CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications
This podcast presents the content of a CyberSecurity & DevSecOps course, aimed at developers and security professionals. It covers understanding application risks, performing authorized web and API penetration tests, and identifying major vulnerabilities such as authentication failures, access control issues, injections, and CSRF. Listeners are introduced to tools like Nmap, Wireshark, Metasploit, and Python scripting, and to the process of fixing flaws and setting up regression tests. Later episodes focus on producing vulnerability reports and building a secure delivery chain with CI/CD, SAST, DAST, SCA, and container security.
Episodi
Welcome, objectives and chapter journey
Welcome to the course 'CyberSecurity and DevSecOps Expert: Develop, Pentest, and Deploy Secure Applications'. This introductory chapter is your starting point. Before diving into technical tools, attack techniques, or secure deployment pipelines, it ...
Essential vocabulary: security, threat, vulnerability, risk
Welcome to this first foundational lesson. Before diving into technical tools, penetration testing techniques, or secure development practices, you need to master the vocabulary that structures all of cybersecurity. These words — security, threat, vu...
Guided workshop: associate each term with a concrete case
**Theoretical Recap** Before diving into the workshop, let's consolidate the four core vocabulary terms you encountered in the previous lesson. A **threat** is any potential event or actor that could cause harm to a system — for example, a hacker att...
The CIA pillars: confidentiality, integrity, availability
Before diving into the technical world of cybersecurity and secure application development, every professional in this field must internalize a fundamental framework: the three pillars known as the CIA triad. These three pillars are Confidentiality, ...
Guided workshop: identifying the CIA pillar under threat
**Theoretical Recap** Before diving into the workshop, let's consolidate the essential framework you need. The CIA Triad is the cornerstone model of information security, composed of three pillars: Confidentiality, Integrity, and Availability. Confid...
Variation workshop: creating your own threat examples
THEORETICAL RECAP Before diving into the workshop, let's consolidate what you have covered so far. Four core concepts form the backbone of cybersecurity thinking: security (the overall state of protection of systems and data), threat (any potential e...
Common web threats presented simply
In the previous activities, you built a solid foundation: you mastered the core vocabulary of cybersecurity (security, threat, vulnerability, risk), and you explored the three fundamental pillars that any security approach must protect: confidentiali...
Guided workshop: recognize the threat on a screenshot
**Theoretical Recap** Before diving into the workshop, let's consolidate what you have covered so far. In cybersecurity, a threat is any potential event or action that could exploit a vulnerability to cause harm to an information system. A vulnerabil...
Intermediate visual summary: mental map of concepts
At this stage of your learning journey, you have covered a significant amount of foundational material. You have explored the core vocabulary of cybersecurity, discovered the three pillars known as the CIA triad, and encountered the most common web t...
Introduction to DevOps and the DevSecOps concept
Before diving into the world of security within development pipelines, it is essential to understand what DevOps is, why it was created, and how the concept of DevSecOps grew out of it. You have already explored the foundational pillars of cybersecur...
Guided workshop: visualizing a simplified CI/CD pipeline
**Theoretical Recap** CI/CD stands for Continuous Integration and Continuous Delivery (or Deployment). It is the backbone of modern DevOps — and by extension, DevSecOps — workflows. Continuous Integration means that every time a developer pushes code...
The role of safety at every stage of the pipeline
When we talk about a software delivery pipeline, we are referring to the full chain of automated steps that transforms source code written by developers into a running application available to end users. In a traditional DevOps approach, this chain i...
Guided workshop: placing security checks in an imaginary pipeline
THEORETICAL RECAP A CI/CD pipeline (Continuous Integration / Continuous Delivery) is the automated chain that takes source code from a developer's commit all the way to a running application in production. In a DevSecOps approach, security is not a f...
Variation workshop: adapting a secure pipeline to an e-commerce project
THEORETICAL RECAP A CI/CD pipeline (Continuous Integration / Continuous Delivery) is an automated sequence of steps that takes source code from a developer's commit all the way to a production deployment. In a standard DevOps pipeline, the typical st...
Pipeline checkpoints and artifacts
In the previous activities, you explored what a Continuous Integration and Continuous Delivery pipeline looks like, and you practiced placing security checks at various stages of an imaginary pipeline. You also adapted a secure pipeline to an e-comme...
Storyboard: Incident avoided with DevSecOps
Introduction: Why a storyboard approach? Throughout the previous activities, you have explored what DevSecOps means, how a Continuous Integration and Continuous Delivery pipeline works, where security checks fit in at each stage, and how artifacts an...
mini-project: writing a security-oriented user story
## Mini-Project: Writing a Security-Oriented User Story ### Project Overview Building on your understanding of DevSecOps principles, the CI/CD pipeline, and the CIA triad, this mini-project challenges you to write a complete set of security-oriented ...
Entry ramp summary and personal checklist
You have now completed the introductory section of this course on CyberSecurity and DevSecOps. Before moving on to more technical and specialized content, this chapter serves a double purpose: consolidating everything you have learned so far and givi...
Prepare your secure test environment (VM, accounts, browser)
Before performing any security test, penetration test, or vulnerability analysis, you must set up a dedicated, isolated, and controlled environment. This is not optional. Working directly on your personal machine, using your real accounts, or testing...
Workshop: installing and verifying the lab virtual machine
**Theoretical Recap** A virtual machine (VM) is a software emulation of a physical computer. It runs an operating system and applications in an isolated environment, completely separated from your host system. This isolation is fundamental in cyberse...
Very high level introduction to Git as the foundation of the pipeline
Git is a version control system. That means it is a tool that tracks every change made to a set of files over time. If you write code, modify a configuration file, or update a script, Git records what changed, when it changed, and who made the change...
Workshop: first Git manipulations (clone, commit)
THEORETICAL RECAP Git is a distributed version control system that tracks changes in files over time. Every project managed with Git lives inside a repository (repo), which stores the full history of modifications. Understanding a few core concepts i...
Git and traceability: history at the service of security
Git is far more than a simple tool for saving code. When used correctly, it becomes a genuine security instrument, allowing teams to track every change, identify the origin of a vulnerability, and respond quickly to incidents. This course builds dire...
Workshop: simulating a committed secret and correcting it
**Theoretical Recap** In the world of DevSecOps, one of the most common and dangerous mistakes a developer can make is accidentally committing a secret — a password, an API key, a database connection string, a private token — directly into a Git repo...
Secure branch policies: key concepts
When you work in a team on a software project, or even alone with a professional pipeline in mind, the way you organize your branches in Git is not a trivial matter. Branches are not just a convenience for parallel development: they are a critical se...
Workshop: setting up a basic pre-commit rule
**Theoretical Recap** A pre-commit hook is a script that Git executes automatically before finalizing a commit. It acts as a last-line-of-defence gate: if the script exits with a non-zero code, the commit is rejected and the developer is forced to fi...
Printable memo sheet: minimal secure pipeline
This memo sheet is designed to consolidate everything you have learned so far into a single, clear, and actionable reference. You have already explored Git fundamentals, branch policies, pre-commit hooks, security concepts such as Confidentiality, In...
Overview of the OWASP Top 10
Before diving into penetration testing techniques or setting up a secure delivery pipeline, every cybersecurity practitioner must understand what they are actually protecting against. The OWASP Top 10 is the most widely recognized reference in web ap...
Workshop: mapping the OWASP Top 10 on the pipeline
**Theoretical Recap** The OWASP Top 10 is a regularly updated reference document listing the ten most critical web application security risks. It is not a checklist to mechanically tick off, but a risk map that helps teams prioritize where to focus t...
The three shifts: Shift-Left, Shift-Right, Feedback Loop
Security in software development has undergone a profound transformation over the past two decades. Traditionally, security was treated as a final checkpoint: developers would write code, assemble an application, and only at the very end would a secu...
Workshop: placing security tests into an existing workflow
**Theoretical Recap** Integrating security tests into an existing CI/CD workflow is the operational heart of DevSecOps. The core principle is simple: security checks must not be an afterthought bolted onto the end of a pipeline — they must be embedde...
Mini-project: create a YAML mini-pipeline with commented security steps
## Project Overview This mini-project is the capstone activity of the INTRO chapter. Having covered Git security policies, pre-commit hooks, OWASP Top 10, CIA triad, Shift-Left/Shift-Right/Feedback Loop principles, and pipeline security mapping, you ...
Step-by-Step Guide: Pre-commit Checklist
A pre-commit checklist is a structured list of security and quality checks that every developer must run — or that are automatically triggered — before any piece of code is officially committed to a shared version control repository such as Git. The ...
Reading a fictional vulnerability report: structure and terminology
Understanding how to read a vulnerability report is a foundational skill for anyone entering the field of cybersecurity or DevSecOps. Whether you are reviewing a report produced by a penetration tester, an automated scanning tool, or a security team,...
Workshop: extracting key information from the report
**Theoretical Recap** A vulnerability report is a structured document that communicates security findings to both technical and non-technical stakeholders. Understanding how to read and extract key information from such a report is a foundational ski...
Workshop: Writing a micro-report on an imaginary bug
THEORETICAL RECAP A vulnerability report is the primary deliverable of any security assessment. It transforms technical findings into actionable intelligence for developers, managers, and security teams. A well-structured report answers four essentia...
General summary and opening to the next chapter
Congratulations on reaching the end of the introductory chapter of this course. Before moving forward, it is essential to consolidate everything you have learned so far and to understand how it connects to what lies ahead. This summary is not simply ...
Welcome and chapter goals
Welcome to the chapter on Fundamentals of OSI Networks, Protocols, and Models. This chapter is your essential starting point before diving into any cybersecurity or DevSecOps practice. Whether you are aiming to conduct penetration tests, identify vul...
Basic vocabulary of a network (host, link, packet)
Understanding how networks work is the foundation of cybersecurity. Before diving into attack techniques, penetration testing tools, or secure deployment pipelines, you need to be fluent in the basic vocabulary that describes what a network is and ho...
Map your home network
**Theoretical Recap** Before diving into the workshop, let's consolidate the core concepts you've encountered so far. A network is made up of hosts (any device with an IP address: computer, smartphone, printer, router, smart TV), links (the physical ...
IP address and packet concepts
Now that you are familiar with the basic vocabulary of networks — hosts, links, and packets — it is time to go deeper into two fundamental concepts that underpin virtually every communication on the internet and on private networks: the Internet Prot...
Observe an ICMP packet with ping
**Theoretical Recap** ICMP (Internet Control Message Protocol) is a network-layer protocol (OSI Layer 3) used primarily for diagnostic and error-reporting purposes. Unlike TCP or UDP, ICMP does not carry application data — it carries control messages...
Associate IP addresses with equipment
**Theoretical Recap** An IP address (Internet Protocol address) is a unique numerical identifier assigned to every device connected to a network. IPv4 addresses are written in dotted-decimal notation (e.g., 192.168.1.1), composed of four octets rangi...
Topology concept, switch vs router
Before diving into the differences between a switch and a router, it is essential to understand what a network topology is and why it matters for anyone working in cybersecurity or DevSecOps. A network topology describes the physical or logical arran...
Visualize a network flow with an online simulator
**Theoretical Recap** Before diving into the simulator, let's consolidate what you've covered so far. A network is a set of interconnected devices (hosts) that exchange data through links in the form of packets. Each packet carries a source and desti...
Introduction to the OSI model and encapsulation
In the previous activities, you explored the basic vocabulary of networks, learned to identify IP addresses, observed packets with the ping command, and distinguished between switches and routers. You now have a solid mental picture of what a network...
Stack the diapers (virtual Lego activity)
**Theoretical Recap** The OSI model (Open Systems Interconnection) is a conceptual framework that standardizes network communication into 7 distinct layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), and A...
Layer 1 Physics — supports and signals
You have already explored what the OSI model is, how encapsulation works, and what IP addresses and packets look like in practice. You even observed real network traffic with tools like ping and Wireshark. Now it is time to go deeper into the foundat...
Choosing the right cable (interactive scenario)
THEORETICAL RECAP At OSI Layer 1 (Physical), the cable is not just a wire — it is a medium that determines speed, distance, interference resistance, and ultimately, the reliability of your entire network stack. Three main cable families dominate ente...
Layer 2 Data link — Ethernet & MAC frame
Now that you have explored Layer 1, which deals with physical signals, cables, and transmission media, it is time to move up one level in the OSI model. Layer 2, called the Data Link layer, sits directly above the physical layer and adds the first la...
Read a captured Ethernet frame
THEORETICAL RECAP An Ethernet frame is the fundamental unit of data at Layer 2 (Data Link) of the OSI model. When two devices communicate on a local network, data is broken down into frames before being transmitted over the physical medium. Each Ethe...
Identify errors in a frame
THEORETICAL RECAP An Ethernet frame is a structured unit of data that operates at Layer 2 (Data Link) of the OSI model. It carries a payload from one MAC address to another within the same network segment. A standard Ethernet frame contains the follo...
Layer 3 Network — the role of routers and IP
INTRODUCTION AND POSITIONING IN THE OSI MODEL You have already explored Layers 1 and 2 of the OSI model. You know that Layer 1 (Physical) handles signals and transmission media, and that Layer 2 (Data Link) manages the framing of data, error detectio...
Use traceroute to see jumps
THEORETICAL RECAP Traceroute (or tracert on Windows) is a network diagnostic tool that maps the path packets take from your machine to a destination host, revealing each intermediate router — called a 'hop' — along the way. It operates at Layer 3 (Ne...
Analyze a traceroute output
THEORETICAL RECAP Traceroute is a network diagnostic tool that maps the path packets take from your machine to a destination host, revealing each intermediate router (hop) along the way. It works by sending packets with incrementally increasing TTL (...
Ramp-up mini-project: documenting the path of a package to a website
## Project Overview In this mini-project, you will consolidate everything you have learned about OSI layers 1 through 3 by tracing, capturing, and documenting the complete journey of a network packet from your machine to a public website. This is not...
Transport protocols: key ideas of TCP vs UDP
Now that you have explored the first three layers of the OSI model — Physical, Data Link, and Network — you have seen how data travels as electrical signals, how Ethernet frames are built, and how routers forward packets across networks using IP addr...
Establishing a TCP handshake via netcat
**Theoretical Recap** The TCP (Transmission Control Protocol) three-way handshake is the foundational mechanism by which two hosts establish a reliable connection before any data exchange occurs. It operates at Layer 4 (Transport) of the OSI model an...
Ports and multiplexing: why 80, 443, 53?
When a computer receives data over a network, it faces an immediate challenge: multiple applications are running simultaneously — a browser, an email client, a file transfer tool — and all of them may be receiving data at the same time. How does the ...
Scan ports with Nmap (beginner level)
**Theoretical Recap** A port is a logical endpoint at the transport layer (Layer 4) that allows a host to run multiple network services simultaneously — this is the multiplexing concept you studied in the previous lesson. When you connect to a web se...
Introduction to Wireshark: Interface and Workflow
Wireshark is one of the most widely used network protocol analyzers in the world. It allows you to capture and interactively browse the traffic running on a computer network. In the context of cybersecurity and DevSecOps, Wireshark is an essential to...
Capturing a TCP handshake with Wireshark
**Theoretical Recap** The TCP three-way handshake is the mechanism by which two hosts establish a reliable connection before any data is exchanged. It consists of three segments: SYN (client initiates, proposes an Initial Sequence Number), SYN-ACK (s...
Common Wireshark Filters (BPF)
When you open Wireshark and start a capture on a busy network interface, you are immediately flooded with hundreds or even thousands of packets per second. Without a way to narrow down what you see, finding the traffic you care about becomes nearly i...
Filter UDP DNS traffic
**Theoretical Recap** DNS (Domain Name System) is the protocol responsible for translating human-readable domain names (e.g., google.com) into IP addresses that machines can route. By default, DNS operates over UDP on port 53 — a deliberate design ch...
CIDR subnets and notation
Understanding how IP addresses are organized and divided is a fundamental skill for anyone working in cybersecurity or network administration. You have already explored ports, transport protocols, and packet capture with tools like Wireshark and Nmap...
Calculate the /24 and /26 address range
**Theoretical Recap** An IP address in IPv4 is a 32-bit number divided into two parts: the network portion and the host portion. CIDR notation (Classless Inter-Domain Routing) expresses this split using a suffix like /24 or /26, which indicates how m...
Adjust the subnetwork for a need
**Theoretical Recap** A subnet (subnetwork) is a logical subdivision of an IP network. The core tool for defining subnets is CIDR (Classless Inter-Domain Routing) notation, written as an IP address followed by a prefix length (e.g., 192.168.1.0/24). ...
Simplified routing and routing tables
Routing is one of the most fundamental mechanisms in computer networking. It is the process by which data packets travel from one network to another until they reach their destination. Understanding how routing works is essential for anyone entering ...
Read the Linux VM routing table
**Theoretical Recap** A routing table is a data structure stored in the kernel of an operating system that determines how network packets are forwarded from one network interface to another. Every Linux machine — whether a workstation, server, or vir...
Simple connection status and firewall concept
Understanding how network connections are tracked and how firewalls make decisions about traffic is a foundational skill for any cybersecurity professional. In the previous activities, you explored how TCP handshakes work, how to capture and filter t...
NAT and network address translation
Network Address Translation, commonly abbreviated as NAT, is a mechanism that allows one or more private IP addresses to be mapped to one or more public IP addresses. It operates at the boundary between a private network (such as a home or corporate ...
Track a NATée connection with iptables logs
**Theoretical Recap** Network Address Translation (NAT) is a mechanism that rewrites IP headers at the boundary between a private network and the public internet. When a packet leaves your LAN, the router replaces the source private IP (e.g., 192.168...
DNS: name resolution and associated protocols
DNS, which stands for Domain Name System, is one of the most fundamental protocols of the modern internet. Without it, users would need to memorize the numerical IP addresses of every website or service they want to reach. Instead, DNS allows the use...
Solving and sniffing a DNS lookup
**Theoretical Recap** DNS (Domain Name System) is the internet's phone book: it translates human-readable hostnames (e.g., example.com) into IP addresses that routers and hosts can use. A DNS lookup follows a strict hierarchical resolution chain: you...
Manipulating the hosts file to override
**Theoretical Recap** The hosts file is one of the oldest name resolution mechanisms in computing, predating DNS entirely. Located at `/etc/hosts` on Linux/macOS and `C:\Windows\System32\drivers\etc\hosts` on Windows, it acts as a local, static looku...
OSI layers 4 to 7 and focus on HTTP
In the previous activities, you explored the lower layers of the OSI model: the physical layer, the data link layer, the network layer (with IP addressing, routing tables, and subnetting), and you practiced with Network Address Translation and Domain...
Analyzing an HTTP request in Wireshark
**Theoretical Recap** HTTP (HyperText Transfer Protocol) operates at Layer 7 (Application) of the OSI model, sitting on top of TCP (Layer 4), IP (Layer 3), and ultimately Ethernet (Layer 2). When a browser sends an HTTP request, it first establishes ...
Full traffic — from HTTP request to response (annotated diagram)
## Project Overview This mini-project is the capstone activity for the 'Fundamentals of OSI Networks, Protocols and Models' chapter. You will produce a fully annotated diagram tracing the complete lifecycle of an HTTP request — from the moment a user...
Personal review strategies and resources
At this stage of the course, you have covered a rich and dense set of topics: from the Open Systems Interconnection model and its seven layers, to the Address Resolution Protocol and the Dynamic Host Configuration Protocol, the Network Address Transl...
Conclusion & mastery checklist
This concluding chapter serves as a structured review of everything covered throughout the 'Fundamentals of OSI networks, protocols and models' section. It is designed to consolidate your understanding, identify any remaining gaps, and confirm that y...
