DevSecOps › Module 6 › Lesson 3
Checkov Named
Checkov literacy — policy ID, framework mapping, scan command stub, fail/warn severity, baseline file — named Checkov rows on YOUR `$DEVSEC_LAB` stubs.
Visual · t36_checkov_named
Checkov = named scan literacy. $DEVSEC_LAB. Original Cyberlium.
Opening
Checkov scans YOUR Terraform — name policy IDs and severity rows on YOUR lab stubs, never weaponize scan output against stranger org pipelines.
Checkov named literacy names: policy ID row category (CKV_AWS literacy stub), framework mapping category (Terraform, CloudFormation literacy), scan command stub category, fail vs warn severity category, and baseline/suppression file category. Analyst documents Checkov scan card on `$DEVSEC_LAB` Terraform stub — command stub, three policy IDs from sample output, severity mapping — without running Checkov against stranger org repos, without publishing scan results to shame third parties, without pipeline sabotage using forged findings. Cyberlium teaches Checkov vocabulary on YOUR labeled notes — defender shift-left only. Refused: stranger org scans, forged findings, sabotage recipes. Lab row: Checkov scan card (command stub, three policy IDs, severity, baseline note).
1. Named Checkov rows
Policy ID, framework mapping, scan command, severity, baseline file — five literacy anchors.
Each policy ID cites YOUR lab stub output — not copied stranger org reports.
Command guide
Try these commands — Named Checkov rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Aqua Trivy action — https://github.com/aquasecurity/trivy-action NIST SSDF PO.3 — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
cat > "$DEVSEC_LAB/notes/ci-pipeline-wiring.md" <<'EOF'
# CI Pipeline Wiring — YOUR lab
## Stage order (fail fast)
1. secret-scan (gitleaks) — blocks credential leaks first
2. iac-scan (checkov) — catch misconfigs before deploy
3. container-scan (trivy fs) — Dockerfile + deps
## Gate policy stub
- FAIL on: gitleaks finding (non-FAKE), checkov CRITICAL, trivy CRITICAL
- WARN on: trivy HIGH — ticket in findings/backlog.csv
## Hardening reminders
- Pin action SHAs; least-privilege permissions block in security.yml
- Never store real secrets in GitHub — use OIDC or secret manager
EOFCommand — copy this
grep -E 'gitleaks|checkov|trivy|FAIL|SHA' "$DEVSEC_LAB/notes/ci-pipeline-wiring.md" grep -E 'secret-scan|iac-scan|container-scan' "$DEVSEC_REPO/.github/workflows/security.yml" curl -sS https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Aqua Trivy action (https://github.com/aquasecurity/trivy-action); NIST SSDF PO.3 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Severity discipline
Fail vs warn mapping documented — not all findings treated equal.
Baseline file literacy explains accepted risk on lab stub — not silent ignore.
3. Refused
No Checkov runs against stranger org repos; no forged findings; no pipeline sabotage.
Checkov literacy supports YOUR IaC hygiene — not offensive CI abuse.
4. What you ship: Checkov scan card
Command stub + three policy IDs + severity mapping + baseline note + NEVER stranger org scan line.
5. What you record before the next lesson
Checkov scan card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Checkov against stranger org public Terraform repo and publish results to 'expose' their misconfigs.
Right
Checkov scan card from `$DEVSEC_LAB` stub. Next: IaC Lab.
Mission: Checkov scan card
1) Name five Checkov literacy rows. 2) Scan command stub for lab Terraform. 3) Three policy IDs with severity each. 4) Write NEVER stranger org scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Baseline vs suppression — literacy split?”
Knowledge Check
APPLY: Checkov literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Publishing stranger org Checkov results is course lab.
True or False
Knowledge Check
APPLY: Checkov scan card includes:
Multiple choice