Description

This curriculum spans the design and operationalisation of security testing practices across CI/CD pipelines, containerised environments, and global deployment workflows, comparable in scope to a multi-phase internal capability build for securing enterprise-scale release processes.

Module 1: Integrating Security Testing into CI/CD Pipelines

Decide where in the pipeline to insert static application security testing (SAST) without increasing build duration beyond acceptable thresholds.
Configure conditional execution of dynamic application security testing (DAST) based on code change scope and risk profile of modified components.
Select tooling that supports incremental scanning to avoid retesting unchanged code in pull request validation stages.
Implement fail-criteria for security gates that balance risk mitigation with developer productivity, including thresholds for critical vs. low-severity findings.
Isolate and manage credentials for security tools within the pipeline using secret management systems like Hashicorp Vault or AWS Secrets Manager.
Design pipeline rollback triggers that activate when post-deployment security scans detect regressions in previously resolved vulnerabilities.

Module 2: Threat Modeling for Deployment Artifacts

Conduct architecture-level threat modeling during sprint planning to identify high-risk components requiring additional security testing in deployment.
Map data flows in containerized applications to uncover insecure inter-service communication paths prior to staging deployment.
Document trust boundaries between microservices and define required security controls for each boundary in deployment manifests.
Update threat models when third-party dependencies are upgraded or replaced in the software supply chain.
Integrate threat model outputs into automated checklists enforced during environment promotion (e.g., dev → staging).
Assign ownership of threat model maintenance to system architects with formal review cycles before major releases.

Module 3: Securing Container and Orchestration Deployments

Enforce read-only root filesystems in production containers and evaluate impact on application logging and runtime behavior.
Configure Kubernetes pod security policies (or equivalent in newer clusters using Pod Security Admission) to restrict privileged containers.
Scan container images for known vulnerabilities and embedded secrets before pushing to private registries used in deployment.
Implement network policies to limit pod-to-pod communication based on service roles and zero-trust principles.
Rotate service account tokens and image pull secrets automatically and integrate rotation into deployment automation workflows.
Monitor for drift in deployed pod configurations and trigger reconciliation when runtime settings deviate from approved baselines.

Module 4: Managing Security Dependencies and Supply Chain Risks

Enforce approval workflows for introducing new open-source libraries with automated SBOM generation at build time.
Integrate software bill of materials (SBOM) validation into deployment gates to block versions with known critical CVEs.
Configure dependency scanning tools to detect indirect (transitive) dependencies and assess their exploitability in context.
Establish a process for evaluating and applying upstream security patches when direct fixes are not available.
Define policies for cryptographic library usage and detect unauthorized or deprecated algorithms in dependencies.
Coordinate with legal and procurement teams to ensure license compliance for open-source components in production artifacts.

Module 5: Runtime Protection and Post-Deployment Validation

Deploy host-based intrusion detection systems (HIDS) on production nodes and tune alerts to reduce false positives from legitimate deployments.
Instrument applications with runtime application self-protection (RASP) and evaluate performance overhead under peak load.
Conduct post-deployment DAST scans against staging environments that mirror production configuration and data masking rules.
Validate WAF rule sets after deployment to ensure coverage for newly introduced endpoints and API parameters.
Monitor for unexpected outbound connections from deployed services that may indicate command-and-control activity.
Compare baseline behavioral profiles of services before and after deployment to detect anomalous execution patterns.

Module 6: Security Governance and Compliance in Deployment Workflows

Define role-based access controls (RBAC) for deployment pipelines, ensuring segregation of duties between developers and approvers.
Log all deployment activities, including who triggered the release and which security checks were executed, for audit trail completeness.
Implement time-based deployment freezes for regulated environments during audit preparation or critical business periods.
Map deployment controls to compliance frameworks (e.g., SOC 2, ISO 27001) and generate evidence reports automatically.
Establish override procedures for security gates with mandatory justification and escalation to security leadership.
Conduct quarterly access reviews for pipeline maintainers and remove privileges for personnel no longer in relevant roles.

Module 7: Incident Response and Rollback Preparedness

Pre-define rollback procedures for each service, including database schema compatibility and data migration reversal steps.
Simulate security incident scenarios during release readiness reviews to validate detection and containment workflows.
Store deployment artifacts in versioned, immutable repositories with retention policies aligned to incident investigation needs.
Integrate deployment metadata with SIEM systems to correlate security alerts with recent code or configuration changes.
Document known vulnerabilities in released versions and communicate mitigation steps to operations and support teams.
Conduct blameless post-mortems for security incidents linked to deployment events and update controls based on findings.

Module 8: Scaling Security Testing Across Multi-Environment and Multi-Region Deployments

Replicate security testing configurations consistently across dev, staging, and production environments using infrastructure-as-code templates.
Adjust scan intensity and frequency based on environment sensitivity, with full scans in pre-production and targeted checks in production.
Coordinate time-zone-aware deployment schedules to ensure security teams are available during high-risk releases in global regions.
Handle data privacy constraints in regional deployments by masking or synthesizing PII in non-production environments used for testing.
Centralize security findings from distributed deployments into a single observability platform with tagging by region and environment.
Negotiate SLAs for security review turnaround in emergency patch deployments across different geographic operations centers.