DevSecOps — The Complete Study Deck
A self-contained, 38-slide study companion to the 6-part DevSecOps tutorial: shift-left culture and threat modeling, SAST/DAST/SCA, container and Kubernetes hardening, secrets and IAM, CI/CD supply-chain security, and compliance frameworks — built to teach the topic on its own, not just jog the memory of someone who already read the course.
Slides
Make security everyone's job
Cover slide framing DevSecOps as continuous, shared, automated security instead of a single gate at the end of the pipeline.
Six modules, one continuous defense
Maps the six tutorial parts to six deck modules and shows the five-stage narrative arc connecting them.
Security stops being a gate at the end
Contrasts bolt-on, gate-based security review with continuous DevSecOps checks, and explains why the gate model breaks down at scale.
Shift-left: catch it while it's still cheap
Defines shift-left as moving security earlier on the SDLC timeline and grounds it in the cost-of-a-bug curve.
Think like an attacker, on purpose
Introduces the four-question threat modeling framework and the STRIDE checklist for structured threat brainstorming.
The cloud secures the cloud, you secure what's inside it
Explains the shared responsibility model and how the provider/customer line shifts across IaaS, PaaS, and SaaS.
Turn the policy PDF into an enforced rule
Shows security-as-code as a concrete practice — an OPA/Rego policy replacing a wiki page nobody reads, enforced automatically on every change.
Tooling alone doesn't make you DevSecOps
Names the three cultural pillars underneath the tooling and lays out a five-level maturity model for improving an org's security practice.
SAST, DAST, SCA: three different questions
Anchors the three core scanning categories to one question each — reading code, attacking a running app, or auditing borrowed code.
SAST reads your code without ever running it
Explains data-flow (taint) analysis, walks a Semgrep example, and names SAST's real limitations.
DAST attacks the running app like a real attacker would
Explains dynamic testing against a live environment, walks OWASP ZAP usage, and contrasts SAST vs DAST directly.
The vulnerability three packages deep
Introduces SCA and explains why transitive dependencies — not the libraries you directly chose — are the real risk.
CVSS tells you how bad, not whether it can reach you
Teaches CVE/CVSS severity scoring and the reachability nuance that determines real-world prioritization, plus IAST/RASP as related hybrid tools.
No single tool covers the whole OWASP Top 10
Surveys the OWASP Top 10 vulnerability categories, shows which tool category catches each, and lays out a cheap-to-expensive layered scanning pipeline.
A container image is more than your app
Explains why containers need dedicated image scanning beyond SAST/SCA, and walks Trivy usage.
Five changes separate a throwaway image from a liability
A before/after Dockerfile walkthrough showing the concrete hardening changes that matter most in practice.
A container is not a lightweight VM
Explains why container isolation is genuinely weaker than VM isolation, and introduces distroless images as an aggressive hardening technique.
Kubernetes adds a new set of who-can-do-what questions
Surveys the five Kubernetes security layers, then walks a full least-privilege RBAC example for a CI/CD ServiceAccount.
Kubernetes trusts every pod by default
Covers the three Pod Security Standards levels and explains why default-allow pod-to-pod networking is a real, commonly-tested gap.
Enforce it automatically, then watch for what slips through
Covers OPA Gatekeeper admission control and Falco runtime detection as complementary prevention and detection layers, plus a full Kubernetes security checklist.
One leaked secret bypasses every other control
Establishes why secrets deserve special attention, surveys what actually counts as a secret, and names the common failure patterns.
Catch it before the commit, know what to do if it leaks anyway
Covers pre-commit and CI secret scanning tools, plus the concrete step-by-step response when a secret leaks regardless.
Why environment variables aren't a secrets manager
Names the real limitations of environment-variable secrets and walks HashiCorp Vault's authenticate-then-authorize architecture.
Every app instance gets its own credential, and it expires on its own
Covers Vault's dynamic secrets as its signature feature, and explains envelope encryption's two-layer key design.
Long-lived keys are a secret you have to store somewhere
Applies least privilege to cloud IAM with a before/after policy example, and explains why workload identity beats static access keys.
Something has to be the first credential
Names the secret-zero problem, resolves it with platform-vouched identity via OIDC, and generalizes to multi-pipeline secret governance.
Why attack a thousand customers when you can attack one build system
Reframes the CI/CD pipeline itself as an attack target and walks the SolarWinds build-system compromise as the canonical example.
A misconfigured trigger can hand your secrets to a stranger's fork
Applies STRIDE to the CI/CD pipeline itself and walks the real 'pwn request' pattern in detail.
A mutable version tag is a promise the maintainer can break
Covers pipeline hardening fundamentals and the specific, real risk of unpinned third-party CI actions, grounded in a 2024 incident.
Scan the infrastructure definition before it's ever provisioned
Covers IaC scanning with tfsec/Checkov and maps the complete software supply chain to show every stage as a potential attack point.
Know exactly what's inside, prove exactly where it came from
Covers SBOM generation, artifact signing with cosign/Sigstore, and the SLSA supply-chain maturity framework.
One diagram, every module, in the order it runs
Assembles the entire course into one end-to-end secure pipeline blueprint, and surveys real-world supply chain attacks beyond SolarWinds.
Passing an audit is not the same as being secure
Distinguishes compliance from security as separate goals, and covers SOC 2's Trust Service Criteria plus the Type I vs Type II distinction.
ISO 27001 asks for a system, PCI-DSS asks for specific controls
Contrasts ISO 27001's risk-management-system approach with PCI-DSS's fixed requirements, and teaches network segmentation as a PCI scope-reduction strategy.
Compliance is largely DevSecOps, formalized
Contrasts GDPR and HIPAA at a glance, then consolidates the entire course into one table mapping practices to the compliance controls they satisfy.
Every tool from this course, in one place
A consolidated reference of every tool and category covered across the six modules, plus the one-line commands worth remembering.
Sixty seconds before the interview
A rapid-recall grid for STRIDE, the OWASP Top 10, and SLSA levels, plus a quick-fire question and answer pairing drawn from across the course.
What you should be able to explain now
Closes the deck with a study checklist synthesizing all six modules into the course's single most important takeaway.