• Online Training
  • Training
  • DevSecOps - Automating Security in DevOps

DevSecOps - Automating Security in DevOps

Abhijay Singh

register Now
Abhijay Singh

Trainer Names: Abhijay Singh
Title: DevSecOps - Automating Security in DevOps
Duration: 4 Days
Dates: 13th - 16th August 2020
Time: 10.00 AM to 2.00 PM
Type: Online Training on Zoom platform

Abstract

One Day hands-on training to automate security into a fast-paced DevOps environment using various open-source tools and scripts.

Overview

Modern enterprises are implementing the technical and cultural changes required to embrace DevOps methodology by introducing practices such Continuous Integration (CI), Continuous Delivery (CD), Continuous Monitoring (CM) and Infrastructure as Code(IaC) .DevSecOps extends DevOps by introducing security in each of these practices giving a certain level of security assurance in the final product. In this training, we will demonstrate using our state-of-the-art DevSecOps Lab as to how to inject security in CI, CD, CM and IaC.

This is a complete hands-on training with attendees requiring only a browser to complete the entire training. Attendees will receive the DevSecOps Lab built using Vagrant and Ansible comprising of various open-source tools and scripts to help the DevOps engineers in automating security within their CI/CD pipeline.

A Short preview of our course is available for viewing here https://www.youtube.com/watch?v=_iGCZ4NPDqY

Course Objectives

  • Create a security culture/mindset amongst the already integrated “DevOps” team.
  • Find and fix low hanging fruit like SQL Injection, XSS and insecure libraries and dependencies as
  • early in SDLC as possible by injecting security in CI/CD
  • Build a secure by default infrastructure
  • Build a system with continuous security monitoring
    • Course Objective

      • Create a security culture/mindset amongst the already integrated “DevOps” team.
      • Find and fix security bugs as early in SDLC as possible
      • Build a secure by default infrastructure
      • Build a system with continuous security monitoring

      Course Outline

      • Introduction to DevOps
        • Introduction and Lab Setup
        • Challenges with Traditional IT
        • What is DevOps?
      • Introduction to DevSecOps
        • Challenges for Security in DevOps
        • DevSecOps – Why, What and How?
        • Vulnerability Management
      • Continuous Integration
        • Pre-Commit Hooks
        • Secrets Management
      • Continuous Delivery
        • Software Composition Analysis (SCA)
        • Static Analysis Security Testing (SAST)
        • Dynamic Analysis Security Testing (DAST)
      • Infrastructure As Code
        • Vulnerability Assessment (VA)
        • Container Security (CS)
        • Compliance as Code (CaC)
      • Continuous Monitoring
        • Alerting and Monitoring
        • Introduction to F-ELK
      • DevSecOps in AWS
        • DevOps on Cloud Native AWS
        • AWS Threat Landscape
        • DevSecOps in Cloud Native AWS
      • DevSecOps Challenges and Enablers
        • Challenges with DevSecOps
        • Building DevSecOps Culture
        • Security Champions
        • Key takeaway

          • Understand how to tackle security issues in a fast-moving DevOps environment
          • Identify tools/solutions and develop processes to create a secure by default infrastructure
          • Utilize the integration scripts and tools provided in the DevSecOps Lab to create your own DevSecOps pipeline

          Who Should Take this Course

          DevOps engineers, security and solutions architects, system administrators will also strongly benefit from this course as it’ll give them a holistic approach towards application security.

          Audience Skill Level

          Intermediate

          Student Requirements

          Anybody with a background in IT or related to software development whether a developer or a manager can attend this course to get an insight about DevOps and DevSecOps.

          What Students Should Bring

          Any device having a browser.

          What Students Will Be Provided With

          The attendees will receive a DevSecOps-Lab VM (designed by the NotSoSecure team) containing all the code, scripts and tools that are used for building the entire DevSecOps pipeline.

          About Trainer

          Abhijay graduated with a degree in computer science in 2010 and then studied for a postgrad diploma in Information Security, after which he immediately began working as a Security Consultant, initially at Accenture. Overall, he brings to his role at NotSoSecure eight years’ security consulting experience, in particular in the banking, finance and telecoms sectors, with key skills in web application security, network Penetration Testing and mobile application security. He is also particularly well versed in Python and JavaScript, and in his spare time, he has participated in a number of Null chapters and Bug Bounty programmes.

          Abhijay joined NotSoSecure in 2019 and his role has various aspects. First, he is involved in different types of Penetration Testing for a broad range of NotSoSecure clients – mobile applications, web applications and infrastructure. This part of his job also involves being responsible for ensuring that client secured environments meet required standards. The second aspect of his work is training, specifically the delivery of the NotSoSecure course “Application Security for Developers” both at clients and also at conferences, such as the Nullcon Security Conference in Bangalore. Finally, his job involves undertaking various types of research, which is published on the NotSoSecure blog.

Copyright © 2019-20 | Nullcon India | International Security Conference | All Rights Reserved