Containers are units of software that package code and its dependencies to ensure applications run quickly and reliably across environments. In this course, you will explore the key differences between virtualization and containerization and the key benefits provided by both. Then you will differentiate between Kubernetes and Docker container solutions and find out why more teams are adopting containers. Next, you will examine how containers make DevSecOps. You will investigate common security challenges presented by containers, such as attack surface size, and you will learn how features such as application programming interface (API) microgateways can be used to complement programming language frameworks to help secure development practices. Then you will focus on how Cloud Native Buildpacks (CNB) and Paketo can be used to build modular container images that can help transform source code using modular, reusable build functions. Finally, you will learn how a strong culture can help provide top-tier container security.

DevSecOps enables the integration of security testing at every stage of the software development process. Amazon Web Services (AWS), for example, offers various tools and services that enable collaboration between developers, security specialists, and operation teams, allowing for efficient and secure software builds. In this course, you will continue to explore DevSecOps, including roles and responsibilities as they relate to development, security, and operations in AWS. Next, you will discover the components required for a successful DevSecOps implementation in AWS, including code analysis, change management, compliance, threat modeling, and security training. Then you will investigate AWS services used for continuous integration and continuous delivery (CI/CD), including AWS CodeBuild, AWS CodeCommit, and AWS CodeDeploy and you will examine the AWS tools and services that enable better testing, logging, monitoring, auditing, governance, and operating services. Finally, you will identify the common challenges of implementing DevSecOps.

Microsoft Azure is a collection of various cloud computing services that provide a wide range of services, including compute, storage, analytics, and networking. In this course, you will discover how Azure DevOps can help plan tasks, collaborate, and build and deploy applications. Next, you will explore capabilities enabled by Azure that can help ease into a DevSecOps workflow. You will focus on best practices for moving towards a DevSecOps process and investigate common challenges of implementing DevSecOps in Azure. Then, you will learn how to build and deploy containers with Azure Pipelines, ensure security with Azure Configuration Scanning, and manage identities and access with Azure Active Directory (Azure AD). Finally, you will examine Azure tools and services such as Azure Key Vault to manage keys and secrets and Azure Policy to create, assign, and manage policy definitions in an Azure environment.

Continuous integration and continuous delivery (CI/CD) is a coding philosophy and set of practices used by application development teams to deploy and deliver rapid, reliable code changes. You will often hear CI/CD referenced alongside DevOps, which is a collection of ideas, practices, processes, and technologies used by project and development teams to streamline product development. In this course, you will explore the fundamental elements and benefits of CI/CD and the key differences between CI/CD and DevOps. Then you will discover how an effective DevSecOps pipeline can help ensure security. Next, you will investigate the potential security vulnerabilities associated with each phase of the DevSecOps pipeline. Finally, you will examine common DevSecOps security recommendations, such as implementing secure coding guidelines, building security into applications, and validating input data.

Google Cloud Platform (GCP) is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products and includes a range of hosted services for compute, storage, and application development. In this course, you will explore the security, privacy, and compliance features of the GCP. Discover the five layers of GCP security, including cloud infrastructure, products and services, blueprints for security posture, workload, and applications, and solution packages. Investigate the tenants of GCP, including secure-by-design, the Security Operations Suite, zero trust security, and continuous integration and continuous delivery (CI/CD). Finally, find out how the Google Cloud Logging service can be used to review data for the DevSecOps pipeline.

DevSecOps allows developers and project managers the ability to automate, monitor, and apply security at all phases of the software life cycle. This includes the planning, developing, building, testing, releasing, delivering, deploying, operating, and monitoring phases. In this course, you will explore factors that define DevSecOps as a methodology or framework. Discover the benefits of using the CALMS and Three Ways frameworks, and the reasons to integrate security into the application development life cycle. Examine key considerations when migrating from the DevOps life cycle to the DevSecOps life cycle and investigate the roles of the code analysis and change management phases. Explore other DevSecOps phases including compliance, threat assessment, research, and vulnerability analysis. Finally, learn how DevSecOps has become inherently decentralized, and why decentralization is critical.

On-premises IT solutions generally relate to IT infrastructure hardware and software applications that are hosted and managed locally on-site. On-premises implementations require more local resources, including a staff that is responsible for maintaining its solutions and all its related processes. In this course, you will discover the key differences and benefits of an on-premises implementation, compared to those of a cloud or hybrid solution. Then you will explore the common roles and responsibilities of a DevSecOps team, including the chief information security officer (CISO), security champion, developer, and security team roles. Finally, you will learn how to create a positive DevSecOps team culture and security posture and delve into the three pillars of DevSecOps: test-driven security, monitoring and responding to security incidents, and risk assessment.

DevSecOps stands for development, security, and operations. DevSecOps is used to integrate security as a shared responsibility throughout the entire IT and development lifecycle. In this course, you will explore DevOps and DevSecOps and their roles in the development and operations teams. First, you will discover the key benefits and common practices of DevOps. Next, you will investigate fundamental DevSecOps requirements like automation, collaboration, and policy, and the potential challenges of adopting DevOps or DevSecOps. Then you will examine common industries, such as automotive, healthcare, and finance, that can implement and benefit from DevSecOps. Finally, focus on the steps to prepare a team to embrace DevSecOps.