Certified DevSecOps Expert CDE
The most comprehensive DevSecOps certification in the world, become a Certified DevSecOps Expert by learning to write custom roles for OS hardening, infrastructure as code, compliance as code and perform vulnerability management at scale, with hands-on advanced training in our state of the art labs.
- Earn the certification by passing the 24-hour practical exam.
- Certification proves to employers and others the practical understanding of the advanced concepts like custom rule sets.
- The lab contains all the major components of the DevOps pipeline.
- A CDE is able to write custom rulesets and reduce false-positive fatigue using automation.
- Course participants should have Certified DevSecOps Professional (CDP) certification.
- Course participants should have a basic understanding of Application Security Practices like SAST, DAST, etc.,
Chapter 1: Overview of DevSecOps
- DevOps Building Blocks- People, Process and Technology.
- DevOps Principles – Culture, Automation, Measurement and Sharing (CAMS)
- Benefits of DevOps – Speed, Reliability, Availability, Scalability, Automation, Cost and Visibility.
- Overview of the DevSecOps critical toolchain.
- Repository management tools.
- Continuous Integration and Continuous Deployment tools.
- Infrastructure as Code (IaC) tools.
- Communication and sharing tools.
- Security as Code (SaC) tools.
- Overview of secure SDLC and CI/CD.
- Review of security activities in secure SDLC.
- Continuous Integration and Continuous Deployment.
- How to move from DevSecOps Maturity Model (DSOMM) Level 2 to Level 4.
- Best practices and considerations for Maturity Level 3.
- Best practices and considerations for Maturity Level 4.
- Security automation and its limits.
- DSOMM level 3 and level 4 challenges and solutions.
Chapter 2: Security Requirements and Threat Modelling (TM)
- What is Threat Modelling?
- STRIDE vs DREAD approaches
- Threat modeling and its challenges.
- Classical Threat modeling tools and how they fit in CI/CD pipeline
- Hands-On Labs:
- Automate security requirements as code.
- Using ThreatSpec to do Threat Modelling as Code.
- Using BDD security to codify threats.
Chapter 3: Advanced Static Analysis(SAST) in CI/CD pipeline
- Why pre-commit hooks are not a good fit in DevSecOps.
- Writing custom rules to weed out false positives and improve the quality of the results.
- Various approaches to write custom rules in free and paid tools.
- Regular expressions
- Abstract Syntax Trees
- Graphs ( Data and Control Flow analysis)
- Hands-On Labs: Writing custom checks in the bandit for your enterprise applications.
Chapter 4: Advanced Dynamic Analysis(DAST) in CI/CD pipeline
- Embedding DAST tools into the pipeline.
- Leveraging QA/Performance automation to drive DAST scans.
- Using Swagger (OpenAPI) and ZAP to scan APIs iteratively.
- Ways to handle custom authentications for ZAP Scanner.
- Using Zest Language to provide better coverage for DAST scans.
- Hands-On Labs: using ZAP + Selenium + Zest to configure in-depth scans
- Hands-On Labs: using Burp Suite Pro to configure per commit/weekly/monthly scans.
Note: Students need to bring their Burp Suite Pro License to use in CI/CD
Chapter 5: Runtime Analysis(RASP/IAST) in CI/CD pipeline
- What is Runtime Analysis Application Security Testing?.
- Differences between RASP and IAST.
- Runtime Analysis and challenges.
- RASP/IAST and its suitability in CI/CD pipeline.
- Hands-On Labs: A commercial implementation of the IAST tool.
Chapter 6: Infrastructure as Code(IaC) and Its Security
- Configuration management (Ansible) security.
- Users/Privileges/Keys – Ansible Vault vs Tower.
- Challenges with Ansible Vault in CI/CD pipeline.
- Introduction to Packer
- Benefits of Packer.
- Templates, builders, provisioners, and post processors.
- Packer for continuous security in DevOps Pipelines.
- Tools and Services for practicing IaaC ( Packer + Ansible + Docker )
- Hands-On Labs: Using Ansible to harden on-prem/cloud machines for PCI-DSS
- Hands-On Labs: Create hardened Golden images using Packer + Ansible
Chapter 7: Container (Docker) Security
- What is Docker
- Docker vs Vagrant
- Basics of Docker and its challenges
- Vulnerabilities in images (Public and Private)
- Denial of service attacks
- Privilege escalation methods in Docker.
- Security misconfigurations.
- Container Security.
- Content Trust and Integrity checks.
- Capabilities and namespaces in Docker.
- Segregating Networks.
- Kernel Hardening using SecComp and AppArmor.
- Static Analysis of container(Docker) images.
- Dynamic Analysis of container hosts and daemons.
- Scanning docker images using Trivy and its APIs.
- Auditing Docker daemon and host for security issues.
Chapter 8: Secrets management on mutable and immutable infra
- Managing secrets in traditional infrastructure.
- Managing secrets in containers at Scale.
- Secret Management in Cloud
- Version Control systems and Secrets.
- Environment Variables and Configuration files.
- Docker, Immutable systems and its security challenges.
- Secrets management with Hashicorp Vault and consul.
- Hands-On Labs: Securely store Encryption keys and other secrets using Vault/Consul.
Chapter 9: Advanced vulnerability management
- Approaches to manage the vulnerabilities in the organization.
- False positives and False Negatives.
- Culture and Vulnerability Management.
- Creating different metrics for CXOs, devs and security teams.
- Hands-On Labs: Using Defect Dojo for vulnerability management.
Ready to learn DevSecOps?
Get in touch, or Register now!