DevSecOps › Module 1 › Lesson 1
Why DevSecOps
DevSecOps literacy means shift-left security vocabulary, pipeline hygiene focus, and lab ethics on YOUR $DEVSEC_LAB repos — not scanning stranger orgs or weaponizing CI/CD against pipelines you do not own.
Visual · t36_why_devsecops
DevSec scope literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Security bolted on at release week fails — Cyberlium teaches DevSecOps vocabulary and lab ethics on repos YOU own, not pipeline abuse against orgs you do not operate.
DevSecOps integrates security into every software delivery stage — design, code, build, test, deploy, operate — so findings surface early when fixes are cheap. Developers and security engineers share vocabulary for SAST, secrets scanning, DAST, and IaC checks — not for running scanners against stranger GitHub orgs or third-party production URLs without authorization. Cyberlium Topic 36 teaches on $DEVSEC_LAB — YOUR personal repos, lab apps, and self-authored pipeline notes under $HOME/cyberlium-lab/t36-devsec/. You will name DevSecOps concepts and lab boundaries — never stranger-org scanning or unauthorized pipeline tampering. Next: Your Repos Only.
1. What DevSecOps covers (named)
DevSecOps includes shift-left testing, secure CI/CD configuration, secrets hygiene, dependency and container scanning, IaC policy checks, findings triage, and governance gates before merge. One hardened pipeline can catch ten vulnerability classes when scanners run on code you own.
Literacy means you can name these activities when reading a DevSecOps charter or job description — not that you can point SAST or DAST tools at stranger org repos or production URLs without authorization.
Command guide
Try these commands — What DevSecOps covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions NIST SSDF — https://csrc.nist.gov/Projects/ssdf (secure software development framework) CISA Secure by Design — https://www.cisa.gov/securebydesign Gitleaks — https://gitleaks.io/ (secret scanning literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('DevSecOps literacy: shift-left security on YOUR $HOME/cyberlium-lab/t36-devsec/ only')"
curl -sS https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions | head -10
curl -sS https://gitleaks.io/ | head -8Primary tools to practice this lesson: python3, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign); Gitleaks (https://gitleaks.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Who needs DevSecOps vocabulary
Developers wire security steps into GitHub Actions and merge gates. Security engineers define policy thresholds and triage findings. Platform teams govern runners, permissions, and artifact stores. Students practice scope and ethics on personal lab repos before touching employer production pipelines.
Cyberlium assumes YOU practice on $DEVSEC_LAB — personal Git repos, labeled lab web apps, self-authored workflow notes — not employer production pipelines without ticket scope or scanners against stranger organizations.
3. What this topic will never call practice
Scanning stranger GitHub orgs, running ZAP against third-party production sites, exfiltrating secrets from repos you do not own, tampering with CI/CD in orgs without authorization, or sharing live credential dumps in public chat.
Ship a sentence: Topic 36 here means secure delivery literacy on MY $DEVSEC_LAB with YOUR repos only. Next lesson: Your Repos Only.
4. What you ship: DevSecOps topic scope scoped to $DEVSEC_LAB literacy
Write literacy vs unauthorized scanning in one paragraph. Dest = $DEVSEC_LAB repos. NEVER stranger-org scans. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). Topic scope. Lab = $DEVSEC_LAB. NEVER stranger-org scans. Path: $HOME/cyberlium-lab/t36-m01-l01-why-devsecops.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run SAST against stranger org repo 'for DevSec learning.' Treat Topic 36 as a free pass to scan third-party pipelines.
Right
Define DevSecOps literacy and name $DEVSEC_LAB as the only practice surface. Next: Your Repos Only.
Mission: define Topic 36 for YOUR DevSec lab
1) Write literacy vs unauthorized scanning in one paragraph each. 2) Write a NEVER list (stranger-org scans, third-party URL DAST, unauthorized pipeline tampering). 3) Name $DEVSEC_LAB as your placeholder. Never aim scanners at repos or apps outside your scoped lab.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: what is DevSecOps?' — not how to scan stranger orgs.
Knowledge Check
APPLY: DevSecOps on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 36 includes stranger-org scanning guides.
True or False
Knowledge Check
APPLY: Primary output of this topic supports:
Multiple choice