Description

This curriculum spans the breadth of a multi-workshop security integration program, addressing the same technical and procedural challenges encountered when hardening enterprise CI/CD systems across distributed teams, hybrid environments, and regulatory audits.

Module 1: Threat Modeling in CI/CD Pipelines

Selecting and integrating threat modeling tools (e.g., Microsoft Threat Modeling Tool, OWASP Threat Dragon) into automated build workflows without introducing pipeline delays.
Defining ownership for updating threat models when new services or third-party integrations are introduced into the pipeline.
Deciding whether to fail builds based on newly identified threats or defer remediation to later stages with tracking.
Mapping data flows across pipeline stages to identify high-risk touchpoints such as artifact repositories and configuration stores.
Implementing dynamic threat model validation using policy-as-code frameworks like OPA to enforce architectural guardrails.
Coordinating threat model reviews between security, DevOps, and development teams on a defined cadence aligned with release cycles.
Handling discrepancies between assumed threat surfaces in design documents and actual runtime behaviors observed in staging environments.
Documenting and version-controlling threat model artifacts alongside infrastructure-as-code to maintain auditability.

Module 2: Securing Secrets Management at Scale

Evaluating trade-offs between centralized secrets managers (e.g., HashiCorp Vault, AWS Secrets Manager) and embedded solutions like Kubernetes Secrets with encryption providers.
Designing short-lived credential rotation policies for service accounts used in CI/CD jobs without disrupting pipeline reliability.
Implementing just-in-time (JIT) access to secrets with time-bound leases and audit logging for forensic readiness.
Handling fallback mechanisms when the primary secrets manager is unreachable during critical deployment windows.
Preventing accidental secret leakage through logs, screenshots, or misconfigured pipeline output by enforcing redaction at the agent level.
Integrating secrets scanning tools (e.g., GitGuardian, TruffleHog) into pre-commit and pull request workflows with tunable false positive thresholds.
Managing cross-region and cross-cloud secrets replication while complying with data residency requirements.
Defining recovery procedures for compromised secrets, including automated revocation and reissuance across dependent systems.

Module 3: Identity and Access Control in Automated Environments

Designing role-based access control (RBAC) policies for CI/CD service accounts that follow the principle of least privilege without over-segmenting workflows.
Integrating short-lived, cryptographically signed tokens (e.g., JWT, SPIFFE) for machine-to-machine authentication across pipeline stages.
Enforcing multi-person approval requirements for high-impact operations like production database schema changes or root key access.
Mapping human identities to automated actions via identity federation (e.g., GitHub OIDC with AWS IAM) to eliminate static credentials.
Implementing time-bound elevation workflows for break-glass access during incident response without creating permanent backdoors.
Auditing access decisions made by policy engines and correlating them with pipeline execution logs for compliance reporting.
Handling identity sprawl when multiple teams use overlapping toolchains with divergent authentication models.
Enforcing access revocation upon employee offboarding across all pipeline-related systems, including third-party SaaS tools.

Module 4: Secure Artifact Creation and Provenance

Implementing reproducible builds by pinning dependencies and toolchains, then verifying output consistency across environments.
Signing container images and binaries using cosign or Sigstore and enforcing signature verification in deployment gates.
Generating and storing Software Bill of Materials (SBOM) for each artifact using tools like Syft or ORAS, then validating completeness.
Integrating artifact provenance checks (e.g., SLSA Level 3+) into promotion workflows between staging and production.
Handling artifact rebuilds after security patches without breaking immutability guarantees or versioning schemes.
Enforcing artifact storage encryption and access controls in registries, including lifecycle policies for deletion and archival.
Resolving conflicts between development speed and artifact signing delays by pre-warming signing agents or batching operations.
Validating build environment integrity by attesting to clean, isolated runners before artifact generation.

Module 5: Runtime Protection in Deployment Workflows

Configuring runtime application self-protection (RASP) agents to detect anomalous behavior without introducing unacceptable latency.
Implementing immutable infrastructure patterns to prevent post-deployment configuration drift that bypasses security controls.
Enforcing network segmentation and egress filtering for containers at deployment time using CNI plugins or service mesh policies.
Integrating vulnerability scanning of running workloads into canary release checks with automated rollback triggers.
Managing exceptions for legacy applications that cannot support modern runtime protections due to compatibility constraints.
Correlating deployment events with runtime security alerts to reduce mean time to detection during breach investigations.
Deploying host-based intrusion detection systems (HIDS) on Kubernetes nodes with minimal performance impact.
Defining thresholds for automated containment actions (e.g., pod isolation) based on severity and confidence of detected threats.

Module 6: Logging, Monitoring, and Forensic Readiness

Designing log retention and indexing strategies that balance cost, compliance, and forensic search performance across distributed systems.
Enabling audit logging for critical services (e.g., Kubernetes API server, IAM, CI/CD platforms) with tamper-resistant storage.
Filtering and enriching pipeline and runtime logs to reduce noise while preserving forensic context for incident reconstruction.
Establishing log integrity controls such as cryptographic chaining or write-once storage to support legal admissibility.
Implementing log source authentication to prevent spoofing in multi-tenant or hybrid cloud environments.
Creating standardized playbooks for log collection during breach investigations across cloud, container, and on-prem systems.
Handling log data sovereignty by routing logs to region-specific collectors based on workload location and data classification.
Validating log pipeline reliability through synthetic transaction injection and automated gap detection.

Module 7: Incident Response in CI/CD Environments

Defining criteria for declaring a DevOps-related security incident, including unauthorized pipeline changes and secret exfiltration.
Isolating compromised build agents or runners without disrupting unrelated deployment workflows.
Preserving forensic artifacts such as build logs, container layers, and configuration snapshots before remediation.
Coordinating communication between security, DevOps, and legal teams during active breaches with predefined escalation paths.
Executing emergency pipeline freezes across multiple repositories while maintaining visibility into ongoing rollouts.
Rebuilding and reseeding CI/CD infrastructure from known-good configurations after compromise.
Conducting post-incident reviews to update detection rules, access policies, and pipeline hardening controls.
Integrating incident telemetry into threat intelligence platforms to improve future detection capabilities.

Module 8: Compliance and Audit in Automated Systems

Mapping automated controls in CI/CD pipelines to regulatory requirements such as SOC 2, HIPAA, or GDPR Article 32.
Generating audit-ready evidence packages that demonstrate control effectiveness without manual data aggregation.
Handling audit requests for access to pipeline logs and configurations while enforcing data minimization and privacy safeguards.
Implementing continuous compliance checks using policy-as-code to flag configuration drift from baseline standards.
Managing exceptions for temporary non-compliance during emergency fixes with automated expiration and review.
Integrating compliance scanning tools (e.g., Checkov, tfsec) into pull request workflows with override governance.
Documenting control ownership and accountability across DevOps, security, and compliance roles in hybrid teams.
Preparing for third-party audits by pre-validating evidence collection scripts and access provisioning procedures.

Module 9: Secure Collaboration Across Toolchains and Teams

Standardizing API contracts and webhook security between CI/CD tools from different vendors to prevent injection attacks.
Negotiating security requirements with external partners who contribute code or manage portions of the pipeline.
Enforcing consistent security policies across heterogeneous environments (e.g., on-prem Jenkins, cloud GitHub Actions).
Managing security debt in legacy pipelines that cannot be immediately modernized due to business continuity requirements.
Facilitating secure code handoffs between development and operations teams using gated merge and deployment approvals.
Resolving conflicts between development velocity and security gate enforcement through measurable risk acceptance workflows.
Implementing cross-team incident simulation exercises focused on DevOps breach scenarios.
Establishing shared metrics for security posture (e.g., mean time to detect, patch latency) to align incentives across teams.