DOCSEARCHbyAlgolia
Submit Docs

DevSecOps Bootcamp

repository·master·Indexed 21 days ago

https://github.com/devsecops/bootcamp

An educational resource providing a 36-hour, 9-week curriculum designed to teach the integration of security into DevOps workflows. The program covers professional, technical, and cultural aspects of DevSecOps, progressing from building and attacking vulnerable Ruby on Rails applications to implementing Infrastructure-as-Code (IaC) with AWS CloudFormation, operational security, cloud forensics, and a final capstone project.

Tokens
33.2K
Snippets
82
Records
170
Agent score
73%

What's inside DevSecOps Bootcamp

  1. Overview of the DevSecOps Bootcamp

    master
    The DevSecOps Bootcamp is a 36-hour introductory program designed to teach the integration of DevOps and Security concepts. It focuses on the professional, technical, and cultural aspects of making security a shared responsibility. The curriculum aims to provide entry-level understanding of common DevSecOps practices, processes, and tools, enabling participants to support DevSecOps transformations and increase security capabilities without relying on gating processes.

  2. Overview of Week 6: Rugged Sec

    master
    Week 6 focuses on 'Rugged Sec', exploring how the Cloud introduces new attack vectors. The curriculum is designed to build awareness of how infrastructure can be abused by attackers, specifically focusing on account takeovers and advanced cloud hacking techniques like lateral movement and privilege escalation.

  3. Introduction to Infrastructure as Code (IaC) and AWS CloudFormation

    master
    This lesson covers the fundamentals of Infrastructure as Code (IaC) and the basics of AWS CloudFormation. IaC allows you to manage and provision your technology stack through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools. AWS CloudFormation is a service that helps you model your entire infrastructure in a text file.

  4. Overview of Week 3: Attack the Weakling

    master

    Week 3 focuses on adopting an attacker's mindset to identify vulnerabilities in web applications. The curriculum covers AWS cloud architecture, deploying vulnerable applications, and practicing common hacking techniques like SQL Injection, Command Injection, and Authentication Bypass.

    Key learning areas include:

    • AWS Fundamentals: Understanding multi-tiered cloud architecture.
    • AWS Deployments: Deploying vulnerable applications (e.g., RailsGoat) and managing control plane/user access concepts.
    • Exploitation: Using tools like Burp Suite and fuzzing techniques to exploit web application defects.

  5. Introduction to Full Stack Development Fundamentals

    master

    This lesson covers the foundational concepts of Full Stack Development within a Software Defined Environment (SDE). Key topics include:

    • Software Defined Environment (SDE) Overview: Understanding the characteristics, benefits, and required skills for working in an SDE.
    • Microservices vs. Monoliths: An overview of microservice architectures and how monolithic applications operate within an SDE.

  6. Lesson 3: End-to-end Infrastructure as Code

    master
    This lesson covers the automation of infrastructure using Infrastructure as Code (IaC) principles. The core focus is on automating deployments using Restacker and integrating managed services like Amazon RDS and logging solutions like Splunk into the automated pipeline.

  7. Week 5: Building A Rugged App Overview

    master
    Week 5 focuses on the responsibility of Software and DevOps Engineers to manage both code and infrastructure. The curriculum covers how to leverage Cloud Service Provider services and patterns to build rugged, secure, and scalable applications using Infrastructure-as-Code (IaC) principles.

  8. Week 1: Getting Started Overview

    master
    Week 1 of the DevSecOps Bootcamp focuses on establishing the foundational culture of DevSecOps, understanding the intersection of DevOps and Information Security, and setting up the necessary lab/development environments. The week is structured into three primary lessons: understanding DevSecOps as a collaborative culture, adopting an attacker's mindset for security design, and hands-on environment setup.

  9. Week 2: Build a Weak App (Development) Overview

    master
    Week 2 focuses on understanding security vulnerabilities by intentionally building a 'weak' application. By creating an application with poor security practices, you gain a visceral understanding of how attackers exploit mistakes. This knowledge serves as the foundation for learning how to implement security best practices in Week 3.

  10. Lesson 2: Build a Weak Rails app & Deploy It

    master

    This lesson focuses on building a Ruby on Rails application that intentionally contains common security vulnerabilities to demonstrate how they can be exploited and subsequently mitigated. The core concepts covered include:

    • Hardcoded Secrets: Storing sensitive information (like API keys or database credentials) directly in the source code.
    • Lack of Input Validation: Failing to sanitize or validate user-provided data, leading to security risks.
    • Code Injection: Vulnerabilities that allow attackers to execute arbitrary code through improper handling of input.

    This lesson is structured around two practical labs: Lab #2 (focusing on trusting user input and borrowing code) and Lab #3 (focusing on AWS setup and deployment).

  11. Lesson 2: Application availability and CloudFormation Overview

    master

    This lesson covers the concepts of building rugged, highly available applications using AWS services. Key topics include:

    • Fault Tolerance/Reliability: Designing systems to withstand failures.
    • Autoscale: Automatically adjusting capacity to meet demand.
    • Elastic Load Balancers (ELB): Distributing incoming application traffic across multiple targets.
    • Resilience Testing: Validating the ability of a system to recover from failures.
    • CloudFormation: Using Infrastructure as Code (IaC) to manage these resources.