Complete DevSecOps Pipeline Builder
Compose and reorder pipeline stages, generate a GitLab-style YAML model, inject application and supply-chain defects, set release policies, and run the workflow through production.
Saved progress0%
Teach DevSecOps as an operating system for secure delivery, not as a disconnected list of scanners.
The suite follows a single application from source control through automated testing, software-supply-chain controls, declarative deployment, production verification, monitoring, and incident response. Every lab is self-contained, safe to run in a classroom, and designed for experimentation rather than passive reading.
Interactive laboratories
Use independently or as a four-part sequence
Automated Security Gates Laboratory
Run simulated SAST, DAST, SCA, secret, IaC, and container scans; compare coverage; triage findings; manage exceptions; and decide whether a release should proceed.
Saved progress0%
Kubernetes and IaC Security Lab
Harden Kubernetes YAML, test policy-as-code rules, simulate admission decisions, apply NetworkPolicy, review RBAC, and evaluate a Terraform configuration for cloud exposure.
Saved progress0%
Software Supply Chain Incident Lab
Investigate dependency confusion, runner compromise, registry tampering, and secret leakage using audit data, SBOMs, signatures, provenance, logs, and response actions.
Saved progress0%
Principles demonstrated throughout the suite
Each principle appears in more than one technical context
Shared responsibility
Developers, security personnel, platform engineers, and operators contribute controls and evidence in the same delivery system.
Fast feedback
Low-cost checks run early, while environment-dependent verification runs after a deployable artifact exists.
Security as code
Pipeline rules, infrastructure, deployment policy, exceptions, and evidence are versioned and reviewable.
Risk-based gates
Automation supports decisions; it does not replace context, exploitability analysis, or accountable acceptance of residual risk.
Immutable promotion
The same identified artifact is tested, signed, verified, and promoted rather than rebuilt separately for each environment.
Continuous learning
Production telemetry and incidents create new tests, policies, threat models, and engineering priorities.
Assessment ideas
Ready-to-use individual or team activities
FOUNDATION
Pipeline rationale memo
Require students to justify stage placement, failure thresholds, and manual approvals rather than merely obtaining a green result.
ANALYSIS
Coverage and blind-spot matrix
Have teams map each seeded weakness to the tools that detect it, the tools that miss it, and the reason for the difference.
ENGINEERING
Hardened deployment review
Grade the final manifest, policy score, admission outcome, network restrictions, and explanation of operational tradeoffs.
RESPONSE
After-action report
Evaluate evidence quality, containment sequence, eradication, recovery criteria, and pipeline improvements after an incident.
Authoritative references used by the labs
Official documentation and recognized secure-development frameworks
NIST SP 800-218 SSDF 1.1Outcome-oriented secure software development practices.
NIST NCCoE DevSecOps resourcesDevSecOps and software supply-chain implementation resources.
OWASP DevSecOps GuidelineGuidance for embedding automated security activities into delivery pipelines.
OWASP SAMMA risk-driven model for assessing and improving software assurance maturity.
GitLab CI/CD pipelinesOfficial explanation of stages, jobs, runners, triggers, and pipeline configuration.
SLSA specificationCurrent approved supply-chain security tracks, levels, provenance, and verification concepts.
CycloneDX specificationSoftware and system transparency through bills of materials and related supply-chain data.
Kubernetes Pod Security StandardsPrivileged, Baseline, and Restricted policy profiles for pod security.
Sigstore Cosign documentationSigning and verifying software artifacts and container images.