Security (DevSecOps)

Security (DevSecOps): a free DevOps track with 8 modules and 37 lessons. Shrink the attack surface of a Linux server: least privilege with sudo, special…

Practice interactively →

Modules

1. 01 Hardening a Linux server

   Shrink the attack surface of a Linux server: least privilege with sudo, special permissions and ACLs, key-only SSH, a host firewall, and watching logins and audit logs.

2. 02 Secret management

   Keep passwords, tokens and keys out of code: catch leaked secrets with gitleaks, store and issue them with Vault or a cloud secret manager, and use Kubernetes Secrets and pipeline secrets correctly.

3. 03 SAST with SonarQube

   Static analysis of source code to find bugs, vulnerabilities and code smells before it runs: SonarQube and SonarLint, the scanner–server–database architecture, Jenkins integration and blocking merges with a Quality Gate.

4. 04 Vulnerability scanning with Trivy in the pipeline

   Understand CVEs, CVSS and severity; use Trivy to scan images, filesystems, IaC and Kubernetes manifests; set blocking thresholds in CI and generate SBOMs to know what you are running.

5. 05 Software supply chain security

   Most of your software is other people’s code: scan and update dependencies, keep base images small and fresh, sign images with cosign, and understand supply-chain attacks and the SLSA framework.

6. 06 IaC security and policy as code

   Cloud misconfiguration is a leading cause of data leaks; scan Terraform with Checkov before apply, write organisational rules in OPA/Rego or Conftest, and give pipelines only the IAM rights they need.

7. 07 Kubernetes security

   Narrow what workloads can do in the cluster: securityContext, Pod Security Standards, NetworkPolicy to isolate traffic, Kyverno policies and runtime detection of unusual behaviour with Falco.

8. 08 A complete DevSecOps pipeline

   Put every tool together into one pipeline: shift left to find issues early, DAST with OWASP ZAP against a test environment, security gates with clear thresholds, and a vulnerability triage process with SLAs, exceptions and metrics.