Course details
Devsecops
Learn how to make security part of the everyday path from commit to production instead of a last-minute gate. You will protect one running example, the Tiffin lunch-ordering app and its pipeline, with secure coding, scanning, secrets handling, threat modelling and hardened containers.
Course curriculum
DevSecOps Foundations5 lessons
Meet the Tiffin app and its pipeline, learn what DevSecOps adds to DevOps, and pick up the core vocabulary: the CIA triad, authentication versus authorization, the OWASP Top 10, and safe habits for the shell scripts every pipeline runs.
Encryption and Secrets4 lessons
Learn symmetric and asymmetric encryption, how TLS combines them, which hash to use for files and which for passwords, and how a secrets manager and KMS keep the Tiffin pipeline's keys out of code and short-lived.
Secure Coding4 lessons
Stop SQL injection with parameters, stop cross-site scripting with output encoding, validate input at the boundary, then let SAST, DAST and SCA check every Tiffin change automatically at the right pipeline stage.
Identity and Threat Modeling4 lessons
Give people, services and pipeline jobs only the access they need through roles, then learn to spot threats before they are built: STRIDE, attack surface mapping, and a lightweight threat modelling workflow that feeds tests into the pipeline.
Cloud, Container and Supply Chain Security5 lessons
Catch cloud misconfiguration with IaC scanning and CSPM, scan and harden Tiffin's container images, secure the software supply chain with lockfiles, SBOMs and signed provenance, and finally harden the build pipeline itself.