DevSecOps › Module 9 › Lesson 4
Lab — Governance
Findings and governance lab on `$DEVSEC_LAB` — triage register, policy-as-code card, secure merge checklist bundled.
Visual · t36_governance_lab
Lab: governance pack on YOUR $DEVSEC_LAB. Original Cyberlium.
Opening
Ship governance artifacts from YOUR scan thread — triage, policy, merge gates — zero stranger org deploys or merge sabotage.
On YOUR `$DEVSEC_LAB` per brief: (1) scope proof — full scan thread Modules 6–8 labeled; (2) finding triage register Module 9-1; (3) policy-as-code card Module 9-2; (4) secure merge checklist Module 9-3; (5) governance loop diagram stub (finding → triage → policy → merge gate); (6) integrity — `$DEVSEC_LAB` only, no stranger org deploys, no merge sabotage, honest triage; (7) chmod 600 pack. Cross-link entire Topic 36 scan thread — professional governance handoff.
1. Lab deliverables
Triage + policy + merge cross-indexed — single governance thread.
Loop diagram links finding IDs to policy gates — accountability.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF RV.2 — https://csrc.nist.gov/Projects/ssdf Gitleaks — https://gitleaks.io/ Bridgecrew Checkov — https://www.checkov.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/findings/findings-lab-summary.md" <<'EOF'
# Findings Lab Summary — YOUR lab
- devsec-findings-template.md: structured finding format
- backlog.csv: prioritized remediation from YOUR scans
- pipeline-gate-policy.md: CI block/warn rules
## Sample findings seeded
- DEVSEC-FND-001..005 from intentional lab misconfigs
## Refusals
- No findings from stranger org scans
EOFCommand — copy this
grep -E 'DEVSEC-FND|backlog|Refusals' "$DEVSEC_LAB/findings/findings-lab-summary.md" grep DEVSEC-FND "$DEVSEC_LAB/findings/backlog.csv" | wc -l ls "$DEVSEC_LAB/findings/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/findings/backlog.csv | Select-String DEVSEC-FND
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF RV.2 (https://csrc.nist.gov/Projects/ssdf); Gitleaks (https://gitleaks.io/); Bridgecrew Checkov (https://www.checkov.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Exception process present in policy card — not optional.
Required checks list matches Modules 6–7 scan gates.
3. Teardown
Secure notes chmod 600; governance pack ready for capstone evidence index.
Archive stub optional per brief.
4. What you ship: governance lab pack
Triage + policy + merge + loop diagram + integrity — chmod 600.
5. What you record before the next lesson
Governance lab pack path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Governance lab includes merge sabotage recipe as bonus deliverable.
Right
Governance lab pack on `$DEVSEC_LAB`. Next: quiz.
Mission: governance lab
1) Scope and full scan thread proof. 2) Finding triage and policy card. 3) Secure merge checklist. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Governance loop diagram — minimum nodes?”
Knowledge Check
APPLY: Governance lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Merge sabotage earns governance lab credit.
True or False
Knowledge Check
APPLY: Governance lab pack should:
Multiple choice