Building a DevSecOps Practice

DevSecOps is a branch of DevOps that focuses on automating Security and integrating it into the process, such as Continuous Delivery, Infrastructure-as-Code (IaC), and observability. DevSecOps speeds the delivery of safer code, but it also helps developers get early feedback on their work, producing more reliable software. This course examines integrating DevSecOps practices into the software delivery pipeline using open-source tools. This course is for software developers, site reliability engineers, and DevOps workers who want to write more secure code in a shorter amount of time.

1. DevSecOps in a Nutshell
   
   • SecDevOps in a Nutshell Or DevOps Security in a Nutshell.
   • A Very Brief Introduction to DevOps and Security
   • DevSecOps, SecDevOps, DevOps Security Defined
   • Activity Major DevSecOps Players: Regulators, Stakeholders, Developers, Operations, IT Security, Auditors, Leadership
   • Shifting DevOps Security "Left" (like other agile practices)
   • Continuous Security, implied Security, explicit Security
   • Points of Contention between traditional Security Teams (InfoSec) and DevSecOps Teams
2. DevSecOps in Practice
   
   • App Security Basics: authorization and access, auditing and logging, confidentiality or privacy, system, and data integrity.
   • Focus on data: platform data, database data, application data
   • Identity management for Dummies: IAM, permissions, and management
   • Mindset shift to DevSecOps: shift left
3. Living with DevSecOps
   
   • DevSecOps Testing and Monitoring
   • Artificial Intelligence and DevSecOps
   • Major DevSecOps Vendors and Solutions

A working understanding of industry-standard DevOps practices. A learner attending this course should be familiar with the basic tenets of agile and modern IT development and deployment methodologies. While not necessarily an expert in these concepts, learners should be comfortable with their principles. Also, a learner should have a keen and curious ambition about IT security. Security professionals attending the course may or may not have a DevOps background.

• Software developers
• Site reliability engineers
• DevOps workers