DevSecOps mental model and threat-driven controls
Integrate security into delivery by connecting assets and threats to preventive, detective and recovery controls with reviewable evidence.
Open module →DevSecOps Fundamentals · DSO-FND
Build security into source → build → artifact → deploy.
Learn security as an engineering evidence loop: threat → control → evidence → decision. The core labs are account-free and teach reasoning first; optional labs map the concepts to Gitleaks, Semgrep, Trivy, Syft, Grype, Cosign and GitHub Actions.
My Learning progress
0% complete
0 of 12 curriculum modules completed · 0/12 currently published modules complete · 0 with lab + knowledge-check evidence.
LevelFundamentals · beginner → early-intermediate
Typical time~11–12 hours · allow 10–14
Labs12 account-free core labs + optional real-tool exercises
Assessment30 random questions · 35 minutes · pass ≥75%
CertificationOptional · ₹499 incl. GST
Learning sequence
Reason first. Scan second. Prove the release.
Every module connects a security problem to a control, evidence and an operational decision.
Secrets detection and credential hygiene
Prevent credentials from entering source control, detect historical leaks, and respond correctly when a secret is exposed.
Open module →SAST and secure code review
Use static analysis to find risky code patterns while keeping rule scope, data flow, validation and human review explicit.
Open module →Dependencies, containers and IaC scanning
Find known vulnerabilities and configuration risks across dependencies, container images and infrastructure code without confusing presence with exploitability.
Open module →SBOM generation and component inventory
Create and reason about software bills of materials so releases have a durable component inventory that can be rescanned later.
Open module →Vulnerability analysis with SBOM and Grype
Use SBOM-driven vulnerability analysis while separating scanner confidence, fix availability, exploitability and exception policy.
Open module →Artifact signing, attestations and provenance
Protect artifact integrity with signatures and provenance so consumers can verify what was built, by whom, and from which source/build process.
Open module →Secure GitHub Actions identity and permissions
Harden CI/CD with least-privilege tokens, explicit permissions, short-lived OIDC credentials, reviewed dependencies and protected deployment environments.
Open module →Policy gates, exceptions and evidence
Turn scanner output into consistent promotion decisions with explicit policy, evidence retention, accountable exceptions and fail-safe behavior.
Open module →Secure pipeline design and artifact promotion
Compose security controls into a source→build→artifact→promote flow that scans once, promotes immutable artifacts and separates build from deploy authority.
Open module →Runtime verification, feedback and response
Connect pre-deployment security evidence to runtime detection, admission/verification, incident response and backlog improvement.
Open module →Capstone — secure source-to-deploy pipeline
Design and validate a release evidence bundle that proves the expected source, scans, SBOM, vulnerability disposition, artifact identity, signature/provenance, policy decision and deployment verification.
Open module →Core tools
bash, Python 3, text/JSON files. No cloud account required.
Optional tools
Gitleaks, Semgrep, Trivy, Syft, Grype, Cosign and GitHub Actions concepts.
Safety boundary
Use synthetic secrets and disposable artifacts. Never paste real credentials into training scans.
Knowledge assessment
Prove you can turn findings into defensible decisions.
30 questions are selected from an 84-question bank covering threat modeling, secrets, SAST, dependencies/containers/IaC, SBOM/vulnerability management, CI identity/signing/policy and runtime troubleshooting.
12 MODULES→30 RANDOM QUESTIONS · 35 MIN→PASS ≥ 75%→OPTIONAL CERTIFICATION
2–3 hour release capstone
Prove one immutable artifact through the entire security evidence chain.
The capstone rejects digest drift, missing evidence, expired exceptions and rollback gaps. It validates relationships—not checkbox presence.
Threats→Scan→SBOM→Sign/provenance→Policy→Deploy verify