SEC540: Cloud Native Security and DevSecOps Automation
About This Course
This course provides development, operations, and security professionals with a deep understanding of and hands-on experience with the DevOps methodology used to build and deliver cloud native infrastructure and software. Participants learn how to attack and then harden the entire DevOps workflow, from version control to continuous integration and running cloud native workloads. Each step of the way, participants will explore the security controls, configuration, and policies required to improve the reliability, integrity, and security of on-premises and cloud-hosted systems. You will also learn how to implement more than 20 DevSecOps security controls to build, test, deploy, harden, and monitor cloud native infrastructure and services.
What You'll Learn
- Understand how DevOps works and identify keys to success
- Wire security scanning into automated CI/CD pipelines and workflows
- Parse security scanning results and display the data on CI/CD dashboards
- Manage secrets for CI/CD servers and cloud native applications
- Automate configuration management using Infrastructure as Code (IaC)
- Build, harden, and publish golden virtual machine images using CI/CD workflows
- Operate and secure container technologies using Docker and Kubernetes
- Manage the software supply chain using software provenance, attestations, artifact signing, software bill of materials (SBOM), and SBOM vulnerability scanning.
- Harden Kubernetes clusters with workload identity and admission control
- Monitor Kubernetes audit logs using cloud logging and monitoring services
- Deploy patches using cloud and Kubernetes blue / green deployments
- Refactor systems to take advantage of microservice and serverless architectures
- Automate cloud compliance and security policy guardrails and auto-remediation playbook
Entry Requirements
The following are prerequisite skills for SEC540:
- SANS SEC488: Cloud Security Essentials or hands-on experience using the AWS and Azure Cloud
- Familiarity with Linux command shells and associated commands
- Basic understanding of common application attacks and vulnerabilities (e.g., OWASP Top 10)
- Basic understanding of version control (git), continuous integration systems (GitLab CI), and Kubernetes is recommended but not required
- Proficient in written and spoken English
There are no minimum entry requirements for years of experience in the domain, education level or age group; but participants should possess the relevant prerequisite skills mentioned above.