DevSecOps › Module 2 › Lesson 1
What is DevSecOps
What is DevSecOps literacy names shared ownership, automated security gates, and continuous feedback — read DevSecOps pillars on YOUR $DEVSEC_LAB pipeline notes before production rollout.
Visual · t36_what_is_devsecops
DevSecOps definition literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Security as a separate gate at the end fails delivery — literacy teaches DevSecOps pillars so pipeline hygiene starts on repos you document.
DevSecOps extends DevOps with security as a shared responsibility — developers fix findings early, security engineers codify policy, platform teams automate gates in CI/CD. Pillars include culture, automation, measurement, and sharing — scanners and policy checks run on YOUR repos at commit, build, and deploy stages. Cyberlium maps DevSecOps pillars on YOUR $DEVSEC_LAB — document fictional role assignments and gate points on paper. Next: Shift Left.
1. DevSecOps pillars (named)
Culture: shared ownership between dev, ops, and security. Automation: SAST, secrets, DAST, IaC scans in CI on YOUR repos. Measurement: findings metrics, mean time to remediate, gate pass rates. Sharing: knowledge bases, runbooks, and policy-as-code in version control.
On $DEVSEC_LAB, write pillar row — pillar, activity, artifact for one fictional pipeline.
Command guide
Try these commands — DevSecOps pillars (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/Projects/ssdf CISA Secure by Design — https://www.cisa.gov/securebydesign GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://csrc.nist.gov/Projects/ssdf | head -10
cat > "$DEVSEC_LAB/notes/devsecops-shift-left.txt" <<'EOF'
DevSecOps / shift-left — NAMED LITERACY:
Traditional: security gate at release — late, expensive fixes
DevSecOps: embed security in design, code, build, deploy — continuous feedback
Shift-left: find secrets, misconfigs, vulns in PR/CI — not prod incident
Pillars: culture + automation + measurement + sharing
Lab: automate gitleaks/checkov/trivy on YOUR sample-repo — no stranger orgs
EOFCommand — copy this
grep -E 'Shift-left|DevSecOps|stranger' "$DEVSEC_LAB/notes/devsecops-shift-left.txt" curl -sS https://www.cisa.gov/securebydesign | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why pillar literacy prevents bolt-on security
Security-only review at release creates bottlenecks and missed defects. Shift-left automation catches secrets and vulns when diffs are small. Mature programs document gates — which stage runs which scanner on which repo.
Students assign lab pillars on notes — production DevSecOps follows org charters and change control.
3. Lab boundary
Forbidden: treating DevSecOps as license for stranger-org scanning. Allowed: DevSecOps pillar card — four pillars with $DEVSEC_LAB fictional pipeline example.
Ship: DevSecOps pillar card for YOUR lab pipeline. Next: Shift Left.
4. What you ship: DevSecOps pillar card for $DEVSEC_LAB
Four pillars with gate artifacts. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. DevSecOps pillar card. $DEVSEC_LAB named. File t36-m02-l01-what-is-devsecops.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scan stranger org because 'DevSecOps needs realism.' Skip automation pillar entirely.
Right
Write DevSecOps pillar card for YOUR $DEVSEC_LAB. Next: Shift Left.
Mission: map DevSecOps pillars on YOUR lab
1) Define culture, automation, measurement, sharing in one sentence each. 2) Write one gate artifact per pillar. 3) Name which role owns policy thresholds. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Automation without measurement is noise — track gate pass rates on lab repos.
Knowledge Check
APPLY: DevSecOps on Cyberlium primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Automation pillar includes scanners in CI on code you own.
True or False
Knowledge Check
APPLY: DevSecOps literacy on Cyberlium uses:
Multiple choice