CURRICULUM

Prerequisites

Basic Linux skills (Bash scripting, start/stop service, create a user, basis sysadmin)
Basic Ruby/Rails (install Ruby, Rails, Gems, write basic Ruby scripts)
Networking Basics (common network protocols & ports)

Syllabus Outline

Week 1: Getting Started

Introductions
What is DevSecOps?
Lab Guides

Week 2: Build a Weak App

Ruby
Rails
Bash Scripting
AWS CLI
AWS SDK
Basic AWS Deployment

Week 3: Attack the Weakling

Deploy vulnerable app to AWS.
Attack the app using different techniques (e.g. OWASP Top 10)
Tools of the trade:
- Nmap
- Metasploit
- SQLMap

Week 4: Keeping the Weak Alive

Learn tools to detect attacks, instrument app to detect attacks
Execute Incident response (contain / burn it down)
Keep the app alive (tension of burn-down the compromised one vs service availability)
Splunk / Log collection
Application Logs

Week 5: Build a Rugged App

Developing for Resilience.
Service Oriented Architecture (SOA).
Stacker
Gauntlt
AutoScale
Least Privileges (IAM, OS hardening, run the app as a non-priv user)
CloudWatch
Control-Plane Pattern

Week 6: Red FTW!

Account Takeover
Privilege escalation
Horizontal movement
Bad patterns (VPN, network layer coupling, tight coupling, etc)

Week 7: Hunt the Attacker

Selfie
Splunk alerts
Incident response in AWS, respond faster

Week 8: Capstone Project

Capstone Project

Hack lab – build an infrastructure from a template, make it better on the fly, keep it alive while others attack it and while attacking others (Capture the Flag).

Week 9: Demos!

Demos