-DSS
  • Hands-On Labs: Create hardened Golden images using Packer + Ansible

3:30pm - 3:45pm Afternoon Break

3:45pm - 5:00pm

8) VULNERABILITY MANAGEMENT WITH CUSTOM TOOLS

  • Approaches to manage the vulnerabilities in the organization.
  • Hands-On Labs: Using Defect Dojo for vulnerability management

Certification Process

Exam and certification process

Our certifications are well recognized in the industry as we ensure our students gain practical skills to implement DevSecOps. To ensure we deliver on our promise, we have a rigorous certification program.

CDP exam is an online, task-oriented exam where you attempt to solve 5 challenges (tasks) in a span of 12 hours. The exam is based on the content covered in the course but might require further research to pass the exam. Once the exam is done, you have 24 hours to send us the exam report.

Please note, it’s not an MCB or tests your memory type of exam but practical applicability of the content covered in the course.

Exam Pass percentage

The student needs to achieve at least 80 points (80%) to achieve the CDP certification.

Steps Involved

A typical certification flow involves 5 steps.

Step 1: The student schedules the exam.

Step 2: We will send you details about the exam and challenges, 30 minutes before the exam start time. Our instructors will be there to assist you if you face any difficulty while connecting to the exam lab.

Step 3: The student will connect to the exam lab using the above details and attempts the exam.

Step 4: After the exam, the student will have 24 hours to send us the exam report along with solutions.

Step 5: Practical DevSecOps team will evaluate the report and share the result(pass/fail) with the student.

Exam Challenges/tasks

The exam has 5 challenges for the exam, each of these challenges provides you points based on how complete or partial your solution was. You would need to score 80 points out of 100 (80%) to achieve the CDP certification.

Exam documentation

After the exam, you have about 24 hours to send us the exam report on our email

Programme scope, delivery arrangements and suitability are confirmed during enquiry.