Module Title: dgt_devops06 – DevSecOps Introduction
Description:
The module “dgt_devops06 – DevSecOps Introduction” is an introduction to DevSecOps, focusing on embedding security practices within the software build and release processes.
Here, as everywhere in the Academy, theory comes first and practice happens in natural language. Once you understand what static analysis, DAST and IaC scanning look for and where they belong in a pipeline, you ask the machine to add those security gates to a CI/CD pipeline, then read the pipeline definition and the scan reports it produces, separate real vulnerabilities from false positives, and send it back to fix what is wrong.
Module Objectives:
-
Understand DevSecOps Principles: Gain insight into the philosophy of DevSecOps and its importance in modern digital infrastructure.
-
Security in Software Build and Release: Learn strategies for integrating security measures into the build and deployment phases, and practise describing them to the machine so that it wires them into the pipeline, identifying vulnerabilities early and mitigating risks effectively.
-
Preventive Measures: Explore the techniques and tools that help prevent critical issues from arising during the operational phase of digital platforms, and learn to verify that what the machine set up really provides robustness and reliability.
-
Collaborative Culture: Foster a culture of collaboration between development, operations, and security teams to streamline workflows and enhance overall software quality.
Key Topics:
-
DevSecOps Fundamentals: An overview of DevSecOps principles, including the integration of security into CI/CD pipelines.
-
Security Considerations During Build and Release: Best practices for incorporating security checks into build processes, automated testing, and secure coding standards, including how to review code and configurations generated by an AI agent.
-
Tools and Technologies: Introduction to tools that automate security assessments, such as static code analysis, dynamic application security testing (DAST), and infrastructure-as-code security scanning, and how to read their findings critically.
-
Risk Management and Compliance: Regulatory requirements and frameworks for maintaining compliance while implementing DevSecOps practices.
-
Case Studies and Real-world Scenarios: Analyze case studies that highlight the impact of DevSecOps on preventing severe issues in production environments.
-
Continuous Improvement: Monitoring, feedback loops, and continuous improvement processes to maintain a strong security posture throughout the software lifecycle.
Target Audience:
This module is designed for developers, IT operations professionals, security practitioners, project managers, and anyone involved in software development and deployment who wants a better understanding of DevSecOps practices. It is suitable both for those new to the field and for those updating their skills.
Outcome:
By the end of this module, participants will have a solid foundation in DevSecOps and will be able to instruct the machine, in natural language, to integrate security into a delivery process, then judge whether the result is genuinely secure. The module also covers how to make digital platforms more secure and resilient, including the issues that arise during the operational phase.
The students can push their exercises to the Academy DevOps & SRE Git project. For this module, create a folder with your username as its name in the following subfolder: https://github.com/Garanti-Del-Talento/gdt_academy