Search our courses
Training

As companies are pushing code faster and more often than ever, the rate of vulnerabilities in our systems is accelerating. As we are being asked to do more with less, DevOps has shown immense value to business and security as an integral component that needs to be integrated into the strategy.

Topics covered in the course include how DevSecOps provides the business value of DevOps and the ability DevOps has to enable the business and support an organizational transformation with the ultimate goal of increasing productivity, reducing risk, and optimizing cost in the organization.

This course explains how DevOps security practices differ from other security approaches and provides the education needed to understand and apply data and security sciences. Participants learn the purpose, benefits, concepts, and vocabulary of DevSecOps; particularly how DevSecOps roles fit with a DevOps culture and organization. At the end of this course, participants will understand using “security as code” with the intent of making security and compliance consumable as a service.

The course is designed to teach practical steps on how to integrate security programs into DevOps practices and highlights how professionals can use data and security science as the primary means of protecting the organization and customer.

Using real-life scenarios and case studies, participants will have tangible takeaways to leverage when back at the office.

This course positions learners to successfully complete the DevSecOps Foundation exam, which is offered on the last day of class for classroom learners. Virtual learners will receive a voucher for a web based exam which they can schedule at their convenience.

No prerequisites / open book exams / web exams / 25 min more for non english native.


COURSE OBJECTIVES

The learning objectives include a practical understanding of:

  •     The purpose, benefits, concepts, and vocabulary of DevSecOps
  •     How DevOps security practices differ from other security approaches
  •     Business-driven security strategies
  •     Understanding and applying data and security sciences
  •     The use and benefits of Red and Blue Teams
  •     Integrating security into Continuous Delivery workflows
  •     How DevSecOps roles fit with a DevOps culture and organization

DevSecOps Foundation

Course Code

GTDSE

Duration

2 Days

Course Fee

POA

Accreditation

DevSecOps Foundation Certification (DSOF)

 

DevSecOps Foundation (DSOF)℠ is a certification that is accredited by DevOps Institute. A DevSecOps engineer is an IT Security professional who is skilled at security as code with the intent of making security and compliance consumable as a service. A DevSecOps engineer uses data and security science as their primary means of protecting the organization and customer. The purpose of this certification and its associated course is to impart, test and validate knowledge of DevSecOps vocabulary, principles, practices, automation and value.

No prerequisites / open book exams / web exams / 25 min more for non english native.

Target Audience

  • Anyone involved or interested in learning about DevSecOps strategies and automation
  • Anyone involved in Continuous Delivery toolchain architectures
  • Compliance Team
  • Delivery Staff
  • DevOps Engineers
  • IT Managers
  • IT Security Professionals, Practitioners, and Managers
  • Maintenance and support staff
  • Managed Service Providers
  • Project & Product Managers
  • Quality Assurance Teams
  • Release Managers
  • Scrum Masters
  • Site Reliability Engineers
  • Software Engineers
  • Testers

Attendee Requirements

  • Although there are no formal prerequisites for the exam, DevOps Institute highly recommends the following to prepare candidates for the exam leading to the DevSecOps Foundation certification:
  • It is recommended that candidates complete at least 16 contact hours (instruction and labs) as part of a formal, approved training course delivered by an accredited Education Partner of DevOps Institute.

Expand all

Course Description

As companies are pushing code faster and more often than ever, the rate of vulnerabilities in our systems is accelerating. As we are being asked to do more with less, DevOps has shown immense value to business and security as an integral component that needs to be integrated into the strategy.

Topics covered in the course include how DevSecOps provides the business value of DevOps and the ability DevOps has to enable the business and support an organizational transformation with the ultimate goal of increasing productivity, reducing risk, and optimizing cost in the organization.

This course explains how DevOps security practices differ from other security approaches and provides the education needed to understand and apply data and security sciences. Participants learn the purpose, benefits, concepts, and vocabulary of DevSecOps; particularly how DevSecOps roles fit with a DevOps culture and organization. At the end of this course, participants will understand using “security as code” with the intent of making security and compliance consumable as a service.

The course is designed to teach practical steps on how to integrate security programs into DevOps practices and highlights how professionals can use data and security science as the primary means of protecting the organization and customer.

Using real-life scenarios and case studies, participants will have tangible takeaways to leverage when back at the office.

This course positions learners to successfully complete the DevSecOps Foundation exam, which is offered on the last day of class for classroom learners. Virtual learners will receive a voucher for a web based exam which they can schedule at their convenience.

No prerequisites / open book exams / web exams / 25 min more for non english native.


COURSE OBJECTIVES

The learning objectives include a practical understanding of:

  •     The purpose, benefits, concepts, and vocabulary of DevSecOps
  •     How DevOps security practices differ from other security approaches
  •     Business-driven security strategies
  •     Understanding and applying data and security sciences
  •     The use and benefits of Red and Blue Teams
  •     Integrating security into Continuous Delivery workflows
  •     How DevSecOps roles fit with a DevOps culture and organization
Course Outline

Course Introduction

  •     Course Goals
  •     Course Agenda
  •     Exercise: Diagramming Your CI/CD Pipeline

    Why DevSecOps?

  •     Key Terms and Concepts
  •     Why DevSecOps is important
  •     3 Ways to Think About DevOps+Security
  •     Key Principles of DevSecOps

    Culture and Management

  •     Key Terms and Concepts
  •     Incentive Model
  •     Resilience
  •     Organizational Culture
  •     Generativity
  •     Erickson, Westrum, and LaLoux
  •     Exercise: Influencing Culture

    Strategic Considerations

  •     Key Terms and Concepts
  •     How Much Security is Enough?
  •     Threat Modeling
  •     Context is Everything
  •     Risk Management in a High-velocity World
  •     Exercise: Measuring For Success

    General Security Considerations

  •     Avoiding the Checkbox Trap
  •     Basic Security Hygiene
  •     Architectural Considerations
  •     Federated Identity
  •     Log Management

    IAM: Identity & Access Management

  •     Key Terms and Concepts
  •     IAM Basic Concepts
  •     Why IAM is Important
  •     Implementation Guidance
  •     Automation Opportunities
  •     How to Hurt Yourself with IAM
  •     Exercise: Overcoming IAM Challenges

    Application Security

  •     Application Security Testing (AST)
  •     Testing Techniques
  •     Prioritizing Testing Techniques
  •     Issue Management Integration
  •     Threat Modeling
  •     Leveraging Automation

    Operational Security

  •     Key Terms and Concepts
  •     Basic Security Hygiene Practices
  •     Role of Operations Management
  •     The Ops Environment
  •     Exercise: Adding Security to Your CI/CD Pipeline

    Governance, Risk, Compliance (GRC) and Audit

  •     Key Terms and Concepts
  •     What is GRC?
  •     Why Care About GRC?
  •     Rethinking Policies
  •     Policy as Code
  •     Shifting Audit Left
  •     3 Myths of Segregation of Duties vs. DevOps
  •     Exercise: Making Policies, Audit and Compliance Work with DevOps

    Logging, Monitoring, and Response

  •     Key Terms and Concepts
  •     Setting Up Log Management
  •     Incident Response and Forensics
  •     Threat Intelligence and Information Sharing

    Course Review

  •     Where We Started
  •     What We Covered
  •     Key Reminders of What’s Important
  •     Exercise: Creating a Personal Action Plan

    Exam Preparations

  •     Exam Requirements, Question Weighting, and Terminology List
  •     Sample Exam Review
Exam
  • Successfully passing (65%) the 90 minute, multiple choice, Bloom's Taxonomy levels 1, 2 and 3 exam leads to the DevSecOps Foundation (DSOF)℠ certificate.
  • No prerequisites / open book exams / web exams / 25 min more for non english native.
  • Although there are no formal prerequisites for the exam, DevOps Institute highly recommends the following to prepare candidates for the exam leading to the DevSecOps Foundation certification:
  • It is recommended that candidates complete at least 16 contact hours (instruction and labs) as part of a formal, approved training course delivered by an accredited Education Partner of DevOps Institute.
Learning Path
Ways to Attend
  • Attend a public course, if there is one available. Please check our schedule, or register your interest in joining a course in your area.
  • Private onsite Team training also available, please contact us to discuss. We can customise this course to suit your business requirements.

Private Team Training is available for this course

We deliver this course either on or off-site in various regions around the world, and can customise your delivery to suit your exact business needs. Talk to us about how we can fine-tune a course to suit your team's current skillset and ultimate learning objectives.

Private Team Training | Contact us

Technical ICT learning & mentoring services

Private Team Training

Our instructors are specialist consultants with vast real world experience and expertise allowing them to design and deliver client-focused courses for your organisation.

Learn more about our Private Team Training

What Our Clients Say

"Absolutely fantastic training. Thoroughly enjoyed it thanks to our highly enthusiastic tutor.  It wouldn't be an understatement to say that it was the best professional training that I have ever received."

 

Customised Linux with Networking

Live Online -  February 2022

 

"The course content was very good. When needed, the Instructor was extending the content of the course with hints and tips to help us understand different topics that were covered in the course."

 

Kubernetes Administration Certification - GTLFK

Live Online June 2021

 

 

 

“The course was held at the highest possible standards, the instructor was excellent, well prepared, well informed, and clearly an SME. Top marks.”

 

Professional Cloud Service Manager - GTC13

Live Online December 2021

 

“Very engaging and practical course so hope to be able to put the learning into practice.”

 

Being Agile in Business - GTBAB

Live Online September 2021

 

“Great instructor, who encouraged active participation. The breakout groups and exercises kept the group engaged and the content relevant to our own products”.

 

Site Reliability Engineering Foundation - GTDSRE

Live Online January 2022

 

 

 

"Intelligence is the ability to avoid doing work, yet
getting the work done"

Linus Torvalds, creator of Linux and GIT

Technical ICT learning & mentoring services

About GuruTeam

GuruTeam is a high-level ICT Learning, Mentoring and Consultancy services company. We specialise in delivering instructor-led on and off-site training in Blockchain, Linux, Cloud, Big Data, DevOps, Kubernetes, Agile, Software & Web Development technologies. View our Testimonials

Download our eBrochure
Our Accreditation Partners
  •  
  •  
  •  

 

Upcoming Courses

Kubernetes Administration

11th - 14th March 2024

26th - 29th March 2024

Live Online

 

This Kubernetes Administration Certification training course is suitable for anyone who wants to learn the skills necessary to build and administer a Kubernetes cluster

Learn More

RUST

11th - 14th March 2024

26th - 29th March 2024

 Live Online

This course will help you understand what Rust applications look like, how to write Rust applications properly, and how to get the most out of the language and its libraries.

Learn More

Introduction to Python 3 

19th - 21st March 2024

9th - 11th April 2024

7th - 9th May 2024

   4th - 6th June 2024

 

Live Online

This Introduction to Python 3 training course is designed for anyone who needs to learn how to write programs in Python or support/modify existing programs.

 

Learn More

 GO LANG TRAINING

11th - 14th March 2024

26th - 29th March 2024

 

Live Online        

 

This Go language programming training course will help you understand how Go works, and immediately be more productive. If you are building a team using Go, this will be a great opportunity to get your team on the same page and speaking the same language. Innovative lab exercises and code samples are provided to reinforce skills and quickly master the topics.

Learn More

Newsletter

Stay up to date, receive updates on scheduled dates, new courses, offers, and events.

Subscribe to our Newsletter