DevSecOps - Automating Security in DevOps

Trainer Name: Rohit Salecha
Title: DevSecOps - Automating Security in DevOps
Duration: 4 Days
Dates: 1^st - 4^th March 2021
Time: 10.00 AM to 2.00 PM IST
Delivery Mode: via Zoom.us and Discord Platform

Abstract

Two Days hands-on training to automate security into a fast-paced DevOps environment using various open-source tools and scripts.

Course Overview

Modern enterprises are implementing the technical and cultural changes required to embrace DevOps methodology by introducing practices such Continuous Integration (CI), Continuous Delivery (CD), Continuous Monitoring (CM) and Infrastructure as Code(IaC) .DevSecOps extends DevOps by introducing security in each of these practices giving a certain level of security assurance in the final product. In this training, we will demonstrate using our state-of-the-art DevSecOps Lab as to how to inject security in CI, CD, CM and IaC.

Every delegate will be provided a personalized cloud setup of our DevSecOps lab for hands-on implementation of various security tools in the CI/CD/CM pipeline. Attendees will receive the DevSecOps Lab built using Vagrant and Ansible comprising the same tools and scripts as a takeaway.

A Short preview of our course is available for viewing here https://www.youtube.com/watch?v=_iGCZ4NPDqY

Course Objectives

• Create a security culture/mindset amongst the already integrated “DevOps” team.
• Find and fix security bugs as early in SDLC as possible
• Build a secure by default infrastructure by automating security
• Build a system with continuous security monitoring

Course Contents

• Lab Setup
  • Online Lab Setup
  • Offline Lab Instructions
• Introduction to DevOps
  • What is DevOps?
    • Lab: DevOps Pipeline
  • Introduction to DevSecOps
    • Challenges for Security in DevOps
    • DevOps Threat Model
    • DevSecOps – Why, What and How?
    • Vulnerability Management
  • Continuous Integration
    • Pre-Commit Hooks
      • Introduction to Talisman
      • Lab: Running Talisman
      • Lab: Create your own regexes for Talisman
    • Secrets Management
      • Introduction to HashiCorp Vault
      • Demo: Vault Commands
  • Continuous Delivery
    • Software Composition Analysis (SCA)
      • Introduction to Dependency-Check
      • Lab: Run Dependency-Check pipeline
      • Lab: Fix issues reported by Dependency-Check
    • Static Analysis Security Testing (SAST)
      • Introduction to Semgrep
      • Lab: Run Semgrep pipeline
      • Lab: Create your own Semgrep Rules
      • Lab: Fix Issues reported by Semgrep
    • Dynamic Analysis Security Testing (DAST)
      • Introduction to OWASP ZAP
      • Demo: Creating ZAP Context File
      • Lab: Run ZAP in pipeline
  • Infrastructure As Code
    • Vulnerability Assessment (VA)
      • Introduction to OpenVAS
      • Lab: Run OpenVAS pipeline
    • Container Security (CS)
      • Introduction to Trivy
      • Lab: Run Trivy in Pipeline
      • Lab: Improvise Docker base image
    • Compliance as Code (CaC)
      • Introduction to Inspec
      • Lab: Run Inspec in Pipeline
      • Lab: Improvise Docker compliancy controls
  • Continuous Monitoring
    • Logging
      • Introduction to the ELK Stack
      • Lab: View Logs in Kibana
    • Alerting
      • Introduction to ElastAlert and ModSecurity
      • Lab: View Alerts in Kibana
    • Monitoring
      • Lab: Create Attack Dashboards in Kibana
  • DevSecOps in AWS
    • DevOps on Cloud Native AWS
    • AWS Threat Landscape
    • DevSecOps in Cloud Native AWS
  • DevSecOps Challenges and Enablers
    • Challenges with DevSecOps
    • Building DevSecOps Culture
    • Security Champions
    • Case Studies
    • Where do we Begin?
    • DevSecOps Maturity Model

  Key takeaway

  • Understand how to tackle security issues in a fast-moving DevOps environment
  • Identify tools/solutions and develop processes to create a secure by default infrastructure
  • In-depth understanding of various tools that can be used for security automation
  • Utilize the integration scripts and tools provided in the DevSecOps Lab to create your own DevSecOps pipeline

  Who Should Take this Course

  DevOps engineers, security and solutions architects, system administrators will also strongly benefit from this course as it’ll give them a holistic approach towards application security.

  Audience Skill Level

  Intermediate

  Student Requirements

  Anybody with a background in IT or related to software development whether a developer or a manager can attend this course to get an insight about DevOps and DevSecOps.

  What Students Should Bring

  • Any computer with an updated browser
  • In order to access our labs, you’ll need an unfiltered direct connection to the Internet. Our labs will not be accessible from behind a proxy or a firewalled Internet connection.

  What Students Will Be Provided With

  Access to cloud DevSecOps-Lab for 24 hours post end of the training for further hands-on practice to each delegate

  The attendees will receive a DevSecOps-Lab VM (designed by the NotSoSecure team) containing all the code, scripts and tools that are used for building the entire DevSecOps pipeline.

  About Trainer

  Rohit has 10 years of experience and has been working for NotSoSecure since 2016 in the capacity of an Associate Director. His primary responsibility is to perform web/mobile and infrastructure penetration tests for clients of NotSoSecure based in the USA, UK, and Europe and is also responsible for peer reviews and scrutiny of client deliverable pentest reports. He is the lead trainer for the best-selling courses of NotSoSecure viz.. “Application Security for Developers”, “DevSecOps”. He is also actively engaged in developing applications and training materials for various training of NotSoSecure.He is also passionate about architecting IT solutions with a focus on Information security.