30 days of DevSecOps
A short security task every day.
Level 201 · 13 lessons · 12 practice labs
Lessons
Days 1–10: surface, secrets, privilege
- Days 1-3: review listening services and the attack surface: You will list the listening services on your own lab system and do a first review to shrink its attack surface.
- Days 4-6: secrets and configuration leaks: You will find passwords and keys forgotten in code and configuration files and see safe ways to manage them.
- Days 7-9: identity and least privilege: You will apply identity and least-privilege principles so that users and services have only the access they need.
- Short task: turn the first nine days’ findings into a one-page risk list
Days 10–18: containers, supply chain, pipeline
- Days 10-12: container hardening: You will harden containers by reducing privileges, using a non-root user and removing components you do not need.
- Days 13-15: dependencies and the supply chain: You will learn how to check the libraries and dependencies you use for known weaknesses and how to reduce supply chain risk.
- Days 16-18: security in CI pipelines: You will see how to add security checks to continuous integration (CI) pipelines and protect the pipeline itself from unauthorised access.
- Short task: pick the three weakest pipeline steps and fix one
Days 19–27: testing, monitoring, response
- Days 19-21: static analysis and tests: You will add static analysis, which inspects code without running it, and security tests to the development process, and learn to read their findings.
- Days 22-24: logging and monitoring: You will set up meaningful logging for the application and server, collect those records and watch them for unusual events.
- Days 25-27: incident response: You will practise the response process for a security incident: detection, containment, fix and lessons learned afterwards.
- Short task: write a five-step response plan for a mock token leak
Capstone
- Days 28-30: wrap-up: a secure release end to end: In the last three days you combine earlier tasks to carry an application from build to release through security checks, end to end.
Practice labs
- Gather the first three days’ surface review in one table: Tabulate the server’s listening services, their owners and whether each is reachable from outside.
- Find and relocate secrets leaking from configuration files: Find three secrets written in clear in the repository and on the server, move them to an environment file and narrow its permissions.
- Turn the first nine days’ findings into a one-page risk list: Rank surface, secret and privilege findings by likelihood and impact and write an owner and first step for each.
- Apply the container hardening checklist to one service: Tick the user, capability, port and base image items by inspecting the service.
- Run the dependency scan and note the supply chain risk: Scan the project’s direct and transitive dependencies, find the component without a lock file and pin it.
- Pick the three weakest pipeline steps and fix one: Review the pipeline file for secrets, privileges and external dependencies, justify three weak steps and fix and run the riskiest.
- Split static analysis findings into real and noise: Mark ten findings as true or false alarms by reading the code.
- Set up logging and monitoring of security events: Log failed logins and authorisation errors in a structured form and write a simple rule that alerts over a threshold.
- Write and run a five-step response plan for a mock token leak: Revoke the token, distribute a new one, review the usage logs, clean the history and write up the lessons.
- Put the checks needed for a secure release in order: Arrange scan, test, approval and signing steps in pipeline order.
- Take a release through scanning and publish it with a checksum: Run the pipeline, keep the scan reports as artefacts and publish the release file’s hash.
- Ship an end-to-end secure release and write the 30-day report: Produce a release that passes every check from code to deploy and summarise remaining risks and the next 30 days’ plan on one page.
About this course
A short security task every day.
What you will learn
- Days 1–10: surface, secrets, privilege
- Days 10–18: containers, supply chain, pipeline
- Days 19–27: testing, monitoring, response
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.