DevSecOps › Module 2 › Lesson 4
Lab — Fundamentals
Pack DevSecOps pillars, shift-left, and pipeline stages cards — fundamentals file from $DEVSEC_LAB only.
Visual · t36_fundamentals_lab
Lab: DevSecOps fundamentals pack. $DEVSEC_LAB only. Original Cyberlium.
Opening
Fundamentals pack merges pillars to shift-left to stages — paperwork before pipeline security module.
Lessons 2-1–2-3 named DevSecOps pillars, shift left, and pipeline stages. This lab merges three cards into one $DEVSEC_LAB fundamentals artifact with M1 ethics cross-reference. No stranger-org scans or third-party URL work — DevSecOps fundamentals paperwork only. Next: Quiz — DevSecOps Fundamentals.
1. Lab contract: DevSecOps fundamentals pack
Create $HOME/cyberlium-lab/t36-m02-l04-fundamentals-lab.txt merging pillars, shift-left, and pipeline stages sections with $DEVSEC_LAB fictional workflow and M1 ethics cross-reference.
Optional: one-line note which fictional lab app URL you used — lab labels only.
Command guide
Try these commands — Lab contract: DevSecOps fundamentals pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/Projects/ssdf CISA Secure by Design — https://www.cisa.gov/securebydesign GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/concepts-lab-summary.md" <<'EOF'
# DevSecOps Concepts Lab Summary — YOUR lab
- devsecops-shift-left.txt: culture + automation literacy
- ssdf-practices.md: NIST SSDF PO/PS/PW/RV mapping
- pipeline-security-stages.txt: CI/CD tool placement
## Integrity
- Scan YOUR repo only — no stranger GitHub orgs
- Prefer markdown stubs when tools not installed
EOFCommand — copy this
grep -E 'SSDF|Integrity|stranger' "$DEVSEC_LAB/notes/concepts-lab-summary.md"
grep NEVER "$DEVSEC_LAB/notes/no-stranger-scans.txt" "$DEVSEC_LAB/roe.txt"
python3 -c "print('Concepts lab: shift-left + SSDF + pipeline stages complete')"═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/notes/ssdf-practices.md | Select-String PW
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal boundaries
Grep pack for stranger-org scan refs, third-party URL DAST, live credential dumps — redact or delete. Pack stays documentary literacy.
Update pack if you rename lab repos — note new fictional labels.
3. Lock the proof
chmod 600 on the pack. Quiz next — then GitHub Actions Hygiene.
DevSecOps fundamentals literacy feeds pipeline security lessons in M3.
4. What you ship: DevSecOps fundamentals pack for $DEVSEC_LAB
Merged pillars, shift-left, stages sections. $DEVSEC_LAB named. NO stranger pipelines. chmod 600.
5. What you record before the next lesson
Date. Fundamentals pack path. $DEVSEC_LAB named. File t36-m02-l04-fundamentals-lab.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include stranger-org scan steps in pack. Skip shift-left section.
Right
Write YOUR DevSecOps fundamentals pack for $DEVSEC_LAB. chmod 600. Next: Quiz — DevSecOps Fundamentals.
Mission: freeze YOUR DevSecOps fundamentals pack
1) Merge M2 literacy sections. 2) Confirm zero stranger-org or third-party URL refs. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed fundamentals pack beats ten unauthorized scan screenshots.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Fundamentals pack should reference $DEVSEC_LAB fictional lab repos.
True or False
Knowledge Check
APPLY: Fundamentals pack should include:
Multiple choice