What is DevSecOps
What is DevSecOps literacy names shared ownership, automated security gates, and continuous feedback — read DevSecOps pillars on YOUR $DEVSEC_LAB pipeline notes before production rollout.
Visual · t36_what_is_devsecops
DevSecOps definition literacy. $DEVSEC_LAB only. Original Cyberlium.
Security as a separate gate at the end fails delivery — literacy teaches DevSecOps pillars so pipeline hygiene starts on repos you document.
DevSecOps extends DevOps with security as a shared responsibility — developers fix findings early, security engineers codify policy, platform teams automate gates in CI/CD. Pillars include culture, automation, measurement, and sharing — scanners and policy checks run on YOUR repos at commit, build, and deploy stages. Cyberlium maps DevSecOps pillars on YOUR $DEVSEC_LAB — document fictional role assignments and gate points on paper. Next: Shift Left.
1. DevSecOps pillars (named)
Culture: shared ownership between dev, ops, and security. Automation: SAST, secrets, DAST, IaC scans in CI on YOUR repos. Measurement: findings metrics, mean time to remediate, gate pass rates. Sharing: knowledge bases, runbooks, and policy-as-code in version control.
On $DEVSEC_LAB, write pillar row — pillar, activity, artifact for one fictional pipeline.
Command guide
Try these commands — DevSecOps pillars (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why pillar literacy prevents bolt-on security
Security-only review at release creates bottlenecks and missed defects. Shift-left automation catches secrets and vulns when diffs are small. Mature programs document gates — which stage runs which scanner on which repo.
Students assign lab pillars on notes — production DevSecOps follows org charters and change control.
3. Lab boundary
Forbidden: treating DevSecOps as license for stranger-org scanning. Allowed: DevSecOps pillar card — four pillars with $DEVSEC_LAB fictional pipeline example.
Ship: DevSecOps pillar card for YOUR lab pipeline. Next: Shift Left.
4. What you ship: DevSecOps pillar card for $DEVSEC_LAB
Four pillars with gate artifacts. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. DevSecOps pillar card. $DEVSEC_LAB named. File t36-m02-l01-what-is-devsecops.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Scan stranger org because 'DevSecOps needs realism.' Skip automation pillar entirely.
- Right: Write DevSecOps pillar card for YOUR $DEVSEC_LAB. Next: Shift Left.
Mission: map DevSecOps pillars on YOUR lab
1) Define culture, automation, measurement, sharing in one sentence each. 2) Write one gate artifact per pillar. 3) Name which role owns policy thresholds. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Automation without measurement is noise — track gate pass rates on lab repos.
APPLY: DevSecOps on Cyberlium primarily:
APPLY: True or False: Automation pillar includes scanners in CI on code you own.
APPLY: DevSecOps literacy on Cyberlium uses: