Course · Training · Workshop
DevSecOps
Build security straight into your CI/CD pipelines: static code analysis, container scanning, SBOM generation and Kubernetes policy management following the shift-left approach.
Discover in this two-day workshop how to successfully integrate security into your DevOps processes. From the fundamentals of the shift-left approach to advanced container security techniques – learn hands-on how to build secure CI/CD pipelines and implement automated security testing.
Trainers
What participants say
Broad introduction to several DevSecOps related tools. Nice hands on experience with easy to use lap environment.
Software Engineer
These customers booked courses in the same topic cluster.More customers →
Content
In this workshop, you will learn how to seamlessly integrate security into your DevOps processes and establish a comprehensive DevSecOps culture in your team. You will discover practical techniques for automating security testing, container scanning, and vulnerability management. Thanks to hands-on exercises and real-world scenarios, you will develop the ability to implement secure CI/CD pipelines and identify security risks early. We start with DevSecOps fundamentals and then delve into advanced topics such as container security, policy management, and automated compliance checks.
Day 1: – Welcome, Setup & Lab Environment – DevSecOps Principles:
- Why does security matter?
- From DevOps to DevSecOps
- Shift-Left Approach
- Automation Principles
- Security as Code
- Vulnerability Databases and Identifiers – Securing Software Development:
- Code Analysis and Scanning
- Introduction to Static Code Analysis (SCA)
- Implementing and Automating Scanning with SonarQube
- Static Application Security Testing (SAST) with GitLab
- Software Bill of Materials (SBOMs)
- Why are Visibility and Traceability important?
- Creating SBOMs with Syft
- Tracking SBOMs with Dependency Tracker
- Automating SBOM Generation and Tracking with GitLab
- Environment-specific Scanners
- Programming language-specific environments (Go vuln scan, npm audit, pip-audit) – Securing Containerized Pipelines:
- Building Secure Containers
- Concepts and Best Practices
- Scanning Containers with Trivy
- Automating Container Scanning and Tracking with GitLab
Day 2: – Securing Containerized Pipelines (continued):
- Container Signing with Sigstore/Cosign
- Automatic Container Signing with GitLab
- Container Artifact Storage
- Artifact Scanning
- Retrieval Policies – Securing Deployed Orchestration:
- Deployment Configuration Scanning with Trivy
- Implementing Pod Security Standards
- Kubernetes Policy Management with OPA (Open Policy Agent) – Security Issue Tracking:
- Creating automated tickets for security findings within GitLab
- Exclusions and Exceptions – Outlook:
- Next Steps: Automated Remediation and Beyond
The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.
Request this course in-house
Request a public date
No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.
More about DevSecOps
DevSecOps is the evolution of DevOps that integrates security as a fundamental component throughout the entire software development lifecycle. Instead of treating security as an afterthought, it is embedded from the beginning into development and deployment pipelines.
The shift-left approach is central to this: security testing and controls are implemented as early as possible in the development process to identify and fix vulnerabilities during the development phase, rather than discovering them in production.
Further resources:
History
DevSecOps emerged as a natural evolution of the DevOps movement when organizations realized that security could no longer be a separate, downstream process. Increasing digitalization and the frequency of cyber attacks made it necessary to integrate security into development processes from the beginning.
Modern tools such as container scanners, SAST/DAST tools, and policy-as-code solutions now enable seamless integration of security into CI/CD pipelines. The Cloud Native Computing Foundation (CNCF) and other organizations are driving the development of open-source security tools specifically designed for cloud-native environments.
The term "Security as Code" describes the approach of defining and managing security policies and controls as code, enabling automation, versioning, and reusability.