Inflearn brand logo image
Inflearn brand logo image
Inflearn brand logo image
Security & Network

/

Computer Security

DevSecOps Basic (/w SAST)

What is DevSecOps? Configure a CI build environment and an environment that automatically performs SAST checks during build

(4.7) 6 reviews

56 learners

  • gnsanrzld4049
이론 실습 모두
devsecops
owasp
CI/CD
sast
SonarQube
Jenkins
grafana

What you will learn!

  • What is DevSecOps?

  • DevSecOps Models

  • CI/CD Pipeline SAST automatic inspection environment configuration

I've heard a lot about DevSecOps, but what exactly is it?

You can set goals for what a DevSecOps environment is and what efforts you should put into building it!

Security teams want to leverage DevOps (CI/CD) environments, but aren't sure where to start!

  • A self-assessment and goal-setting method presented using various DevSecOps criteria.

  • Example environment configuration using open source (Github, Jenkins, SonarQube, etc.) for configuring a DevSecOps environment

Learning Content

  • It was created with a focus on the basics of DevSecOps and setting up a practical environment.

  • Section 1: What is DevSecOps? , DevSecOps Models

  • Section 2: Configuring a CI Environment and Automated SAST (Source Code Vulnerability Checking) Scanning Environment in a CI Environment

  • Section 3: Monitoring Measures

Section (1) DevSecOps Basic

Let's take a look at what DevSecOps is and how to plan for its implementation in your environment.

We review DevSecOps models proposed by various overseas companies and present our own assessment and future plans.

Section (2) CI & SAST

This hands-on exercise demonstrates how to implement automated SAST (Source Code Vulnerability Scanning Tool) inspection to apply Sec in a DevOps environment.

  • Tools used: Jenkins & Github

Section (3) Monitor

We propose a monitoring plan to ensure normal operation after SAST automatic inspection.

  • Tools used: Prometheus & Grafana

Practice environment

  • Operating System and Version (OS): The environment in which Docker runs (Windows, Linux OSX, Mac, etc.)

  • Tools used: Docker Desktop

  • PC specifications: A practical environment will be created using a total of five Docker images. Any specifications that can run approximately five Docker containers simultaneously are sufficient.

Learning Materials

  • Lecture materials are provided in PDF format, and the code required for practice is provided in the attached files for each lecture.


Player Knowledge and Precautions

  • This article primarily introduces a method for building an automated SAST/DAST vulnerability inspection environment based on a CI/CD pipeline for building a DevSecOps environment.

  • Since we cannot cover all the various SAST/DAST tools, such as reducing false positive rates and improving detection rules for SAST/DAST, we would appreciate it if you could provide information based on the automated DevSecOps environment configuration.
    - We plan to continue producing a series of lectures on the topic of DevSecOps, and we plan to additionally write basic content on reducing false positives or enhancing detection rules based on open source tools (e.g. SonarQube, ZAP).


Recommended for
these people

Who is this course right for?

  • Anyone who wants to build a DevSecOps environment in their company

  • Anyone who is thinking about how to set goals and plans for building DevSecOps

Hello
This is

557

Learners

37

Reviews

12

Answers

4.4

Rating

6

Courses

Curriculum

All

23 lectures ∙ (3hr 19min)

Course Materials:

Lecture resources
Published: 
Last updated: 

Reviews

All

6 reviews

4.7

6 reviews

  • neobus71742389님의 프로필 이미지
    neobus71742389

    Reviews 8

    Average Rating 5.0

    5

    30% enrolled

    • cindy02276721님의 프로필 이미지
      cindy02276721

      Reviews 2

      Average Rating 5.0

      5

      30% enrolled

      • jingu2225079님의 프로필 이미지
        jingu2225079

        Reviews 4

        Average Rating 3.0

        3

        100% enrolled

        • simonkim95님의 프로필 이미지
          simonkim95

          Reviews 2

          Average Rating 5.0

          5

          100% enrolled

          Tôi đã xem bài giảng về tích hợp gitlab - sast (sonarqube) rất hay. Tôi đã rất băn khoăn không biết làm thế nào để tích hợp công cụ sast vào quy trình ci/cd tại doanh nghiệp. Tôi nghĩ rằng bài giảng này đã giúp tôi định hình được phần nào hướng đi. Mặc dù công cụ sẽ triển khai không phải là sonarqube, nhưng tôi nghĩ nó sẽ rất hữu ích trong việc trao đổi với bên cung cấp công cụ.

          • lakescript님의 프로필 이미지
            lakescript

            Reviews 1

            Average Rating 5.0

            5

            100% enrolled

            Nội dung cốt lõi về xây dựng pipeline CI trong thực tế đã được truyền đạt rất đầy đủ. Đặc biệt, mẹo về cách áp dụng khi có công cụ bảo mật khác ngoài SonarQube đã sử dụng trong thực hành thông qua các buổi học bổ sung cũng rất hay. Tuy nhiên, sẽ tốt hơn nếu có một chút lý thuyết về SonarQube cũng như các công cụ bảo mật khác! Dù sao thì đây vẫn là một buổi học rất bổ ích. Cảm ơn.

            $51.70

            gnsanrzld4049's other courses

            Check out other courses by the instructor!

            Similar courses

            Explore other courses in the same field!