Home Getting Started

Getting Started

Your first steps with Practical DevSecOps courses and certifications
Restu Muzakir
Michael Owen
By Restu Muzakir and 2 others
• 19 articles

Welcome to Practical DevSecOps

🚀 Quick Summary - 🏢 Trusted by Fortune 500 companies (Accenture, Ford, Roche, IBM) - 🌍 5,000+ certified professionals across 104 countries - 📚 9 certification programs available - 🎥 3 years of video access + 30–60 days of labs - 🏆 Lifetime-valid certifications 🎯 Welcome to Practical DevSecOps Practical DevSecOps is the leading provider of hands-on DevSecOps and security automation training. Our platform is trusted by major global organizations, including Accenture, Ford, Roche, IBM and more. With over 5,000 certified professionals across 104 countries, we’ve set the standard for practical, real-world DevSecOps education. 📋 Our Certification Portfolio - 🎓 Certified DevSecOps Professional (CDP) – Ideal for beginners starting their journey - 🔧 Certified DevSecOps Expert (CDE) – For intermediate practitioners building expertise - 🤖 Certified AI Security Professional (CAISP) – Specialization in AI/ML security - ☁️ Certified Cloud-Native Security Expert (CCNSE) – Security in Kubernetes and cloud-native environments - 🐳 Certified Container Security Expert (CCSE) – In-depth container security training - 🛡️ Certified Security Champion (CSC) – Drive secure culture in development teams - 🔐 Certified Threat Modeling Professional (CTMP) – Mastering security by design - 🔗 Certified Software Supply Chain Security Expert (CSSE) – Focus on securing the software supply chain - 🔑 Certified API Security Professional (CASP) – Deep dive into API security - Certified Model Context Protocol Security Expert (CMCPSE) - deep dive in MCP security 📦 What You Get When you enroll in any of our courses, you receive a complete learning package: ​ - 🎥 3 years of access to our comprehensive video library - 📄 Detailed course manuals in downloadable PDF format - 💬 Access to our support by clicking bubble chat in the bottom corner on every platform page - 🧪 30–60 days of cloud-based lab access for hands-on practice - ✅ One exam attempt included with every certification - 🏆 Lifetime-valid certification upon passing Common Questions Q1: Is there a transcript available for the videos? A1: Most of the closed captions or subtitles in the videos are based on the course manual we have sent to your email when you start the course

Last updated on Sep 02, 2026

How to Get Started

🚀 Quick Summary: - 🆓 7-day free trial available - 📝 Simple registration process - 💳 Multiple payment options (Credit card, Debit card, PayPal and Bank Transfer) - 📅 Flexible lab start dates - 🧾 Invoice available for corporate purchases ​ ​ 🎯 Getting Started is Easy & Risk-Free Beginning your Security certification journey is straightforward and risk-free. We understand that choosing the right certification program is an important decision, which is why we offer a 7-day free trial. By signing up on our portal, you can: - 🎥 Access sample videos - 🔐 Try hands-on labs - 📋 Review the complete course outline - 🔍 Evaluate our teaching methodology - ✅ Ensure content aligns with your goals 💳 Simple Enrollment Process Step 1: Complete Pre-signup here: https://www.practical-devsecops.com/pre-signup/ - 📝 Select your preferred course - 👤 Enter basic contact details (name, email, phone) - 🌍 Choose your country to allocate the respective lab region - 📅 Pick your preferred start timeframe for reference only Step 2: Receive a personal purchase link for secure payment via: - 💳 Credit cards (Visa, MasterCard, Amex) - 💸 Debit cards - 🅿️ PayPal - 🏦 Bank Transfer For Corporate Purchases: 🏢 Simply email our team with your company and billing details for professional invoicing at registrations@practical-devsecops.com ⏰ Flexible Scheduling After purchase, you can manage your course as you desire. However, please do note the following points: - 📅 You need to schedule your course to make good use of the 60 days of lab - 🎥 Videos and labs begin together once you activate the course - ⚖️ Labs are available 24x7 through out your journey - 📅 Must schedule within one year after course purchase ​ 📌 How to Schedule Your Course After completing payment, you’ll receive a course confirmation email with all the necessary details to schedule your course start date.

Last updated on Apr 21, 2026

Platform Navigation Guide

🚀 Quick Summary: - 🤳 Self Service portal to manage your courses and exams - 📊 Dashboard shows progress, lab status, and deadlines - 🎥 Videos stream online (not downloadable) - 📄 PDF manuals available for offline reference - 💬 Chat widget for requesting support - 🎛️ Student portal for self-service needs 📊 Your Learning Dashboard Our learning platform is designed for ease of use while providing all the tools you need for successful certification preparation. Upon logging in, your dashboard provides an at-a-glance view of: - 📈 Course progress and completed modules - ⏰ Remaining lab days - 🎯 Upcoming deadlines and milestones This helps you manage your time effectively and ensures you don't miss important deadlines. You can access your course using this link: https://portal.practical-devsecops.training/courses/ ​ 🎥 Optimized Video Experience Our video learning experience is optimized for online streaming, ensuring you always have access to the most up-to-date content: - ⏯️ Platform remembers your progress - pause and resume anytime - 📚 Each video paired with relevant lab exercises - 📱 Mobile-friendly learning experience - 🔄 Always current - no outdated content ​ 💡 Pro Tip: Use the dual approach - watch videos for visual instruction and hands-on labs to gain practical experience! ​ 💬 Support Our Chat widget channel connects you to the support - ❓ Ask questions and get expert answers - 👨‍🏫 Direct access to instructors and teaching assistants - ⚡ Typically receive responses within minutes - 🌍 Real-world context and practical tips

Last updated on Sep 02, 2026

Understanding Credly Badges and the “Explain‑to‑Me” Feature in Practical DevSecOps Courses

Understanding Credly Badges and the “Explain‑to‑Me” Feature in Practical DevSecOps Courses Introduction When you start a Practical DevSecOps course, two visual cues help you track progress and deepen learning: Credly digital badges and the “Explain‑to‑Me” icon ( ? ) that appears next to code snippets. Both tools are designed to celebrate achievements, showcase your expertise, and turn complex commands into bite‑size lessons. This article explains exactly what you’ll see in Credly, how to use the badge‑sharing options, and how the “Explain‑to‑Me” feature works inside the learning environment. 1. What a Credly Badge Looks Like and How to Use It 1.1 Visual preview of a Credly badge - Badge shape – A compact, circular or shield‑shaped graphic that includes the Practical DevSecOps logo, the specific certification name (e.g., “Certified DevSecOps Professional”), and the date you earned it. Tip: In most browsers you’ll see a subtle “Verified by Credly” badge corner that confirms authenticity. 1.2 Accessing your badge 1. Receive a notification – After pass a certification exam, you’ll get an email to accept your Credly badge 2. Open the badge – Clicking the button takes you to Credly’s web portal where the badge is displayed in full size. 3. Explore badge actions – Below the badge you’ll find a row of icons: - Share – Post directly to LinkedIn, Twitter, Facebook, or embed on a personal website. - Download – Save a PNG or SVG version for a résumé or portfolio. - Verify – Copy a public verification link that employers can click to confirm the credential. 1.3 Sharing best practices - LinkedIn – Add a short caption that highlights the specific skill you earned (e.g., “Just earned the Practical DevSecOps Professional badge – now proficient in secure CI/CD pipelines”). - Twitter – Use hashtags like #DevSecOps, #Credly, and #ContinuousLearning to increase visibility. - Personal website – Embed the badge using the provided HTML snippet; this creates a live verification widget that updates automatically if the badge is renewed. 2. The “Explain‑to‑Me” ( ? ) Icon in Code Snippets 2.1 Purpose of the question‑mark icon The small question‑mark that appears next to a command or configuration line is not a typo—it’s an interactive learning aid called Explain‑to‑Me. Its goal is to: - Provide a concise, plain‑language description of what the command does. - Reduce the need to switch tabs or search external documentation. - Support learners of all experience levels, from beginners to seasoned security engineers. 2.2 How it works | Action | Result | |--------|--------| | Click the ? icon | A pop‑up window or inline tooltip appears, showing a short paragraph (≈ 2‑3 sentences) that explains the command’s purpose, typical use cases, and any important flags. | | Hover (desktop) or tap (mobile) | A preview tooltip shows a one‑sentence summary. | | Close the pop‑up | The tooltip disappears, returning you to the code view without losing your place. | Example: In a Dockerfile you see RUN apt‑get update && apt‑get install -y curl ?. Clicking the ? displays: “Updates the package index and installs the curl utility, which is used for transferring data with URLs. The -y flag automatically answers ‘yes’ to prompts.” 2.3 When to use Explain‑to‑Me - First‑time exposure – If you’ve never seen a command before, the tooltip gives you a quick mental model. - Exam preparation – Review the explanations to reinforce key concepts before a certification test. - Reference while coding – While building a pipeline, the pop‑ups act as an on‑the‑fly cheat sheet, keeping you focused on the task. 3. Practical Scenarios Scenario 1: Using Explain‑to‑Me while debugging a pipeline 1. Open the CI/CD YAML file in the Practical DevSecOps lab. 2. Spot the line - script: npm audit ?. 3. Click the ? to read: “Runs npm audit to identify known vulnerabilities in Node.js dependencies. Returns a report with severity levels.” 4. Adjust the script based on the explanation (e.g., add --audit-level=high). 4. Common Questions Q1: Do Credly badges expire? No. Once issued, a badge remains valid indefinitely. If the underlying certification is updated, you may receive a refreshed badge with a new issuance date. Q2: Are the explanations language‑specific? The tool currently only support english language. Q3: Is the badge shareable outside Credly? Absolutely. You can download the image file or use the embed code to place the badge on any website, blog, or internal portal. Conclusion Credly badges give you a portable, verifiable record of your DevSecOps achievements, while the “Explain‑to‑Me” ? icon turns every code snippet into a mini‑tutor. Together, they create a seamless learning loop: you earn a badge, showcase it, and use built‑in explanations to deepen your expertise. Embrace both features to accelerate your career, build a compelling professional profile, and master the secure development practices that modern organizations demand.

Last updated on Jan 06, 2026

Getting Started with Practical DevSecOps: Course Filters, and Account FAQs

Getting Started with Practical DevSecOps: Course Filters, and Account FAQs Welcome to Practical DevSecOps! This guide explains how to navigate your learning dashboard, use filters to track your progress, understand course provisioning timelines, and get help whenever you need it. 1. Organizing Your Learning Path with Course Filters Practical DevSecOps courses contain a mix of hands‑on labs, videos, quizzes, readings, and feedback forms. The filter panel on the dashboard lets you view exactly what you need, when you need it. 1.1. Filter by Task Type | Task Type | What It Contains | Typical Use | |-----------|------------------|-------------| | Hands‑on Exercise | Interactive labs and command‑line tasks | Practice real‑world scenarios | | Video | Recorded lectures or demos | Visual learning, concept review | | Quiz | Multiple‑choice assessments | Test knowledge retention | | Reading Material | PDFs, articles, or reference guides | Deep‑dive theory | How to apply: Click the Task Type dropdown and select one or more categories. The list updates instantly, showing only the relevant items. 1.2. Filter by Priority - Mandatory – Must be completed to earn the Certificate of Completion. - Optional – Helpful for extra practice but not required for course completion. Tip: Prioritize mandatory tasks early to stay on track for your certification goals. 1.3. Filter by Status | Status | Meaning | |--------|---------| | Not Started | Items remaining on your curriculum | | In Progress | Current tasks being worked on | | Completed | Finished items | 2. Why Are My Courses Not Visible Under "My Courses"? If you have enrolled but your course does not appear on your dashboard, check the following steps: 1. Verify your login email The platform ties course enrollments to the exact email address used at registration. Verify the email in the top-right corner of the dashboard. 2. Schedule your course Courses do not appear under My Courses until they are scheduled: 1. Log in to the member portal: https://members.practical-devsecops.training 2. Locate the Schedule button next to your enrolled course. 3. Select your desired start date and time slot, then click Schedule the Course. 3. Allow 20–30 minutes for the provisioning build - Once scheduled, an automated background build provisions your labs, content modules, and assessments. - This process typically takes 20–30 minutes. - After 20–30 minutes, perform a hard refresh (Ctrl + F5 or Cmd + Shift + R), and your course will appear under My Courses. 4. Need help? If you have scheduled your course and waited 30 minutes but it still does not appear, open the Chat with support widget on the portal for assistance within minutes. 3. ID Verification: Non‑English Names Are Accepted When submitting your ID for certification issuance: - Our verification system supports Unicode characters, so names in Cyrillic, Arabic, Asian scripts, or any other non-Latin alphabets are fully accepted. - The only requirement is that the ID is clear, legible, and matches the personal details on your learner profile. 4. Common Questions & Quick Tips | Question | Quick Answer | |----------|--------------| | Do filters affect my actual progress data? | No. Filters only change your dashboard view; your progress records remain intact. | | How soon after scheduling does my course appear? | A background build runs for 20–30 minutes, after which the course appears under My Courses. Please keep in mind that the background build will be triggered on your scheduled date | | How do I contact support? | Use the in-portal Chat widget for rapid assistance within minutes. | By mastering these navigation tools and understanding provisioning timelines, you’ll spend less time troubleshooting and more time mastering DevSecOps skills. Happy learning!

Last updated on Sep 02, 2026

Using the TaskManager Application and Accessing GitLab Projects in Practical DevSecOps

Using the TaskManager Application and Accessing GitLab Projects in Practical DevSecOps Welcome to your first hands‑on experience with the TaskManager web app and the associated GitLab repositories that power the Practical DevSecOps training environment. This guide walks you through what the TaskManager application is, why it matters in a DevSecOps curriculum, and how to correctly clone and explore the GitLab project, even when you encounter password prompts or permission issues. By the end of this article you’ll be ready to start experimenting with the intentionally vulnerable “Prod” machine and begin your journey toward DevSecOps certification. Table of Contents 1. What Is the TaskManager Application? 2. Why TaskManager Is Central to Practical DevSecOps 3. Accessing the GitLab Project - 3.1 Understanding the Two URLs - 3.2 Cloning the Repository Correctly What Is the TaskManager Application? TaskManager is a lightweight, web‑based task‑tracking tool that serves as the flagship demo application for the Practical DevSecOps labs. - Purpose – It mimics a real‑world SaaS product, allowing learners to practice secure coding, continuous integration, containerization, and automated security testing. - Environment – The app is deployed on the “Prod” machine, a deliberately vulnerable production‑like environment. This gives you a safe sandbox where you can explore security flaws without risking actual production systems. - Technology Stack – Multiple language implementations are provided (e.g., Node.js, Java, Python). The Node.js version is the most commonly used in the beginner labs. Why TaskManager Is Central to Practical DevSecOps | Learning Objective | How TaskManager Helps | |--------------------|-----------------------| | Secure Coding | The source contains known OWASP Top‑10 vulnerabilities (e.g., insecure deserialization, XSS). | | CI/CD Pipelines | Pre‑configured GitLab CI jobs demonstrate automated builds, tests, and security scans. | | Container Security | Dockerfiles and Kubernetes manifests let you explore image hardening and runtime policies. | | Incident Response | Simulated attacks on TaskManager give you a playground for detection and remediation. | By interacting with the same codebase that your instructors use, you gain a consistent, reproducible learning experience. Accessing the GitLab Project Understanding the Two URLs 1. Production Demo URL – https://prod-.lab.practical-devsecops.training/ 2. Personal Clone URL – https://gitlab.practical-devsecops.training/pdso/django.nv Cloning the Repository Correctly Follow these steps to clone the personal fork to your local workstation: 1. Open a terminal (Linux/macOS) or Git Bash (Windows). 2. Copy the clone URL (the personal fork link above). 3. Run the Git command: git clone https://gitlab.practical-devsecops.training/pdso/django.nv django 4. When prompted for a username and password, use the credentials supplied in the exercises 5. After cloning, navigate into the project folder: cd django

Last updated on Jan 06, 2026

Getting Started with Practical DevSecOps: CDE Certification, and Lab Access Duration

Getting Started with Practical DevSecOps: CDE Certification, Supply‑Chain Attack Course, and Lab Access Duration Welcome to Practical DevSecOps! Whether you’re preparing for the Certified DevSecOps Engineer (CDE) exam, exploring our Supply‑Chain Attack module, or wondering how long you can use the hands‑on labs, this guide walks you through the first steps, course content, and access policies. By the end of the article you’ll know exactly how to enroll, what you’ll learn, and how to make the most of your lab time. 1. How to Begin Your CDE Certification Journey 1.1 No Formal Request Required – Just Schedule It The CDE certification process is streamlined through our single‑sign‑on (SSO) portal. Follow these steps: 1. Log in to the Members Portal - URL: https://members.practical-devsecops.training/ - Use the same credentials you employ for the lab environment (SSO syncs both portals). 2. Navigate to the “CDE Scheduling” Section - After authentication, click “Schedule CDE” on the dashboard. 3. Select Your Preferred Start Date - Choose any future date that fits your calendar. The system will lock in the date and send you a confirmation email with exam details and pre‑exam resources. 4. Prepare with Recommended Materials - You can review it by downloading the PDF manual, which contains all the course materials. 1.2 What Happens After Scheduling? - Lab Availability: You can start using the labs portal to study. - Support: Chat widget on the bottom right corner of the page. 2. Inside the Software Supply Chain Security Expert Course Supply‑chain security is a fast‑evolving threat vector. Our course is designed to give you a holistic, up‑to‑date view of how attackers compromise software from code to deployment. 2️⃣ Core Topics Covered | Module | Key Areas | |--------|-----------| | Application‑Level Threats | Dependency confusion, malicious libraries, code injection | | Container Security | Image tampering, malicious base images, runtime attacks | | Kubernetes Hardening | Supply‑chain risks in Helm charts, pod security policies | | CI/CD Pipeline Exploits | Credential leakage, compromised build agents, rogue pipelines | | Real‑World Case Studies | SolarWinds, Codecov, and recent supply‑chain incidents | | Defensive Strategies | SBOM generation, provenance verification, automated scanning tools | 2️⃣ What Makes This Course Stand Out? - Hands‑On Labs: Each module includes a lab where you replicate an attack and then apply mitigations. - Industry‑Relevant Tools: Work with tools such as Syft, Grype, Trivy, and GitHub Advanced Security. Scenario: Imagine you receive a pull request that adds a new npm package. In the lab you’ll learn how to detect a malicious package masquerading as a legitimate one, then enforce policy using an SBOM gate in your CI pipeline. 3. How Long Do You Keep Access to Course Videos and Labs? 3.1 Uniform Lab Access Across All Courses - Standard Access Period: 60 days from the date of purchase. Example: If you buy the Certified DevSecOps Professional (CDP) course on March 1, your lab environment will be available until April 30. 3.2 Video Content Availability - Unlimited Streaming: All recorded lectures and demo videos will remain accessible for up to 3 years. - Download Option: You may download PDFs of slide decks, but video files are streaming‑only to protect intellectual property. 3.3 Extending Your Lab Time - Purchase Additional Days: Through the portal you can buy extra lab extensions in 30‑day increments. - Corporate Licenses: If your organization holds an enterprise license, labs may be available for the length of the contract. 4. Common Questions & Quick Tips | Question | Answer | |----------|--------| | Do I need to request the CDE certification separately? | No. Simply log in, schedule your start date, and the system handles the rest. | | What if I finish the labs before 60 days? | You can continue watching the videos or work on the optional labs we have already provided to further enhance your knowledge beyond the mandatory ones. | | Can I retake the CDE exam if I fail? | Yes, you may schedule a retake after a 15-day cooling-off period. Please note that a retake exam will incur an additional USD 100 fee. You can purchase the retake exam voucher here: https://www.practical-devsecops.com/exam-retake/ and select your enrolled course.| | Could I know the meaning of a Certificate of Completion in our course? | A Certificate of Completion refers to the certificate that you will receive once you have successfully completed the course. You need to complete all the Mandatory Exercise and videos first and then you can download the Certificate of Completion by yourself | | When does lab countdown start? | It depends on the countdown displayed in your lab time progress, as indicated in your course, the countdown will start when your lab will expire in 60 days from the date of provisioning your lab, whether you use the labs or not. 60 days is a fixed time window. After 60 days, you will not have access to the labs. Please keep in mind that even if you schedule a course and do not start any labs, the lab time will still continue to decrease because the resources have already been provisioned and scheduled.| Quick Tips for Success 1. Mark Your Calendar: Set reminders for the 60‑day lab expiry. 2. Leverage the Support: Use the Chat widget to get real‑time help on tricky lab steps. 3. Document Your Findings: Keep a personal notebook of each ; it’s invaluable for the certification exam. 5. Next Steps 1. Log in to the members portal and schedule your CDE start date. 2. Enroll in the Supply‑Chain Attack course if you haven’t already. 3. Plan your 60‑day lab usage—prioritize high‑impact modules first. 4. Join the community forum to share insights and ask questions. Embark on your DevSecOps journey with confidence—Practical DevSecOps equips you with the knowledge, tools, and hands‑on experience you need to secure modern software supply chains and earn the CDE credential. Happy learning!

Last updated on Sep 03, 2026

How to Enroll, Renew, and Access Resources for Practical DevSecOps Courses

How to Enroll, Renew, and Access Resources for Practical DevSecOps Courses Welcome to Practical DevSecOps! Whether you’re just starting your certification journey or you need to extend your lab access, this guide walks you through every step—from scheduling your first class to keeping your learning materials after the lab period ends. Follow the instructions below to get the most out of your course experience. Table of Contents 1. Scheduling Your First Course 2. Renewing Lab Access 3. Getting Video Transcripts & Closed Captions 4. Using Lab Links After the Access Period 5. Common Questions & Quick Tips Scheduling Your First Course If you can’t see your courses list, it’s likely because you haven’t scheduled the course yet. Follow these simple steps to add a class to your calendar. Step‑by‑Step Scheduling 1. Log in to the member portal Visit the Practical DevSecOps member site: https://members.practical-devsecops.training/ 2. Select the course you want On the dashboard, locate the “Schedule” button next to the desired course title. 3. Choose a date and time - Pick a start date that fits your schedule. - Select an available time slot (sessions are offered in multiple time zones). 4. Confirm the schedule Click “Schedule the Course.” You’ll receive a confirmation email with the session details and a link to join the live class. 5. Verify the course appears in your list Return to the dashboard; the newly scheduled course should now be listed under “My Courses.” Pro tip: Add the session link to your personal calendar (Google, Outlook, etc.) to receive automated reminders. Renewing Lab Access Lab environments are the hands‑on component of every Practical DevSecOps certification. When the access period is about to expire, you have a few options to keep working. How to Extend Your Lab Time 1. Visit the pricing page – Go to: https://portal.practical-devsecops.training/pricing 2. Choose a renewal option – The page lists: - 30 days of lab extension - 60 days of lab extension - 90 days of lab extension 3. Complete the purchase – Follow the checkout flow; your lab access is updated instantly. 4. Check the new expiration date – After renewal, the updated date appears in the “Lab Access” section of your course dashboard. Getting Video Transcripts & Closed Captions Many learners rely on transcripts for review or accessibility. Here’s how you can obtain them: - Closed captions are generated from the course manual that was emailed to you when you enrolled. - To view captions while watching a video, click the CC icon on the video player. Tip: Download the original course manual (attached to the welcome email) and use it as a reference while watching videos. The manual mirrors the caption text, making it easy to follow along offline. Using Lab Links After the Access Period You may wonder whether saved URLs from lab materials remain functional once your sandbox expires. The answer depends on the source of the link. What Happens to Saved Links - External resources (e.g., public GitHub repos, vendor documentation) stay accessible as long as the original site keeps them public. - Practical DevSecOps‑hosted lab environments (the interactive sandboxes) become inactive after the expiration date. The URL will still load, but the environment will be read‑only or display a “session expired” message. Best Practices | Action | Reason | |--------|--------| | Bookmark external resources | Guarantees you can revisit tutorials, tools, and reference guides. | | Export lab configuration files (Dockerfiles, Terraform scripts, etc.) before the expiration date | Allows you to recreate the environment locally or on a personal cloud account. | | Take screenshots of key lab screens | Helpful for documentation or exam preparation. | Scenario: Carlos saved the URL to a vulnerable OWASP Juice Shop instance provided in the “Web Application Security” lab. After his lab access ended, the URL still pointed to the public Juice Shop repository, so he could continue practicing locally by pulling the Docker image from Docker Hub. Common Questions & Quick Tips Q1: I still don’t see my scheduled course after following the steps. A: Clear your browser cache or try an incognito window. If the issue persists, contact support with a screenshot of the dashboard. Q2: Can I combine multiple renewal periods? A: Yes. You can purchase a monthly extension and later add a quarterly one; the system will stack the dates automatically. Q3: Are transcripts available in languages other than English? A: Currently, captions are only provided in English. However, you can use third‑party translation tools on the caption file for personal use. Q4: Will my saved lab links work on a different device? A: External links will work on any device with internet access. Lab‑hosted links require an active subscription, regardless of the device. Final Checklist - [ ] Schedule your course on the member portal. - [ ] Add the session link to your personal calendar. - [ ] Download the course manual for captions and reference. - [ ] Renew lab access before the expiration date via the pricing page. - [ ] Export any valuable lab artifacts (scripts, configs) before the sandbox shuts down. By following this guide, you’ll smoothly navigate enrollment, keep your hands‑on labs active, and retain valuable learning resources long after the official course window closes. Happy learning, and welcome to the Practical DevSecOps community!

Last updated on Sep 16, 2026

Open Source Threat Modeling Tools: A Practical Guide for DevSecOps Beginners

Open Source Threat Modeling Tools: A Practical Guide for DevSecOps Beginners Threat modeling is a cornerstone of any DevSecOps program—it helps you anticipate security risks, prioritize mitigations, and communicate findings to stakeholders. With a growing ecosystem of free, community‑maintained utilities, you don’t need an expensive commercial suite to get started. This article walks you through the key considerations when selecting an open‑source threat‑modeling tool, highlights the most widely‑used options, and shows how to integrate a tool into your first security‑by‑design workflow. Why Choose an Open‑Source Threat Modeling Tool? | Benefit | What It Means for You | |--------|-----------------------| | Cost‑effective | No licensing fees; you can spin up as many instances as needed. | | Transparency | Source code is visible, so you can verify the methodology and extend it. | | Community support | Active contributors share templates, plugins, and best‑practice guides. | | Flexibility | Easily integrate with CI/CD pipelines, issue trackers, or documentation generators. | Open‑source tools are especially attractive for teams that are just beginning their DevSecOps journey, as they allow rapid experimentation without a large budget commitment. Factors to Evaluate Before Picking a Tool 1. Intended Outcome - Risk register: Do you need a structured list of threats with severity scores? - Architecture diagrams: Are visual representations a priority? - Compliance mapping: Must the tool align threats with standards like ISO 27001 or NIST 800‑53? 2. Time & Skill Investment - Some tools are drag‑and‑drop (e.g., Threat Dragon) and require little training. - Others are script‑oriented (e.g., pyTM) and assume familiarity with Python or Markdown. 3. Scope of Modeling - Application‑level: Focus on APIs, microservices, or UI flows. - Infrastructure‑level: Model cloud resources, network topology, or IaC templates. 4. Integration Needs - Does the tool export to JSON, CSV, or STIX for downstream analysis? - Can it be triggered from GitHub Actions, GitLab CI, or Jenkins? 5. Community Activity - Look at recent commits, open issues, and the size of the contributor base. A lively repo usually means quicker bug fixes and new features. Popular Open‑Source Threat Modeling Tools Below is a curated snapshot of the most actively maintained utilities (the full list lives at the Awesome Threat Modeling repository). 1. Threat Dragon (OWASP) - Type: Web‑based UI + desktop (Electron) - Strengths: Intuitive drag‑and‑drop canvas, built‑in STRIDE templates, export to JSON or PDF. - Best For: Teams that value visual diagrams and quick onboarding. 2. Microsoft Threat Modeling Tool (Free, not fully open source) - Type: Windows desktop app - Strengths: Rich data‑flow modeling, automatic threat generation, integrates with Azure DevOps. - Best For: Organizations already invested in Microsoft ecosystems. 3. pyTM - Type: Python library + CLI - Strengths: Scriptable threat generation, Markdown output, easy to embed in CI pipelines. - Best For: Developers comfortable with code‑first approaches. 4. SecuriCAD (Community Edition) - Type: Simulation‑based modeling (limited free tier) - Strengths: Quantitative risk scores, attack‑path simulation. - Best For: Teams that need deeper quantitative analysis without a commercial license. 5. ThreatSpec - Type: DSL (Domain‑Specific Language) + Ruby gem - Strengths: Write threat models as code, version‑control friendly, integrates with Git. - Best For: DevSecOps pipelines that treat security artifacts like any other source code. Getting Started: A Step‑by‑Step Example with Threat Dragon 1. Install - Visit the Threat Dragon releases page and download the appropriate installer (Windows, macOS, or Linux). 2. Create a New Model - Choose “Create New Model” → select the STRIDE template. - Sketch your system’s data flow: external users → API gateway → microservice → database. 3. Generate Threats - Click “Auto‑Generate Threats”. The tool will list STRIDE‑derived threats for each component (e.g., Spoofing on the API gateway). 4. Prioritize - Assign Likelihood and Impact scores (Low/Medium/High). - The tool automatically calculates a Risk Rating. 5. Export & Share - Export the model as a PDF for stakeholder review or as JSON for automated ingestion into a ticketing system (e.g., Jira). 6. Integrate with CI - Store the exported JSON in your repository. - Add a GitHub Action that validates the JSON schema on every pull request, ensuring the model stays in sync with code changes. Common Questions | Question | Answer | |----------|--------| | Do I need a diagramming tool in addition to the threat‑modeling software? | Most open‑source tools include built‑in diagram editors. If you prefer a separate diagramming suite (e.g., draw.io), you can import/export SVG files. | | Can I use these tools for cloud‑native environments? | Yes. Look for plugins that ingest Terraform or AWS CloudFormation files (e.g., ThreatSpec’s IaC parser). | | How do I keep the threat model up‑to‑date? | Treat the model as source code: store it in version control, review changes during code reviews, and automate validation in CI pipelines. | | Is there a learning curve? | Tools like Threat Dragon require minimal training (<1 hour). Code‑first tools (pyTM, ThreatSpec) need basic scripting knowledge but pay off with repeatable automation. | Tips for Successful Open‑Source Threat Modeling - Start Small: Model a single high‑risk service before expanding to the whole architecture. - Leverage Templates: Use STRIDE, PASTA, or CVSS templates to ensure consistent threat identification. - Automate Repetitive Tasks: Export models to JSON and feed them into issue‑trackers or security dashboards. - Engage the Community: Contribute bug fixes or new templates back to the project—this improves the tool and builds your credibility. - Document Decisions: Capture why a threat was accepted, mitigated, or transferred; this documentation is invaluable for audits and future teams. Take the Next Step Open‑source threat modeling empowers DevSecOps teams to embed security early, iterate quickly, and stay budget‑conscious. Pick a tool that matches your team’s skill set, integrate it into your CI/CD workflow, and make threat modeling a living part of your development lifecycle. Happy modeling!

Last updated on Jan 04, 2026

Linux Fundamentals for DevSecOps: Shebang, Filesystem, PATH, Links, and Prompt

Linux Fundamentals for DevSecOps: Shebang, Filesystem, PATH, Links, and Prompt Welcome to the first step of your Practical DevSecOps journey! Before you can automate security checks, build pipelines, or write secure scripts, you need a solid grasp of the Linux environment that underpins every DevSecOps tool. This article demystifies the most frequently encountered concepts—shebang, filesystem hierarchy, PATH variable, hard & symbolic links, and the command prompt—and provides clear examples you can try right away. 1. The Shebang (#!) – Telling Linux Which Interpreter to Use What is a shebang? A line that starts with #! (pronounced “hash‑bang”) at the very top of a script is both a comment and an instruction. It tells the kernel which interpreter should execute the file. #!/bin/bash # This is a comment for humans echo "Hello, DevSecOps!" - #!/bin/bash points to the Bash binary located in /bin. - Everything after # on that line is ignored by the interpreter, so it also works as a regular comment. Why it matters in DevSecOps - Guarantees consistent execution across different environments (e.g., CI runners, containers). - Prevents “script not found” errors when the default shell isn’t Bash. Quick test: Create a file named hello.sh, paste the snippet above, make it executable (chmod +x hello.sh), and run ./hello.sh. You should see Hello, DevSecOps!. 2. Navigating the Linux Filesystem Linux organizes files in a single rooted tree (/). Understanding where executables, libraries, and configuration files live is essential for troubleshooting and for placing your own tools. | Directory | Typical Contents | When to use it | |-----------|------------------|----------------| | /bin | Essential user binaries (e.g., ls, cat) | System‑wide commands required for boot | | /usr/bin | Most user commands (e.g., git, vim) | General purpose utilities | | /usr/local/bin | User‑installed executables (custom scripts, third‑party tools) | Ideal location for tools you compile or download yourself | | /sbin & /usr/sbin | System administration binaries (e.g., ifconfig) | Usually accessed by root | | /opt | Optional add‑on software packages | Large third‑party applications | Practical scenario You’ve just compiled a security scanner from source. Place the binary in /usr/local/bin so it’s available to every user without cluttering system directories. sudo cp myscanner /usr/local/bin/ Now you can run myscanner from any directory. 3. The PATH Environment Variable What is PATH? PATH is a colon‑separated list of directories that the shell searches when you type a command without a full path. echo $PATH # Example output: # /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin How it works When you type git, the shell checks each directory in $PATH in order. The first matching executable is run. Adding a custom directory to PATH If you store scripts in ~/bin, make sure the shell can find them: # Add to current session export PATH=$HOME/bin:$PATH # Persist across logins (add to ~/.bashrc or ~/.profile) echo 'export PATH=$HOME/bin:$PATH' >> ~/.bashrc source ~/.bashrc Why PATH matters for DevSecOps - Enables you to invoke tools (e.g., trivy, kube-score) from any location in CI pipelines. - Avoids hard‑coding absolute paths in scripts, making them portable. 4. Links: Hard vs. Symbolic Linux provides two ways to reference the same data: hard links and symbolic (soft) links. Hard Links - Create another directory entry that points directly to the same inode (the actual data on disk). - No separate file; deleting one link does not delete the data as long as another link exists. - Cannot span different filesystems or reference directories. # Create a hard link ln original.txt hardcopy.txt # Verify they share the same inode ls -i original.txt hardcopy.txt Symbolic Links - A special file that contains a pathname to another file or directory. - Can cross filesystem boundaries and point to directories. - If the target is removed, the symlink becomes “dangling”. # Create a symbolic link ln -s /usr/local/bin/myscanner /usr/bin/myscanner # Show where it points ls -l /usr/bin/myscanner When to use which? - Hard links – Rarely needed in DevSecOps; useful for backup scripts where you want multiple names for the same file without extra storage. - Symbolic links – Ideal for versioned tools (/opt/tool-1.2/bin/tool -> /opt/tool-1.2.3/bin/tool) or for creating shortcuts in $PATH. 5. Customizing the Command Prompt A clear prompt helps you recognize the current user, host, and directory—especially when juggling multiple terminals. Basic PS1 example export PS1='\u@\h:\w\$ ' # Result: devuser@myhost:/home/devuser$ - \u – username - \h – hostname (short) - \w – current working directory - \$ – shows # for root, $ for normal users Add the line to ~/.bashrc to make it permanent. Prompt tip for DevSecOps Include the active virtual environment or Git branch to avoid committing from the wrong context: export PS1='[\u@\h \W$(git branch 2>/dev/null | grep "^*" | cut -d " " -f2)]\$ ' 6. Common Questions & Tips | Issue | Likely Cause | Fix | |-------|--------------|-----| | Prompt shows ># instead of /# after typing a command | You typed cd .. but didn’t press Enter or the shell is waiting for a closing quote | Press Enter or complete the command. | | #!/bin/bash appears as # only in the editor | The editor is displaying the line as a comment; the shebang is still functional | Verify with head -1 script.sh to see the raw line. | | Command not found even though binary exists in /usr/local/bin | /usr/local/bin not in $PATH | Add it to PATH as shown in Section 3. | | Hard link fails with “Invalid cross‑device link” | Source and target are on different mounted filesystems | Use a symbolic link (ln -s) instead. | Quick Checklist Before Running a Lab 1. Shebang – First line starts with #!/bin/bash (or appropriate interpreter). 2. Executable Permission – Run chmod +x script.sh. 3. PATH – Verify the tool’s directory is in $PATH. 4. Prompt – Ensure you’re at the expected location (/# for root, $ for normal user). 5. Links – Use ls -l to confirm symlinks point where you expect. 7. Wrap‑Up Mastering these Linux fundamentals—shebang, filesystem layout, PATH, linking mechanisms, and prompt customization—lays a reliable foundation for every DevSecOps task, from writing secure automation scripts to configuring CI/CD runners. Keep this guide handy, experiment with the examples, and you’ll move through the Practical DevSecOps courses with confidence. Happy hacking!

Last updated on Jan 04, 2026

Exam zip format and challenge folder

Overview This document outlines which exams do not require a challenges folder as part of their certification process. Understanding these exceptions helps streamline the exam setup and administration process. Exam Zip Format Structure Exams That Require Challenges Folder The following exams are administered with a challenges folder component. You need to download the necessary files such as .py, .yaml, and others, and place them into the respective challenge folder. - DevSecOps Professional Exam [CDP] - DevSecOps Expert Exam [CDE] - Container Security Expert Exam [CCSE] - Cloud Native Security Expert Course Exam [CCNSE] Exams That Don’t Require Challenges Folder The following exams are conducted without a challenges folder component. You should not include the .py file in the zip, even if it’s the file you edited. The exam rules prohibit any executable‑type artifacts (executables, shell scripts, .py files). Only submit the non‑executable files you added or changed, and embed the relevant Python code as a snippet or screenshot inside your report. - Threat Modeling Exam [CTMP] - Software Supply Chain Security Expert Exam [CSSE] - AI Security Professional Exam [CAISP] - API Security Professional Exam [CASP] - Security Champion Exam [CSC] - MCP Security Expert (CMCPSE) Note: For these certification exams, only a PDF or markdown format inside the zip file is required. You do not need to create a challenges folder.

Last updated on Jul 03, 2026

certified threat modeling professional (CTMP)

certified threat modeling professional (CTMP) is Learn how to use threat modeling in the modern DevOps organizations Common Question: Q1: Is the Threat Modeling focused on every sort of system? A: Threat Modeling is a concept that is not limited to just software. You can threat model your house, your car, an electronic voting systems, Elections Operations, and many other things. So, is threat modeling focussed just for software? In fact, Threat modeling methodologies like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege) are still applicable to non-web applications/software.  You can adapt them to the specific context of your application/software. Q2: What's good for PCI certification? A: Tools find threats, and categorize them in to various standard mappings. There are plenty of tools discussed in the course through lectures, and hands on. When you are at the end of the course, you should have a better idea of the choices you want to make. If not, kindly post back here, we will assist you. Q3: How can I integrate the process of threat modeling into our pipeline? A: Here's a brief explanation: - CI/CD is about automating the building, testing, and deploying of your application. - Threat Modeling is a proactive security practice that identifies potential vulnerabilities in your application. While CI/CD itself doesn't directly perform threat modeling, it can automate certain aspects and trigger security checks based on your threat model. For example: - Integrate SAST (Static Application Security Testing) tools that can flag potential security issues in the code based on common coding vulnerabilities. - E.g., Nikto, SSlyze, Nmap. - Integrate DAST (Dynamic Application Security Testing) tools that can scan your application for vulnerabilities while it's running. - E.g., OWASP ZAP. We cover more of these practices in our CDP course. In summary: - Identifying potential threats is the responsibility of the threat modeling team. - Implementing security practices and integrating scanning tools into the pipeline is the responsibility of the DevOps team. - Addressing and fixing vulnerabilities discovered during the scanning process is the responsibility of the development team.

Last updated on Jan 28, 2026

Certificate of Completion vs Certified Certification

Certificate of Completion vs Certified Certification These are two different credentials. Completing the course and passing the exam are not the same thing. Certificate of Completion You earn a Certificate of Completion by finishing all mandatory course work. That includes: - All mandatory labs - All mandatory quizzes - Any other content marked as mandatory Optional content does not block this certificate. When you have completed every mandatory item, you can download the Certificate of Completion from the course page. This certificate typically includes CPE credits. A Certificate of Completion shows that you finished the required training. It is not the same as being certified. Certified Certification You earn the Certified credential by passing the certification exam. You do not need to finish all mandatory labs, quizzes, or other mandatory course work before you: - Schedule the exam - Take the exam - Pass the exam and receive the Certified credential You can book and complete the exam even if some mandatory course items are still unfinished. Once you pass, you receive the official Certified certification for that course. Schedule the exam through the Members Portal: https://members.practical-devsecops.training Quick comparison | | Certificate of Completion | Certified Certification | | --- | --- | --- | | How you get it | Complete all mandatory labs, quizzes, and other mandatory items | Pass the certification exam | | Do you need to finish all mandatory work? | Yes | No | | Can you schedule the exam without finishing the course? | Not required for this certificate | Yes | | What it proves | You completed the required training | You passed the official exam | Summary - Finish all mandatory work: Certificate of Completion - Pass the exam: Certified certification - You can schedule and take the exam without completing every mandatory item If you are unsure which one you have earned, check your course page for the Certificate of Completion download, and the Members Portal for exam scheduling and Certified status.

Last updated on Sep 14, 2026

Certificate of Completion vs Certified Certification

Our courses lead to two different documents, and they have different requirements. Mixing them up is the most common source of confusion about exam eligibility, so this article sets out exactly what each one needs. The Two Credentials Certificate of Completion A printable proof that you have finished the mandatory components of a course: the mandatory exercises and the mandatory videos. It is issued by the learning platform, and it does not involve an exam. Certified credential The official certification you earn by passing the practical exam. It comes with a PDF certificate and a digital badge. It is awarded on the basis of your exam result alone. What Each One Requires Do you need to finish all mandatory work? Certificate of Completion: Yes. All mandatory exercises and mandatory videos must be complete. Certified exam: No. Do you need to pass the exam? Certificate of Completion: No. It is available regardless of exam status. Certified exam: Yes. Passing the exam is the only requirement. Do optional labs matter? Neither credential requires optional labs. Optional content never blocks either one. Exam Eligibility in Detail You do not need to finish all mandatory labs, quizzes, or other mandatory course work before you: - Schedule the exam - Take the exam - Pass the exam and receive the Certified credential You can book and complete the exam even if some mandatory course items are still unfinished. Completing the mandatory curriculum first is recommended, because the exam tests the skills those labs teach. It is a preparation recommendation, not a gate. Choosing What to Do First If your goal is the Certified credential, you can book the exam whenever you are ready. Working through the mandatory exercises beforehand will make you better prepared, but nothing stops you from sitting the exam either way. If you also want the Certificate of Completion, finish every mandatory exercise and video in the portal. You can do this before or after your exam, in any order. Frequently Asked Questions Do I need to finish the mandatory parts to get into the exam? No. You can schedule and sit the exam with mandatory exercises, videos, and challenges unfinished. Do I have to finish the whole course before the exam? No. Finishing the course is not required for the exam. It is only required for the Certificate of Completion. Are the mandatory labs required for exam eligibility? No. Nothing in the course gates exam eligibility. The mandatory labs are recommended preparation because the exam tests those skills. Is anything required to sit the exam? Only that you book it within your certification deadline. There is no completion requirement. Can I get the Certificate of Completion without taking the exam? Yes. Once all mandatory course elements are complete, the certificate is available regardless of exam status. Can I pass the exam without the Certificate of Completion? Yes. The two are independent.

Last updated on Sep 15, 2026