Career capstone: DevSecOps engineer
You join the software unit of the fictional Atlas Logistics as a DevSecOps engineer, secure its pipelines, images, secrets and supply chain end to end and report to management.
Level 501 · 13 lessons · 12 practice labs
Lessons
Discovery
- Inventory of pipelines, repositories and images
- Gap analysis against a checklist
- A prioritised work plan
- Short task: pick the three riskiest pipelines with reasons
Implementation
- Moving secrets to Vault and OIDC
- An organisation-wide secure base image
- Scans and gates
- Signing and provenance
- Runtime monitoring and alerts
- Short task: pilot the new gates with two teams and gather feedback
Incident and report
- Drill: a leaked deploy token
- Metrics and the management report
- Capstone: secure and defend Atlas Logistics’ software delivery chain
Practice labs
- Take an inventory of pipelines, repositories and images: Gather every repository, its pipelines and the images in the registry into one table through the API.
- Run a gap analysis against the checklist: Check secrets, runner, scanning and signing items for every pipeline and score the gaps.
- Pick the three riskiest pipelines and write the prioritised work plan: Score by production access, number of secrets and openness to outside contributions, justify the choice and produce an eight-week plan.
- List the jobs that use static secrets: Extract long-lived passwords from the CI variables and the jobs that use them.
- Move one pipeline’s secrets to Vault and OIDC: Define the role and policy, change the job to fetch short-lived credentials and remove the static variable.
- Publish an organisation-wide secure base image and move two services to it: Publish a hardened, scanned and signed base image with regular rebuilds and measure the drop in vulnerabilities for two services.
- Add the shared scan template to a project: Include the template in the pipeline and show the scan jobs run.
- Pilot the new gates with two teams and gather feedback: Turn the gate on in warn mode first, measure how many releases it would block and tune the threshold from team feedback.
- Roll out signing, provenance and runtime monitoring: Make the pipeline sign the image and produce an attestation, the deploy verify them and Falco alerts be collected, proving each with a trial.
- Order the steps of the leaked deploy token drill: Put revoke, scope, redeploy and notify in the right order.
- Run the leaked deploy token drill: Revoke the token, review the usage logs, move to the new identity set-up and time the exercise.
- Secure the software delivery chain and report to management: In the Atlas Logistics scenario summarise all work with before and after metrics and present the remaining risks and next quarter’s ask.
About this course
You join the software unit of the fictional Atlas Logistics as a DevSecOps engineer, secure its pipelines, images, secrets and supply chain end to end and report to management.
What you will learn
- Discovery
- Implementation
- Incident and report
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.