DevSecOps: Integrating Security into DevOps Pipelines

• An understanding of the DevOps process
• Basic working knowledge of Docker containers and Kubernetes orchestration

Audience

• DevOps professionals

DevSecOps is an extension of the DevOps methodology that integrates security practices into every stage of the development and operations lifecycle.

This instructor-led, live training (online or onsite) is aimed at intermediate-level DevOps professionals who wish to integrate security into DevOps practices, focusing on automating security checks and processes within a CI/CD pipeline.

By the end of this training, participants will be able to:

• Grasp the fundamentals of integrating security within the DevOps process.
• Automate security checks using Jenkins and integrate tools like SonarQube for code analysis and vulnerability scanning.
• Deploy secure applications with Kubernetes.
• Ensure secure communication between microservices using RabbitMQ, PostgreSQL, and MongoDB.
• Set up continuous monitoring and auditing to ensure compliance and security across deployments.

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

Course Customization Options

• To request a customized training for this course, please contact us to arrange.

Introduction to DevSecOps

• The importance of integrating security into the DevOps process
• Key principles and practices of DevSecOps

Continuous Integration (CI) Security

• Securing code repositories (GitLab integration with Jenkins)
• Automated code quality and security analysis using SonarQube
• Implementing static code analysis as part of Jenkins CI pipeline

Container Security with Docker

• Creating secure Docker images
• Managing Docker image repositories with Harbor
• Best practices for vulnerability scanning and image version control

Setting up Secure CI/CD Pipelines

• Configure Jenkins for security integration
• Run a SonarQube analysis
• Generate and secure Docker images

Securing the Deployment Process with Kubernetes

• Security practices for Kubernetes orchestration
• Role of Kubernetes Orchestrator in secure progressive deployment
• Implementing RBAC (Role-Based Access Control) and securing service communication

Integrating RabbitMQ, PostgreSQL, and MongoDB

• Secure communication between services
• Data security practices for PostgreSQL and MongoDB
• Hardening RabbitMQ for secure messaging

Identity and Access Management with Keycloak

• Configuring Keycloak for user authentication and authorization
• Managing identity for Kubernetes clusters

Implementing Security in Kubernetes

• Deploy applications securely on Kubernetes
• Integrate Keycloak with Docker and Kubernetes for identity management

Monitoring and Auditing in DevSecOps

• Continuous monitoring tools and techniques
• Auditing deployments and maintaining compliance
• Practical guide to automating rollback on security failures

Summary and Next Steps