CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications

Understanding how to read a vulnerability report is a foundational skill for anyone entering the field of cybersecurity or DevSecOps. Whether you are reviewing a report produced by a penetration tester, an automated scanning tool, or a security team,...

A pre-commit checklist is a structured list of security and quality checks that every developer must run — or that are automatically triggered — before any piece of code is officially committed to a shared version control repository such as Git. The ...

## Project Overview This mini-project is the capstone activity of the INTRO chapter. Having covered Git security policies, pre-commit hooks, OWASP Top 10, CIA triad, Shift-Left/Shift-Right/Feedback Loop principles, and pipeline security mapping, you ...

**Theoretical Recap** Integrating security tests into an existing CI/CD workflow is the operational heart of DevSecOps. The core principle is simple: security checks must not be an afterthought bolted onto the end of a pipeline — they must be embedde...

Security in software development has undergone a profound transformation over the past two decades. Traditionally, security was treated as a final checkpoint: developers would write code, assemble an application, and only at the very end would a secu...

**Theoretical Recap** The OWASP Top 10 is a regularly updated reference document listing the ten most critical web application security risks. It is not a checklist to mechanically tick off, but a risk map that helps teams prioritize where to focus t...

Before diving into penetration testing techniques or setting up a secure delivery pipeline, every cybersecurity practitioner must understand what they are actually protecting against. The OWASP Top 10 is the most widely recognized reference in web ap...

This memo sheet is designed to consolidate everything you have learned so far into a single, clear, and actionable reference. You have already explored Git fundamentals, branch policies, pre-commit hooks, security concepts such as Confidentiality, In...

**Theoretical Recap** A pre-commit hook is a script that Git executes automatically before finalizing a commit. It acts as a last-line-of-defence gate: if the script exits with a non-zero code, the commit is rejected and the developer is forced to fi...

When you work in a team on a software project, or even alone with a professional pipeline in mind, the way you organize your branches in Git is not a trivial matter. Branches are not just a convenience for parallel development: they are a critical se...

**Theoretical Recap** In the world of DevSecOps, one of the most common and dangerous mistakes a developer can make is accidentally committing a secret — a password, an API key, a database connection string, a private token — directly into a Git repo...

Git is far more than a simple tool for saving code. When used correctly, it becomes a genuine security instrument, allowing teams to track every change, identify the origin of a vulnerability, and respond quickly to incidents. This course builds dire...

THEORETICAL RECAP Git is a distributed version control system that tracks changes in files over time. Every project managed with Git lives inside a repository (repo), which stores the full history of modifications. Understanding a few core concepts i...

Git is a version control system. That means it is a tool that tracks every change made to a set of files over time. If you write code, modify a configuration file, or update a script, Git records what changed, when it changed, and who made the change...

**Theoretical Recap** A virtual machine (VM) is a software emulation of a physical computer. It runs an operating system and applications in an isolated environment, completely separated from your host system. This isolation is fundamental in cyberse...

Before performing any security test, penetration test, or vulnerability analysis, you must set up a dedicated, isolated, and controlled environment. This is not optional. Working directly on your personal machine, using your real accounts, or testing...

You have now completed the introductory section of this course on CyberSecurity and DevSecOps. Before moving on to more technical and specialized content, this chapter serves a double purpose: consolidating everything you have learned so far and givi...

## Mini-Project: Writing a Security-Oriented User Story ### Project Overview Building on your understanding of DevSecOps principles, the CI/CD pipeline, and the CIA triad, this mini-project challenges you to write a complete set of security-oriented ...

Introduction: Why a storyboard approach? Throughout the previous activities, you have explored what DevSecOps means, how a Continuous Integration and Continuous Delivery pipeline works, where security checks fit in at each stage, and how artifacts an...

In the previous activities, you explored what a Continuous Integration and Continuous Delivery pipeline looks like, and you practiced placing security checks at various stages of an imaginary pipeline. You also adapted a secure pipeline to an e-comme...

THEORETICAL RECAP A CI/CD pipeline (Continuous Integration / Continuous Delivery) is an automated sequence of steps that takes source code from a developer's commit all the way to a production deployment. In a standard DevOps pipeline, the typical st...

THEORETICAL RECAP A CI/CD pipeline (Continuous Integration / Continuous Delivery) is the automated chain that takes source code from a developer's commit all the way to a running application in production. In a DevSecOps approach, security is not a f...

When we talk about a software delivery pipeline, we are referring to the full chain of automated steps that transforms source code written by developers into a running application available to end users. In a traditional DevOps approach, this chain i...

**Theoretical Recap** CI/CD stands for Continuous Integration and Continuous Delivery (or Deployment). It is the backbone of modern DevOps — and by extension, DevSecOps — workflows. Continuous Integration means that every time a developer pushes code...

Before diving into the world of security within development pipelines, it is essential to understand what DevOps is, why it was created, and how the concept of DevSecOps grew out of it. You have already explored the foundational pillars of cybersecur...