Content:

In this workshop, you will learn how to seamlessly integrate security into your DevOps processes and establish a comprehensive DevSecOps culture in your team. You will discover practical techniques for automating security testing, container scanning, and vulnerability management.
Thanks to hands-on exercises and real-world scenarios, you will develop the ability to implement secure CI/CD pipelines and identify security risks early.
We start with DevSecOps fundamentals and then delve into advanced topics such as container security, policy management, and automated compliance checks.

Day 1:
– Welcome, Setup & Lab Environment
– DevSecOps Principles:
... - Why does security matter?
... - From DevOps to DevSecOps
... - Shift-Left Approach
... - Automation Principles
... - Security as Code
... - Vulnerability Databases and Identifiers
– Securing Software Development:
... - Code Analysis and Scanning
... - Introduction to Static Code Analysis (SCA)
... - Implementing and Automating Scanning with SonarQube
... - Static Application Security Testing (SAST) with GitLab
... - Software Bill of Materials (SBOMs)
... - Why are Visibility and Traceability important?
... - Creating SBOMs with Syft
... - Tracking SBOMs with Dependency Tracker
... - Automating SBOM Generation and Tracking with GitLab
... - Environment-specific Scanners
... - Programming language-specific environments (Go vuln scan, npm audit, pip-audit)
– Securing Containerized Pipelines:
... - Building Secure Containers
... - Concepts and Best Practices
... - Scanning Containers with Trivy
... - Automating Container Scanning and Tracking with GitLab

Day 2:
– Securing Containerized Pipelines (continued):
... - Container Signing with Sigstore/Cosign
... - Automatic Container Signing with GitLab
... - Container Artifact Storage
... - Artifact Scanning
... - Retrieval Policies
– Securing Deployed Orchestration:
... - Deployment Configuration Scanning with Trivy
... - Implementing Pod Security Standards
... - Kubernetes Policy Management with OPA (Open Policy Agent)
– Security Issue Tracking:
... - Creating automated tickets for security findings within GitLab
... - Exclusions and Exceptions
– Outlook:
... - Next Steps: Automated Remediation and Beyond

Disclaimer: The actual course content may vary from the above, depending on the trainer, implementation, duration and constellation of participants.

Whether we call it training, course, workshop or seminar, we want to pick up participants at their point and equip them with the necessary practical knowledge so that they can apply the technology directly after the training and deepen it independently.