CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications

In the previous activities, you learned the essential vocabulary of security: asset, threat, vulnerability, and risk. You also practiced locating assets inside a simple application such as a Todo List. Now we build on that foundation with the single ...

THEORETICAL RECAP In threat modeling, an 'asset' is anything of value that an attacker might want to steal, alter, destroy, or misuse — and that you must therefore protect. Assets are not only files or databases; they include data (user credentials, ...

Welcome to the first true building block of application security. Before you can defend an application, run a penetration test, or set up a secure delivery pipeline, you must master a small set of words used every single day by security professionals...

Welcome to the chapter on Application Security Principles and Threat Modeling. This chapter is the foundation of the entire training path that will turn you into a CyberSecurity and DevSecOps professional. Before you learn how to attack applications,...

This chapter closes the module dedicated to advanced Linux for security. You have travelled a long way: from user and group management, sudoer configuration, and the creation of restricted accounts, to writing executable scripts scheduled with cron, ...

## Project Overview In this mini-project, you will apply a complete security hardening checklist to a Linux virtual machine (VM) in a lab environment. This project consolidates every skill covered in the 'Linux advanced for security' chapter: user an...

Hardening a Linux system means reducing its attack surface and configuring it so that it resists attacks as much as possible. Until now you have written scripts, managed users and sudoers, configured logging, and audited authentication logs. Hardenin...

THEORETICAL RECAP On Debian-based Linux systems, /var/log/auth.log records authentication and authorization events: SSH connections (successful and failed), sudo invocations, su attempts, PAM messages, and session open/close events. On RHEL-based sys...

Logging and auditing are the backbone of security operations on a Linux system. Logs are the recorded traces of what happens on a machine: services starting and stopping, users logging in, commands executed with elevated privileges, failed authentica...

THEORETICAL RECAP On Linux, every process runs with the privileges of a user and its groups. The principle of least privilege dictates that an account should hold only the permissions strictly required for its tasks—nothing more. A pentester frequent...

Advanced user and sudoer management is a cornerstone of Linux security. On a Linux system, every process and every file is tied to an identity. Understanding how users, groups, and privilege elevation work allows you to reduce the attack surface, app...

THEORETICAL RECAP A Bash script is just a text file until you grant it execute permission and provide an interpreter. The shebang line (#!/bin/bash) on the first line tells the system which interpreter to use. Permissions are managed with chmod: chmo...

Scripting is one of the most powerful tools a security professional has. A well-written Bash or Python script can automate reconnaissance, parse thousands of log lines, back up critical files, or orchestrate a deployment. But a poorly written script ...

THEORETICAL RECAP The /etc directory is the heart of Linux system configuration. It contains critical files: user accounts (/etc/passwd, /etc/shadow), network settings, service configurations, firewall rules, and repository definitions you manipulate...

Bash (Bourne Again Shell) is the default command interpreter on most Linux distributions. Writing scripts in Bash allows you to automate repetitive tasks, chain together the network and system tools you have already studied (ip, ss, nmap, apt, system...

On a Linux system, software is installed and updated through package managers such as apt (Debian, Ubuntu) or yum/dnf (Red Hat, CentOS, Fedora). These package managers download software from repositories. A repository is a server that hosts packages ...

THEORETICAL RECAP Before any penetration test or network analysis, you need a reconnaissance toolkit. Two tools are foundational: nmap and Wireshark. Nmap (Network Mapper) is an active scanner: it sends crafted packets to hosts to discover live machi...

Package management is one of the most important skills for anyone administering or securing a Linux system. A package is a compressed archive that contains a program, its libraries, configuration files, and metadata describing what the software needs...

THEORETICAL RECAP Documenting network status means capturing a reliable snapshot of what your Linux host exposes and communicates on the network at a given moment. The core mental model is a layered inventory: interfaces (link and IP configuration), ...

THEORETICAL RECAP A network interface is a connection point between your machine and a network. On Linux, interfaces such as 'lo' (loopback, 127.0.0.1), 'eth0' or 'enp0s3' (wired), and 'wlan0' (wireless) each carry one or more IP addresses. A port is...

In the previous chapters you learned to manage processes, signals, and services with systemd. A running service almost always listens on the network, so the next logical step is to inspect the local network configuration and the network activity of y...

When a Linux service fails to start, crashes unexpectedly, or behaves in an unexpected way, you need a systematic method to diagnose the problem. On modern Linux distributions, services are managed by systemd, and their logs are collected by a compon...

THEORETICAL RECAP On modern Linux systems, systemd is the init system and service manager (PID 1). A 'service' is a unit described by a unit file (usually ending in .service) located under /lib/systemd/system/ or /etc/systemd/system/. The core mental...

After learning to manage processes, permissions, and signals, the next step is to understand how a modern Linux system starts, supervises, and stops the services that run in the background. On most current distributions (Debian, Ubuntu, Red Hat, Cent...

THEORETICAL RECAP A signal is an asynchronous software interrupt sent to a process by the kernel, another process, or the user. It tells the process something happened and, unless caught or ignored, triggers a default action. Each signal has a name a...