Payment by bank transfer · Moroccoتعلَّم · مارِس · أتقِن

Catalogue / Cybersecurity

DevSecOps: Securing Code, Dependencies and Containers

Build security in from the very first lines of code — secrets, static analysis, dependencies, SBOMs, Docker images, signatures — and have CI enforce it automatically.

  • Intermediate to advanced
  • 11 lessons
  • 10 h 55 min

A MasterLinux course · Original text

What you will learn

  • Understand “shift-left” and recognize OWASP Top 10 risks in real code
  • Model an application's threats with STRIDE before writing the first line
  • Never commit a secret, detect one with Gitleaks and clean up Git history
  • Read, fix and write static analysis rules with Semgrep
  • Find and fix vulnerable dependencies with npm audit and pip-audit, and automate updates
  • Produce a CycloneDX or SPDX SBOM with Syft and put it to use
  • Scan images, repositories and infrastructure files with Trivy
  • Write a hardened Dockerfile — multi-stage, minimal image, non-root user
  • Sign and verify what you publish (checksums, keys, cosign and Sigstore)
  • Set up security gates in GitHub Actions and GitLab CI that block a critical vulnerability

Course content

11 lessons · 10 h 55 min
Section 1 — Fundamentals3 lessons · 2 h 30 min
  1. Shift-left and the OWASP Top 10: security starts in the editor Preview45 min
  2. Threat modeling with STRIDE 55 min
  3. Secrets: never commit them, detect them with Gitleaks and clean the history 50 min
Section 2 — Analyzing code3 lessons · 2 h 45 min
  1. SAST with Semgrep: reading, fixing and writing rules 1 h
  2. Vulnerable dependencies: npm audit, pip-audit, overrides and Dependabot 55 min
  3. SBOM with Syft: inventory what you ship (CycloneDX and SPDX) 50 min
Section 3 — Containers and the delivery chain4 lessons · 3 h 40 min
  1. Scanning images and infrastructure files with Trivy 55 min
  2. Writing a hardened Dockerfile 50 min
  3. Signing and verifying: checksums, keys, cosign and Sigstore 55 min
  4. Security gates in CI: GitHub Actions and GitLab CI 1 h
Section 4 — Final project1 lesson · 2 h
  1. Final project: securing the "api-souk" API end to end 2 h

Requirements

  • The “Fundamentals” course (included) or solid hands-on experience with the Linux command line
  • Git (clone, commit, push) and the basics of a CI pipeline
  • Ability to read some JavaScript or Python; Docker basics are a plus

Who is this course for?

  • Junior developers who want to ship secure code from day one
  • DevOps engineers who need to add security to their pipelines
  • Fintech, e-commerce and online public service teams subject to Moroccan Law 09-08