# 1 DevSecOps Bootcamp

So let's get to the actual contents of what you will learn when you enroll. So, basically, what new powerful skills and expertise you will have once you have completed and worked through the entire boot camp. And the first things first, we start with security essentials or security basics, which is great since you don't need this as a prerequisite knowledge. So even if you don't have security background, this chapter covers all of that. And it's important because security is a very broad topic, and we need to cover all security essentials needed to lay the foundation for the entire upcoming training to fill any knowledge gaps, specifically for DevSecOps. In this chapter, we also go through what's called OST top 10 categories. A DevSecOps engineer should definitely know the OS Foundation and be familiar with their work. So this is a perfect introduction to them and one of their projects actively used as guidelines in application security. So we go through this in detail, deep diving and understanding each category and what security aspects they cover. Very important, we're going to go through different security risks at different levels of the application, whether it's the application code itself, the runtime, the infrastructure and so on. Different security types explaining SQL injection, path traversal, XSS or cross site scripting, client or server side request forgery, and several others as part of security basics. And if you're a software developer, alone this knowledge added to your current experience will make you 10 times better at your work if you understand the security concepts behind the application security. And as a non software developer, this is the central part of understanding what security threats and application or systems around that application can even have before you learn how to secure stuff. So this chapter is an absolute must for anybody who wants to understand core application security concepts in order to learn about DevSecOps. So instead of just learning how to execute security scanning tools in order to automate DevSecOps processes by just copy pasting the commands from the official documentation, you actually learn what you are trying to secure with those tools or what security issues you are trying to validate. And this is the difference between our educational material and any other courses which leave out such crucial knowledge and only focus on the tools and their features without teaching the concepts and purpose behind them. After understanding the security essentials, we basically laid a good foundation to build on top of that and now understand the whys behind the DevSecOps. Why was there a need for it and what purpose does it have? So here you will learn about the DevSecOps concepts, the different types of DevSecOps automation tools, the security scanning types, what you automate and how. And it's also important to understand DevSecOps as its own engineering role and clear division of responsibilities between DevSecOps and other engineering roles, which is an extremely important but often ignored topic. And this is an example of a direct reference to practice and how things are implemented in real world versus the theory. Now, let me add here. If you just learned these two chapters that I just described and you didn't even continue with the rest of the boot camp, you will already be more knowledgeable in security and DevSecOps than 80% of engineers who are not directly security engineers, which is pretty crazy to be able to learn all these in just first two chapters considering the importance of this highly complex topic. And, again, we achieve that by dedicating lots of time to put together the essential topics, crafting the project outline, and going into the right level of detail in each lecture. And now starts the action. With all this knowledge, we can start the exciting journey of learning DevSecOps with hands on practice and integrating security in every single step. Now, the demo projects in the rest of the boot camp are divided into three main categories: Application security, infrastructure and cloud security, and platform security for Kubernetes specifically. And each one of those alone in isolation is a huge topic. So we cover all of them plus a couple of more things that I'm gonna mention at the end. The category of application security is the part where you learn tons of DevSecOps tools which help us automate security validation in our application release process to basically validate whether our application code is secure or not. And if not, what security issues does it actually have? And how can we fix them? So we start off by setting up a base CI pipeline with little to no security and this is done on purpose so that we can see a clear comparison of before and after security implementation. Securing the pipeline step by step and learning new DevSecOps concepts and tools in each of these steps. And as I said, there are tons of DevSecOps concepts and tons of things that go into automating application security with DevSecOps. So we're gonna start implementing automated security checks to scan the application code for any leaked secrets in the code. We're gonna do extensive code testing using SAS tools, which stands for setting application security testing. And we're also gonna learn about software composition analysis to automate validating any third party dependencies of an application for any security issues. And as part of that, we're also gonna learn the concept of CVEs and how they reference known vulnerabilities in third party public libraries. So here, we're gonna learn the concepts of what each type of security scanning actually does and all the tools that help us automate those processes. But when we do the automated security scanning, we also want to visualize the results. So we are gonna learn how to generate reports of any of those automated security checks, how to use a vulnerability management tool called DefectDojo to upload those reports and use DefectDojo to help us find the fixes and find the remediation of the security issues. We're also gonna learn a very important concept of false positive analysis when working with security scanning tools. And we're gonna learn for the practical real world reference why that is so important and how to configure the tools to minimize and reduce the number of false positives. What we are also gonna do is based on the Python knowledge from DevOps, we're gonna actually automate the process of generating reports and uploading them to a vulnerability management tool, which again is a use case that you would need in a practical real world application of DevSecOps because DevOps and DevSecOps is all about automating, and this is part of that automation process. And then, very interesting and important, we are actually gonna dig into the example application that we are scanning for securities, and we're gonna actually fix some of the issues like SQL injection issue, the third party library vulnerabilities, and so on in order to understand how the fixes are done in general, as well as important notes on understanding the tasks and responsibilities in a DevSecOps process and how that applies to real world gain. And that is just the CI pipeline. But, of course, the pipeline continues from CI to CICD with the addition of continuous deployment. And adding a deployment part basically opens up a whole new world of security concerns that we need to handle with other concepts and tools. So here again, we start off by building a completely insecure but realistic continuous deployment to AWS with bad security practices so that we can secure that step by step and see the comparison of before and after implementing DevSecOps. As part of that, we're also gonna learn a very important concept of image scanning because, as you know, Docker has become standard. We are deploying our applications as containers, and container is a runtime for the application, so we're not only concerned about how secure the application code is, but also the environment where it's gonna run, which is container, how secure that runtime is. And again, we're gonna use DevSecOps automation tools for container scanning. And on top of that, we're actually learn how to configure automated scans on the Docker repository itself, and specifically in AWS ECR. And, again, we're gonna go step further here, and we're also gonna see example of how to actually fix or remediate security issues found in a Docker image specifically. And that brings us to the next step of the application release, which is the deployment environment, which, as I said, is a whole new world of security concerns and security concepts that we need to consider. We're gonna learn about infrastructure and cloud security because that's where the application will run, and that's where the application will actually be accessible by the end users. So completely exposed to public. And definitely the best cloud platform to learn about cloud security is AWS, which is by far the most used cloud platforms still in the world. So that's what we'll be focusing on in this boot camp as well. However, I want to mention here is that as with any other tool that we're gonna use in this Boot Camp, my approach is always concepts before technologies. And this applies to AWS as well. So even though we learn lots of AWS specific services here, you actually learn tons of many general security concepts that you can apply to any cloud platform or infrastructure. And that is extremely important to me to not just teach the tools and technologies or technology specific things but the concepts so that you are actually empowered to go out there and use any tool that applies to that concept. And that's why I made sure to have general cloud security and infrastructure security concepts in this part. So what are some of the things that are included here? We basically are gonna learn about a very important concept of access management to security. So we're gonna learn the core AWS service for access management of your cloud platform, which is IAM service. So we're gonna go deeper here. We're gonna understand the secure and proper usage of users, groups, policies, and most importantly, the AWS roles. And this is important because when we're automating things, instead of humans just doing manual stuff, basically services and scripts and tools talk to each other and the whole thing is orchestrated with automation, then we need to use roles extensively way more than users or groups. We're also gonna secure deployment to our environment, which is gonna be a combination of secure access management, but also secure network configuration to make sure that all the traffic getting to your virtual machines on AWS, which are EC2 instances, all the traffic is secure, and it goes through AWS authentication and authorization steps, which means no SSH ing into the servers, and what's more important, no static private keys or user access keys, instead using roles and short lived access tokens for short lived sessions. Here we have another step, another concept that actually applies to application security, but it comes after deploying an application to the end environment. And that is a concept of Dust or dynamic application security testing. So SaaS or static application security testing is for the code, the application code itself, which is also called a white box testing. However, there are many security issues that will only appear when the application is actually running and interactions to that application is happening. So basically, Dust is simulating an attacker who is attacking or trying to hack into your running systems. And again, we're gonna learn the concepts of Dust, the tools, and we're gonna see how to secure our application after finding any issues or security findings with Dust tests. So going back to the infrastructure security, again, coming back to the automation concept because we want things automated, we're actually gonna go into details of how infrastructure as code helps in securing your infrastructure and why is it so important in DevSecOps. And once we've understood that, we're actually gonna deploy that and use it to make our infrastructure more secure, and we're gonna use Terraform here to basically build a secure AWS infrastructure for our application deployment environment. Again, with proper access management, network security, and so on. And here, we're gonna go a step further, and we're actually gonna learn not only how to secure our infrastructure using infrastructure as code tool, but also how to automate the security checks when using infrastructure as code to create the infrastructure. And in doing that, we're actually gonna use a concept of GitOps where we're gonna build a CICD pipeline for our Terraform infrastructure as code script and add the security scanning or static security scanning in the pipeline just like we did for the application, which is the definition of GitOps of using version control tool for your infrastructure as code and treating it the same way as your application. And as a final but very important part of cloud security and infrastructure security, we're going to learn the concept of logging and monitoring and we're going to understand exactly why and how logging and monitoring help us in securing our systems or even after somebody has infiltrated our systems. And for the cloud security specifically, we're actually gonna learn two AWS services for logging and monitoring, which are CloudTrail and CloudWatch. So we're gonna learn about these tools in general, but, of course, we need use cases. We need hands on practice. So we're gonna configure those services to monitor the activity and behavior on our AWS cloud platform across all different services and actually notify us when something happens that is a suspicious behavior or something that may affect security of our systems. And as part of that, we're also gonna learn how to monitor and alert on AWS cloud costs using AWS Budget Service, which is a small use case, but also a useful one. After the chapter of infrastructure and cloud security, we're gonna move into a third giant part of this boot camp related to Kubernetes platform security. Because as you know, Kubernetes has already become a standard in the cloud world and no DevOps related boot camp or course would be complete without covering Kubernetes in it. This means we are gonna actually change our application development environment from simple virtual machines on AWS to a full blown Kubernetes cluster on AWS using EKS. And that means by introducing Kubernetes cluster on top of cloud infrastructure, we'll introduce another world of security attack surface and security concerns which need to be addressed. And our goal is to always equip you with the most in demand skills and most use cases, so stopping at AWS and cloud security was not an option for us here. So learning how to secure Kubernetes platform and applications running inside Kubernetes cluster will be an absolute game changer in your career. And I just wanna note here that we are gonna be first releasing the part one of this boot camp because as I said, this boot camp is pretty large, so we kinda divided it up into two parts. And Kubernetes platform security will be another large part two of this boot camp. But to cover on a high level the concepts and topics that you're gonna learn related to Kubernetes security, obviously, just like with cloud security, we're gonna cover the access management to Kubernetes cluster, who has access what, who can log in as an administrator to set up and configure stuff, and how are those access credentials managed with the least privileged access. So as part of this, we're gonna actually dive in and see, again, in practice, not just the Kubernetes native mechanism for access control, which is Kubernetes RBAC mechanism, role based access control, with service accounts, roles, role bindings, and so on, but also its integration with AWS's Access Management Access Management Service called IAM, which, as you remember, we mentioned in the cloud security. So basically combining those two give us secure access control of EKS cluster. And again, this is a very practical real world use case. But of course, aside for access management, we also need to secure the applications running inside, how we pull the private images into the Kubernetes cluster, how we make sure to secure the containers, the pods running inside the cluster so that they don't become the entry points of security attacks to allow hackers to break out of the pods and access the whole Kubernetes cluster. So we're gonna learn the concepts behind that as well as how to secure that part. We're also gonna learn the Kubernetes native security related components such as network policies. So how to do micro network segmentation and basically secure the access on a pod level rather than on the cluster level. And as part of that, we're also gonna learn a third party implementation of that. We're also gonna learn the concept of service mesh and how different features of service mesh actually help you secure your complex microservices applications in the Kubernetes cluster. And, of course, in addition to that, we have the cluster entry points like ingress controllers, the load balancers, which are also important considerations when we're talking about security. So we're gonna cover all of that and see actual real life use cases of those things. One more super important and relevant topic is sensitive data management in Kubernetes. Because when we have applications that need to talk to each other, we have databases, we have other services that require authentication and authorization, obviously, have lots of access keys or credentials and so on that needs to be stored securely. So as part of this, we're gonna learn a very popular open source tool from HashiCorp called Vault. So using Vault, we're actually gonna demonstrate how to store and use secrets and sensitive data in Kubernetes and around Kubernetes, including the secret key management, the secret data management for the applications, storing any credentials, and so on. And finally, again, we want to automate processes, we want to learn the automation parts of the security as well in Kubernetes, since we're learning DevSecOps. That means we're gonna learn the tools for automatic scanning of security misconfigurations and security vulnerabilities of Kubernetes manifests. So when product teams deploy their applications to Kubernetes cluster using Kubernetes manifest files, we can automate the scanning of those configuration files for any security issues. And as part of that, we're also gonna learn what's called policy as code. So basically creating any security policies related to Kubernetes and enforce those policies as part of the CICD pipeline for the application deployment process, which is a super exciting and interesting topic and something that also makes working with Kubernetes and managing security issues and misconfigurations in Kubernetes way easier to handle from the Kubernetes administrator side. So this part is gonna be completely packed with absolutely amazing, exciting concepts directly related to Kubernetes, but also involving lots of third party tools. And as I said, this will upgrade your existing skills as an engineer to a completely new level. And that's not even all. We're not done yet. A very important security related topic is compliance. The need to automate things and make things fast and efficient in DevOps and DevSecOps world applies to compliance as well, which we all know as this traditional bureaucratic manual effort that companies have to do to validate compliance of their projects. But not in DevSecOps. We will learn about compliance as code and the tools that help us automate compliance using code and scripts. And compliance is an overarching concept that actually applies to all these three categories that we just went through from application security to infrastructure and cloud security to platform security. And as part of compliance as code we're also gonna learn about CIS benchmarks and how they are used as part of implementing compliance as code. And again, all of this will be taught as hands on demo project so you're actually gonna learn how to do all of these in practice and not just theory. And finally, the last but not least, DevSecOps is not only a technological change and technological implementation where you just put a dozen technologies together and create automated processes, but it's also a conceptual change or sometimes even a cultural change in IT project teams in organizations. So it's important to understand, again, in real world, what are the challenges and difficulties of introducing DevSecOps into a project or the entire organization? How do you get engineers on board? How do you introduce DevSecOps strategically in teams step by step? Because here's the thing. When you, as an engineer, learn about DevSecOps, you're getting a completely different understanding and perspective of what benefits it has. And by having this knowledge, you will know exactly how it helps the business and teams. But other people, including engineers, who are not aware of those concepts often may not have the same perspective and may not even think that this is something important or relevant. Or they just don't have time to research and understand why it's important. So how can you be the driver for DevSecOps in your project and organization to show the other team members and engineers using incremental wins what value it has. So here in this last chapter we cover some practical strategies and steps for DevSecOps adoption in organizations. And this could be another huge value add in your career because knowing this will let you provide massive value for the company strategically as well. So that's basically the entire curriculum. And as you see, it's huge. It has lots of technologies, lots of concepts, lots to learn, and I'm happy that we can make all this knowledge available to the world. One thing I want to stress here again is that the main focus of the entire boot camp, just like in every other course or boot camp that we have, is to learn and understand the concepts and think about the tools just as means to an end. That means the CICD pipeline that we build, the infrastructure as code project that we build, all the different security scanning tools that we use, all of that knowledge is easily transferable to any other CICD tool, to any other security scanning tool, even to any application using a different tech stack than we're using in this bootcamp. So you'll have all the knowledge to replace any of these tools very easily because you understand the fundamental concepts. That means, if you're thinking about I want to implement this for Jenkins pipeline or I want to do this in GitHub Actions or Bitbucket or whatever CICD tools you want to use. So you can literally take the pipeline and translate it to any other CICD tool. So that was extremely important for me because I believe that is the most powerful level of knowledge when you're not tied or chained to the tools but rather see them as means to an end to actually accomplish the actual goals that you have with your projects for example. So that was probably the longest bootcamp overview video in the world. But I hope I was able to answer all the questions that you might have, was able to give some more value in this video itself and I hope to see you inside the bootcamp.