SecDevOps Foundation® (SDOF) Certification Training

Secure DevOps (SecDevOps) represents the evolution of DevOps toward a security-first software engineering approach. Building upon guidance from the U.S. Department of Homeland Security (DHS), the NIST Secure Software Development Framework (SSDF), and modern DevOps practices, SecDevOps integrates security throughout the entire software lifecycle—including today's AI-enabled applications.

 Consequently, SecDevOps has become the “go to” methodology for organizations writing high-assurance programs, especially for government agencies, defense contractors, financial institutions, healthcare organizations, critical infrastructure providers, and any organization developing security-sensitive software. It provides an excellent operational framework for implementing the guidance contained within the NIST Secure Software Development Framework (SSDF), for traditional software systems, AI-enabled applications, and software that incorporates generative AI components.

 Through realistic case studies and hands-on exercises, you will learn to evaluate existing software development practices, identify security gaps, improve DevOps pipelines, integrate NIST SSDF guidance, and apply Secure DevOps principles to both traditional software and AI-enabled systems.

 This certification training course will help you prepare for and successfully attain the highly respected SecDevOps Foundation (SDOF) certification. In this course, you will discover: 

• The benefits, concepts, processes and vocabulary of SecDevOps to deliver secure software while maintaining Agile speed, flexibility, and quality.
• How SecDevOps extends Agile and DevOps for CI/CD/CC - Continuous Integration, Continuous Delivery, Continuous Compliance.
• How the guidance of the NIST Secure Software Development Framework integrates naturally to complement SecDevOps practices.
• Which organizational culture and individual mindset changes are best to maximize success securing traditional and AI applications.
• How to plan, design and use a pipeline to test and automate the testing, deployment, security validation, and monitoring of production environments.
• How modern threat modeling, secure design, vulnerability management, and automated security testing work together throughout the software lifecycle.

SecDevOps Foundation® (SDOF) Certification Training Benefits

• In this SecDevOps Foundation Course, you will learn how to:

  • Prepare for official SecDevOps Foundational certification (SDOF) from the DevOps Institute by PeopleCert.
  • Throughout the course, students complete numerous hands-on activities using modern DevOps tools, secure development pipelines, threat modeling techniques, vulnerability analysis, and collaborative team exercises
  • Leverage the NIST Secure Software Development Framework to guide the security practices of SecDevOps for both traditional and AI applications.
  • Establish continuous improvement practices to face new or unanticipated challenges

• Prerequisites

  None.

• SecDevOps Foundation Certification Details

  • The 60-minute certification exam is open-book and taken online after the course delivery has finished. An exam voucher is included in the course tuition.
  • The certification exam is administered through the DevOps Institute by PeopleCert.

SecDevOps Foundation Training Outline

Learning Objectives

Module 1: SecDevOps Context

• Megatrends and Context
• CALM Principles
• The 3 Ways 

Module 2: Foundations of Secure DevOps

• Iterative and incremental
• From Scrum to SecDevOps
• Automated testing for TDD and ATDD
• Activity: Create secure password scenarios using BDD
• Key principles and security-first philosophy 
• SecDevOps guidance from the NIST SSDF
• Exercise: SecDevOps and NIST SSDF synergy

Module 3: Secure DevOps Pipeline and Toolchain

• Continuous Integration, Delivery, Deployment and Compliance
• SecDevOps lifecycle and the Pipeline
• Pipeline for development
• Pipeline for operations (Configuration as Code)
• Activity: Using a Vulnerability Scanner, Hands-On
• Cloud, containers and security integration
• Pipeline maturity and planning
• Pipeline and other development tools
• Activity: Planning Pipeline Security Testing
• Using Source Repositories Git, GitLab, GitHub
• Branching strategies, merge conflicts, and secure pull requests
• Activity: Running a Secure CI/CD/CC Pipeline, Hands-On

Module 4: Risk, Vulnerabilities and Threats

• Risk assessment – key goal
• Cyber intelligence (know the enemy)
• Threat and Vulnerability Catalogs
• Activity: SQL Injection Example, Hands-On
• Threat modeling (STRIDE, OCTAVE and the PASTA process)
• Activity: Threat Modeling, Gamification
• Gathering threat and vulnerability metrics
• Activity: Quantitative Scoring of Vulnerabilities (CVSS), Hands-On

Module 5: Culture Change and Leadership Mindset

• What is good culture?
• Culture assessment models – safe, trustworthy and empowering
• Activity: Identifying and improving your organization’s culture, video review
• Leadership Mindset – Fixed or Growth
• Scaling Secure DevOps (SAFe, Platform Engineering, and SRE)
• Personnel, stakeholders and the team
• Homework: Mindset self-evaluation spreadsheet (optional)

Module 6: Best Practices for SecDevOps

• Planning with a vision – start from where you are
• Measuring your organization’s SecDevOps maturity
• Exercise: SecDevOps Implementation Stages, survey
• AI-assisted development and secure use of generative AI
• Security considerations for AI-generated software

1. Embracing and enabling organization-level governance

• Why care about GRC? 
• Rethinking policies - policy as code
• Building a responsive model
• Deploying immutable infrastructure
• Ongoing monitoring and evaluation
• Activity: Intrusion Detection, hands-on

Module 7: Continuous Learning

• Experiential learning
• Retrospective learning
• Continual improvement
• Learning sources

Module 8: Review and Summary

• Exam review
• Key course concepts
• Next steps