DevOps: Configuration Management, CI/CD, Monitoring-Security

This video will give you an overview about the course.

The traditional techniques of security verification are simply not adequate for this new paradigm. In this video you will see how digitalization and adoption of agile and DevOps practices has changed the way we create software.

• Deliver incremental software quickly

• Explore adoption of DevOps practices

• Learn the advantages of adopting DevOps practices

This video will give you a glimpse of severity of cyberattacks and you’ll see how to manage security risks in a rapidly changing world by adoption of DevOps principles.

• Learn about the continuous security assessment for making safe and secure software

• Embed security checks and verifications at different points of DevOps pipeline

• Fail fast, through automation and security integrating with development tools

In this video you will see the basic principles to be followed for a successful DevOps adoption. You will also see the benefits accrued out of it.

• Add robust security methods to traditional DevOps practices from day 1

• Learn the “Secure by Design" principle along with code review and security testing

• Learn about cost reduction by detecting and fixing security issues early

In this video you will see the strategy for transformation from DevOps to DevSecOps.

• Explore the team approaches to handle security challenges

• Address all the three areas of People, Process and Technology

In this video you will get to see the awesome work being done by OWASP around security.

• Obtain unbiased, practical information about application security

• Explore the OWASP resources and community

• Explore the OWASP top 10 vulnerabilities

In this video you will see how digitalization and adoption of agile and DevOps practices has changed the way we create software. The traditional techniques of Security verification are simply not adequate for this new paradigm.

• Explore Shift-Left Security checks and verifications

• Learn about AppSec Pipelines

• Know more about consistent processes

This video covers the best practices for automating different types of security tests.

• Know that application security solutions need to evolve with changing times

• Learn about the application security need that has been intensified with increasing risks

• Build a comprehensive automated security testing strategy

This video showcases the various tools which are available for performing different types of security tests and scans.

• Choose appropriate tools from different open source and commercial options

• Explore the tools introduced by OWASP

In this video you will see the importance of Red and Blue teams, which are two distinct teams of security professionals who are all working for the betterment of the company, but doing it in opposing ways.

• Approach to test resilience against any attack

• Learn the two-pronged strategy to attack and defend

• Perform an exercise to provide opportunity to challenge organization’s defenses realistically

In this video you will see how proper planning is quite crucial to address security requirements.

• Define proper functional and non-functional requirements.

• Take the first step which is to identify all the risks

• Explore the security user stories for various stakeholders - User, Admin, Business Owner

In this video you will see how to take care of security principles during design and architecture phase.

• Get to think about security from architecture phase

• Identify the core pillars of secure architecture - Confidentiality, Integrity, Availability

• Follow best practices for a secure architecture

This video shows how to apply the techniques of threat modelling, data flow diagrams and attack surface to build a secure and robust design. This would lay the foundation of a secure software.

• Identify the important assets and protect them

• Learn the iterative process from design and throughout the application life-cycle

• Learn about STRIDE model

This video explores the importance of proper Identity and access management to allow only authorized users to access the system and resources.

• Create, maintain, and use digital identities

• Learn the major steps for inventory management– Define, Map, Assign

• Manage identity and access across different phases – Discover, Harvest, Refine.

This video demonstrates the significance of performing code reviews in order to discover vulnerabilities and security related weaknesses.

• Augment standard code review practice with security considerations

• Secure code reviews look for software weakness early on

• Check for areas more prone to weaknesses

The aim of this video is to learn about the security hardening.

• Explore the importance of hardening

• Study the hardening lifecycle

• Take a look at the different automation tools

In this video you will see how Static Application Security Testing helps in finding vulnerabilities earlier in the development cycle.

• Analyze software during coding and unit testing phase

• Scan source code and look in binaries and configuration files

• Judiciously chose static analysis tools to perform static application testing

In this video you will see how to perform Static Application Security Testing by embedding SonarQube into CI/CD pipeline.

• Demonstrate static analysis testing

• Explore the use of WebGoat, a deliberate vulnerable application

• Learn about SonarCloud

This video explorers how Dynamic Application Security Testing helps in finding vulnerabilities on a running application.

• Analyze running application for weaknesses

• Learn about black-box testing where attacks are performed on running application

• Judiciously chose dynamic analysis tools to perform dynamic application testing

In this video you will see how to perform Dynamic Application Security Testing by embedding Zed Attack Proxy into CI/CD pipeline.

• Demonstrate dynamic analysis testing

• Explore the use of WebGoat, a deliberate vulnerable application

• Know more about ZAP

This video showcases newer techniques of performing Security Analysis Testing.

• Instrument code for performing novel security testing and protection

• Use IAST to detect vulnerabilities in a running application

• Use RASP to prevent vulnerabilities from being exploited

In this video you will see how to audit the open-source components being used in any application.

• Make sure that the safe and secure open-source components are being used

• Track usage of OSS components

• Set up policies around vulnerability management and license compliance

In this video you will see how configuration of infrastructure should be secured.

• Identify and mitigate risks to infrastructure configuration

• Follow best practices - Isolation, Firewall and Identity based access

• Use Docker container for a safe and secure environment

In this video you will see how key management and identity management provides safe access to your applications.

• Explore management of encryption keys through their entire lifecycle

• Use KMS to provide organization exclusive custody of encryption keys

• Use identity management to control user information

In this video you will see how companies like Netflix continuously test their production environment with various kinds of chaos. You will also see how fuzz testing can be used to expose system vulnerabilities against malicious input.

• Provide seamless service in distributed / cloud computing environment

• Simulate production environment with various failure scenarios

• Learn about the fuzzing technique

In this video you will see how a system should be monitored for security related incidents.

• Leverage both security information and event management

• Monitor for violations and assign distinct categories

• Know what the judiciously chosen metrics provide

In this video you will see the benefits of good Governance practices and regular audits.

• Manage organization's overall governance, risk management and compliance with regulations

• Track metrics across application security process, risk and SDLC

• Learn more about regular audits

In this video you will see how to respond to security incidents and perform digital forensics to contain the impact and prevent future incidents.

• Learn about having a proper incident response emergency plan

• Aim to prevent incidents by identifying trends in the adversary community

• Learn that Proper Incident Response minimizes losses and mitigates the exploited weakness