SEC534: SANS Cloud Defender 2022

Provided by

What You Will Learn

Principles! Practices! Tools! Oh My! Start Your Journey On The DevSecOps Road Here.

SEC534: Secure DevOps: A Practical Introduction explains the fundamentals of DevOps and how DevOps teams can build and deliver secure software. You will learn how DevOps principles, practices, and tools and how they can be leveraged to improve the reliability, integrity, and security of systems.

Using lessons from successful DevOps security programs, this course will explain how Secure DevOps can be implemented. Students will gain hands-on experience using popular open-source tools such as Puppet, Jenkins, GitLab, Vault, Grafana, and Docker to automate Configuration Management ("Infrastructure as Code"), Continuous Integration (CI), Continuous Delivery (CD), containerization, micro-segmentation, automated compliance ("Compliance as Code"), and Continuous Monitoring. The lab environment starts with a CI/CD pipeline that automatically builds, tests, and deploys infrastructure and applications. Leveraging the Secure DevOps toolchain, students perform a series of labs injecting security into the CI/CD pipeline using a variety of security tools, patterns, and techniques.

YOU WILL LEARN:
  • Foundations and principles of DevOps, Continuous Delivery, and Continuous Deployment
  • The security risks and challenges posed by DevOps
  • The keys to successful DevOps security programs
  • How to build security into Continuous Delivery and Continuous Deployment
  • The tools, patterns, and techniques of security automation in DevOps
  • How to secure your build and deployment environment and tool chain
  • How to leverage Infrastructure as Code for secure configuration management and provisioning
  • How manual security practices (risk assessments, audits, and pen tests) can be adapted to continuously changing environments, and the important role that they still play
  • Security risks and challenges posed by containers, and how to secure container technology
  • How to automate compliance in DevOps, using the DevOps Audit Defense Toolkit
COURSE CONTENT OVERLAP NOTICE

Please note that the course material for SEC534 and SEC540 overlap. SEC534 introduces students to Secure DevOps with discussions targeting on-premise deployments. SEC540 covers Secure DevOps from both a cloud and on-premise perspective.

HANDS-ON TRAINING
  • Understanding how a Continuous Delivery/Deployment pipeline works
  • The DevOps Deployment Kata
  • How to implement static analysis testing into Continuous Delivery
  • How to write automated security tests in Continuous Delivery
  • Security in system monitoring
  • Infrastructure as Code - securing a Puppet manifest
  • Container Security - finding vulnerabilities in Docker configurations
  • Automated auditing
YOU WILL BE ABLE TO:
  • Understand the core principles and patterns behind DevOps, how work is done in DevOps, and what the keys to success in DevOps are
  • Map out and implement a Continuous Delivery/Deployment pipeline
    • How to do a Value Stream Map of the processes and workflows in making code or configuration changes - from check-in to deployment and operations
    • How Continuous Integration, Continuous Delivery, and Continuous Deployment work, including workflows, patterns, and tools
    • How to identify the security risks and issues in DevOps and Continuous Delivery
  • Map out where security controls and checks can be added in Continuous Delivery and Continuous Deployment
    • Conduct effective risk assessments and threat modeling in a rapidly changing environment
    • Design and write automated security tests and checks in CI/CD
    • Understand the strengths and weaknesses of different automated testing approaches in Continuous Delivery
    • Implement self-service security services for developers
    • Inventory your software dependencies and secure them
    • Threat model and secure your build and deployment environment
  • Integrate security into production operations
    • Automate security policies
    • Leverage container technologies (such as Docker) for security
    • Automate compliance and run-time defense
    • Create continuous feedback loops from production to engineering
  • Create a plan for introducing or improving security in a DevOps environment
  • Apply DevOps techniques to secure DevOps practices
WHAT YOU WILL RECEIVE
  • Printed and Electronic Courseware and Lab Workbook
  • Digital Download Lab environment
  • Extensive links to resources on DevOps, Continuous Delivery/Deployment, case studies, tools, etc.
ADDITIONAL RESOURCES

Posters, Cheat Sheets, and Lists
  • Cloud Security and DevOps Best Practices poster
  • Fix Security Issues Left of Prod Cheat Sheet
  • CWE/SANS Top 25 Most Dangerous Software Errors
  • Security Web Application Technologies (SWAT) Checklist
Webcasts
  • Cloud and DevSecOps 3-Part Webcast Series, May 2021
  • Extending DevSecOps Security Controls into the Cloud: A SANS Survey, October 2020
  • Winning in the Dark: Defending Serverless Infrastructure in the Cloud, June 2020
  • Attacking and Defending Cloud Metadata Services, October 2019
  • Cloud Security and DevOps Automation: Keys for Modern Security Success, April 2019
  • Continuous Security: Monitoring & Active Defense in the Cloud, August 2018
Tools

See a complete list of Cloud Security tools here.

WHAT SANS COURSE TO TAKE NEXT
  • SEC488: Cloud Security Essentials
  • SEC522: Defending Web Applications Security Essentials
  • SEC540: Cloud Security and DevSecOps Automation

Related article

At GIAC, we believe that hands-on testing is the future of cybersecurity certification. With five certification exams featuring CyberLive , and thr...