Day to Day Topics List
Your Learning Curve.
-
Week 1 - Till Day 5
Pre-Requisites
A practical training that covers all the basics you need. It covers
microservices (React, JAVA and Python),
building and running them on cloud VMs,
containerizing and deploying them using Docker,
Running and Orchestrating them on Kubernetes etc ! -
Week 2 - Day 1
WELCOME TO DEVSECOPS
Discover why security is crucial in modern development and learn how to identify potential security risks and their solutions. Our expert instructors will guide you through the process of working with the security team and show you how to implement DevSecOps best practices. You'll also learn about Helm, Kubernetes Package Manager, Helm Charts, and Code Linting.
- INTRODUCTION
- Importance of security
- Security scope
- Potential security risks and their solutions
- security team
- How security team works
- The conflicts with other team
- The solution
- What is DevSecOps
- INTRODUCTION TO HELM
- Helm - Kubernetes Packages Manager
- Helm architecture
- Helm charts
- CODE SECURITY
- Code security
- Code linting
- Lint your fronted code
- Lint your Java code
- STATIC CODE ANALYSE
- Static code analysis
- Sonarqube
- Install Sonarqube
-
Week 2 - Day 2
SECURING CODE AND DEPENDENCIES
In this session, we'll take a deep dive into securing your code and dependencies. You'll learn how to install Sonarqube and Helm, and use them to detect and eliminate vulnerabilities. We'll show you how to create projects, generate tokens, and run scanners to check for security threats. You'll also learn about application dependency security and how to detect known vulnerabilities.
- STATIC CODE ANALYSIS
- Install sonarqube
- Install helm
- Installing sonarqube helm
- Modifying helm values
- Setting the service type to LoadBalancer
- Installed sonarqube
- Check the installation and all the resources
- Connect to the UI
- Creating projects
- Create our fronted web projects in soanrqube
- Create project and token
- Get the command to run the scanner
- Client side installations and scanning
- Install sonar-scanner using binary
- Clone the project and run scan
- Check the published reports.
- Possibility of integrating with existing DevOps process
- APPLICATION DEPENDENCY SECURITY
- Application Dependency Security:
- Types of dependencies
- Types of vulnerabilities - Known and Unknown
- Detecting the known vulnerabilities
- Need of automating it.
- COMMON VULNERABILITIES AND EXPOSURES(CVEs)
- CVE
- Challenges of multiple softwares and vendors
- Combined community efforts to eliminate security threats
- Governance body
- Central Database
-
Week 2 - Day 3
UNCOVER COMMON VULNERABILITIES AND EXPOSURES
Don't let vulnerabilities in your application dependencies and OS packages compromise your security. Learn how to identify these vulnerabilities using build tools such as NPM and Maven. Our experts will guide you through the process of examining reports and guidelines to ensure that your projects are secure.
- FINDING THE VVEs OF APPLICATION DEPENDENCIES
- Using build tools to identify CVEs of your application dependencies
- Integrating with your Build Tools
- Npm Audit
- Audit your frontend (ReactJS) project for CVEs
- Understanding reports
- Examining a CVE - Guidelines
- Using maven to identify the java app dependencies
- Owasp dependency check plugin for Maven
- Finding our the CVEs of java app dependencies
- Scan your Java project
- When scanning can be performed
- Integration with CI/CD
- NPM TO FIND CVEs OF A REACT / NODE PROJECT
- MOVEN AND OWSAP DEPENDENCY CHECK
-
Week 2 - Day 4
OS PACKAGES AND CONTAINER SECURITY
Containers and operating systems add an extra layer of security threat, which is why it's important to check and find out the threats while developing a container. Our experts will teach you about container development security and best practices for running a binary. You'll learn how to minimize the number of packages and use lightweight base images such as Alpine and Distroless images from Google.
- CONTAINER SECURITY
- Best Security Practices to run a binary
- Applying for Minimum Permissions
- Best practices while developing a container
- OS PACKAGES SECURITY
- OS packages and security
- Base Image Security
- Minimizing the number of packages
- Lightweight base images such as Alpine
- Distroless images from Google
- Copy only the artifact to your final production image
-
Week 2 - Day 5
DEVELOP SECURE CONTAINERS
Learn how to use the right base image and find CVEs of your containerized applications. Our experts will teach you about multi-stage building and how to reduce the attack surface of your containers. You'll also learn how to use Trivy for container security and scan an image using Trivy.
- MULTI STAGE BUILDING
- Building containers in stages
- Minimizing the packages and reducing the attack surface
- Docker Multi-Stage Building for JAVA App
- Production optimized container image from Multi-stage builds
- CVE CHECKS FOR CONTAINERS
- Container Scanning for known vulnerabilities (CVEs)
- What to scan on a container
- Identifying the OS packages in a container
- Tools that support container scanning
- USING TRIVY FOR CONTAINER SECURITY
- Introduction to Trivy
- Install Trivy
- scan an image using Trivy
-
Week 3 - Day 6
CONFIGURATION SECURITY
Configuration changes can be a challenge, but they don't have to compromise your security. In this session, our experts will show you how to ensure security at configuration, whether it's Kubernetes, Terraform, or Dockerfile. You'll learn about loopholes in Docker and Kubernetes and how to solve them using Trivy.
- TRIVY ADVANCED USE CASES
- Using Trivy for base image scanning
- Scan the react Application Image
- Using Trivy to scan your filesystem (npm project)
- Scanning a Repository using Trivy
- Integrating Trivy scannings with your CI/CD System
- CONFIGURATION SECURITY
- Introduction to configuration security
- Various configurations for your project
- DOCKERFILES SECURIY
- Loopholes in Docker
- Trivy to scan Dockerfile
- Identifying and Solving your Dockerfile
- KUBERNETES CONFIGURATION SECURITY
- Loopholes in Kubernetes
- Trivy to Scan your Kubernetes Manifests
- Solving the configurations threats in Kubernetes
-
Week 3 - Day 7
SUPPLY CHAIN SECURITY
Learn how to prevent man-in-the-middle attacks by securing your supply chain. Our experts will teach you about Terraform configurations security and the potential risks involved. You'll also learn about identifying supply chains in CI/CD pipelines and how to use hash values and digital signatures to detect file modifications.
- TERRAFORM CONFIGURATIONS SECURITY
- Overview of Terraform
- Terraform Manifests
- Challenges and Potentials risks on Terraform
- Scanning the terraform configurations using trivy
- Solving the threats in Terraform manifests
- SUPPLY CHAIN SECURITY
- What is a Supply chain
- How microservices has impacted the supply chain and increased threats
- Identifying supply chains in CI/CD Pipelines
- MAN IN THE MIDDLE ATTACKS
- Hash values
- Hash values to detect file modifications
- Man in the middle attack
- Digital Signatures
- How a Digital signature works
- Supply chain security for containers
-
Week 3 - Day 8
SUPPLY CHAIN SECURITY TO LEFT
Our final session is all about implementing supply chain security in an automated way and shifting it to left. You'll learn about Cosign for supply chain security of container images and how to use it to secure your projects.
Join us for an exciting journey into the world of DevSecOps and take your security skills to the next level!
- COSIGN FOR SUPPLY CHAIN SECURITY OF CONTAINER IMAGES
- Introduction to cosign
- cosign to sign your container images
- Sign the frontend image using the private key
- Sharing the image with a registry
- Pulling the image and Validating the Signature at the receiver end
- Jq or jless to simplify reading json output
- KUBERNETES POLICY MANAGEMENT
- Kubernetes Security
- Policies
- Ensuring security practices using Policies
- KEYVERNO
- Managing policies using Kyverno
- Install Kyverno
- Writing your first policy using Kyverno
-
Week 3 - Day 9
POLICIES IN KUBERNETES
Any insecure and unreliable applications and configurations should be prevented from entering to your production infrastructure. Use policies to ensure that your infrastructure decline non-secure requests from people and systems.
- WIRING POLICIES IN KYVERNO
- Policy Syntax
- Writing a policy
- Reusing Kyverno existing policies
- KEYVERNO POLICIES AND ADMISSION CONTROLLERS
- Restrict the container registries using policies
- A Practical demo to allow only trusted registries
- Configmap and annotations for the policy
- Image validation with policies
- Validate the image signature to ensure supply chain security
- Practical demos using frontend and java containers
- SECURITY AS PIPELINES/CODE
- Security as Pipelines / Code
- Security as Pipelines
- Need of integrating security with CI/CD
- Avoid human interactions as much as possible
- Shifting Security to left with Pipelines
-
Week 3 - Day 10
DEVESCOPS AND CI/CD - PART 1
Security is no longer a trouble once it's well integrated with your CI/CD systems. Let's build a CI/CD system for your projects with security in the right space. :)
- SECURITY AS PIPELINES / CODE
- Pipelines to automate security stuff
- Various securities to validate within pipelines
- How will your pipelines validate a success / failure
- Exit codes in Linux
- DEVSECOPS
- Build Security into CI/CD Pipelines
- Setup Jenkins
- Installing client side softwares on Jenkins server
- Build tools - maven, npm
- Kubectl
- Gcloud for GKE integration
- Trivy
- Sonar-scanner
- Docker
- Registry credentials
- Git
- Cosign
- Installing Server side softwares
- GKE
- Kyverno
- Sonarqube Server
- Configuring the jenkins servers
- Docker socket access
- GKE Access
- Registry Access
-
Week 4
An advanced project on Kubernetes
Now you are done with the course and its time to start the most amazing part of this course. 20+ engineers working together to implement best container practics on a project, to make you ready for your Job search. The project is too big and wide that if one person handle it in a company, its takes 3 to 4 months. You will also go through an interview and resume preparation session at the end to kickstart your Job hunt!
-
Celebrate
Your Success
Story!
