👋 It’s Black Friday Sale

Day

:

Hour(s)

:

Minute(s)

:

Second(s)

Buy Now
Study Later
p

Certified Software Supply Chain Security Expert (CSSE)TM

The Certified Software Supply Chain Expert Course offers a deep dive into the security risks associated with software supply chains, providing you with the knowledge and skills to identify, validate, and mitigate these risks. We will begin the course with an overview of the risks of using commercial, open-source, and proprietary third-party code. You will then explore security threats involving container and orchestration systems like Kubernetes and attack scenarios involving the cloud and its managed services. Finally, you will learn how to manage a Secure Software Supply Chain Program.

After the Software Supply Chain Expert course, you will be able to:

  • Understand the role of supply chain security in protecting organizations from attacks.
  • Identify various supply chain attacks and how they can be exploited via code, container, clusters, and cloud.
  • Develop strategies for assessing and mitigating supply chain risks.
  • Develop an understanding of best practices for supply chain management and security, including guidance from the SDF, CIS, SLSA, and SCVS frameworks.
Enroll Now
Watch Video
×
Load iframe content

Top Rated Course

Check Out Reviews

  • Self-paced Learning Mode
  • Browser-based Lab Access
  • 24/7 Instructor Support via Mattermost

Prerequisites

  1. Course participants should have knowledge of running basic Linux commands like ls, cd, mkdir, etc.,
  2. Basic knowledge of Git, CI/CD pipelines, containers, and Cloud Platforms.
  3. A good understanding of OWASP Top 10 vulnerabilities.
  4. Familiarity with any scripting language like Python, Golang, or ruby helps. However, it’s not a necessity.

Chapter 1: Introduction to Supply Chain Security

  1. Course Introduction (About the course, syllabus, and how to approach it) 
  2. About Certification and how to approach it
  3. Course Lab Environment
  4. Lifetime course support (Mattermost)
  5. An overview of the Supply Chain Security
  6. Supply Chain Security Building Blocks
    1. Code Creation
      1. Source Code Management (SCM)
      2. Internal and external (third-party) software inventory
      3. Build system (CI/CD)
      4. Application
    2. Containers
    3. Clusters
    4. Cloud
  7. Threat Model of Software Supply Chain
    1. Overview of Code Creation (SCM, CI/CD and Application)
    2. Overview of Containers
    3. Overview of Clusters
    4. Overview of Cloud
  8. Evolution of Software Supply Chain Security
  9. Hands-on Exercise: 
    1. Learn how to use our browser-based lab environment
    2. How CI/CD Works
    3. Working with Gitlab CI/CD
    4. Understanding Stages in CI/CD Pipelines
    5. Continuous Deployment
    6. How the Equifax Hack Happened

Chapter 2: Attacking Code and Application Supply Chain

  1. Introduction to code supply chain
  2. Code creation process and systems involved
    1. Source code management (git, svn)
    2. Package managers
    3. Build and CI/CD systems
  3. Attacks on SCM systems
    1. Breaking out of restricted Git shells
    2. Git servers leaking confidential information
    3. Exploiting pre-commit hooks
    4. Repo Jacking
    5. Executing Arbitrary Code With Git Commands
    6. Risks of unencrypted Git traffic
    7. Insufficient Authentication In Git Servers
  4. Supply Chain Attacks on package managers
    1. Magecart attack in an Airways
    2. Supply Chain Attacks on CDNs
    3. Bypassing security mechanisms like CSP
    4. Typo-squatting techniques
    5. Combosquatting
    6. Brandjacking
    7. Dependency confusion
    8. Abusing IDE behaviors through dependency confusion
    9. Package Masquerading
    10. Abusing Generative AI for package masquerading
  5. Attacks on Build and CI/CD Systems
    1. Poisoning build pipelines for complete pwnage
    2. Manual code reviews and sneaking PR/MR
    3. Abusing webhooks to compromise CI/CD systems
    4. Cross Build Injection (XBI) Attacks
    5. Misconfigured Github Actions
  6. Attacks on Application Side
    1. Injection attacks
    2. Cross Site Scripting (XSS)
    3. Server Side Request Forgery
  7. Real-World case studies of code supply chain attack
    1. Stealing environment variables from build servers
    2. Exposing private source code on GitHub
    3. Leaking source code of patented technologies
    4. Stolen code-sign certificates or signed malicious apps
  8. Best practices for securing application supply chain
    1. SBOMs
    2. Code Signing and Commit Signing
    3. Artifact Signing
    4. Dependency Hashing
    5. Dependency Pinning
    6. Defending GitHub Actions With Pinning
  9. Technologies and solutions for securing applications
    1. SCA
    2. SAST
    3. DAST
    4. Fuzz Testing
  10. Hands-on Exercises:
    1. Dependency confusion
    2. GitLab privilege escalation
    3. Git commit spoofing
    4. Git commit signing
    5. Typosquatting dependency
    6. How the Codecov attack happened
    7. Working with pre-commit hooks
    8. Exploiting pre-commit hooks
    9. Software Component Analysis (SCA)
    10. Static Application Security Testing (SAST)
    11. SCA/SAST using pre-commit hooks
    12. Dynamic Analysis

Chapter 3: Attacking Container Supply Chain

  1. Introduction to container technology
    1. What is a container
    2. Basics of container
  2. Ways to interact with containers ecosystem
  3. Attack surface of containers and supply chain risks
    1. Overview of container security
    2. Attack surface of the container ecosystem
    3. Attack surface analysis using native and third party tools
      1. Attack surface analysis with native tools
      2. Kernel features: Namespaces, Cgroups, Capabilities
  4. Attacking Container Supply Chain ecosystem
    1. Malicious images
    2. Insecure container registry
    3. Attacking through container misconfigurations
  5. Best practices for securing container applications
    1. Container Image Security
      1. Distroless and scratch image
      2. Multi-stage builds
    2. Securing Docker daemon
  6. Technologies and solutions for securing containerized applications
    1. Docker host security configurations
      1. Seccomp
      2. Apparmour
      3. Image signing and Content Trust
  7. Hands-on Exercises:
    1. Working with docker command
    2. Creating container snapshots
    3. Malicious container image
    4. Backdooring docker image
    5. Attacking docker registry
    6. Exploiting containerized apps
    7. Unsecured docker daemon
    8. Minimize docker security misconfigurations
    9. Build a secure, miniature image to minimize attack footprint
    10. Typosquatting attack in docker image
    11. Backdooring docker image
    12. Malicious container image

Chapter 4: Attacking Kubernetes/Cluster Supply Chain

  1. Microservices and Kubernetes
    1. Introduction to Microservices Architecture
    2. Introduction to Kubernetes Architecture
  2. Core Components of Kubernetes
  3. Supply Chain Threats for a cluster
  4. Kubernetes Package Manager
    1. Helm and its security
    2. Understanding Helm charts workflow
    3. Creating Helm Charts
  5. Abusing Kubernetes Request Pipeline
    1. Authentication, Authorization, and Admission Controllers
    2. Attacks on Admission Controllers and webhooks
    3. Insecure RBAC rules
  6. Common Attack Vectors in Kubernetes Clusters
  7. Technologies and solutions for securing container orchestration
    1. Static analysis of Kubernetes clusters
    2. Dynamic analysis and runtime security of Kubernetes clusters
  8. Hands-on Exercises:
    1. Kubernetes basic commands
    2. Working with Kubernetes
    3. Kuberntes secrets
    4. Kubernetes service accounts
    5. Kubernetes networking using Calico
    6. Reconnaissance using Kube-hunter
    7. Stealing Kubernetes secrets
    8. Exploiting Kubelet API
    9. Privileged pods in Kubernetes
    10. Sniffing Kubernetes network traffic
    11. Kubernetes image scanning
    12. Static analysis of Kubernetes manifests

Chapter 5: Attacking Cloud Supply Chain

  1. Introduction to Cloud Ecosystem (Public, On-Premise)
  2. Cloud Attack Surface and Threat Matrix
  3. Shared Security Model of the Cloud
  4. Attack Vectors in AWS
    1. Misconfigurations (exposed secrets, metadata service, etc.)
    2. Attacking Managed Services Like S3, CloudFront CDN
    3. Attacking Serverless Computing
    4. Attacking Application Deployment Services
  5. Attack Vectors in Azure
    1. Misconfigurations (exposed secrets, metadata services, etc.)
    2. Attacking Azure Blob storage, Azure Application Gateway
    3. Attacking Azure Functions
    4. Attacking Web Apps
  6. Attack Vectors in GCP
    1. Misconfigurations (exposed secrets, metadata services, etc.)
    2. Attacking Google Cloud Storage GCS, Cloud CDN
    3. Attacking Google Cloud Functions
    4. Attacking Google Kubernetes Engine
  7. Best Practices for Securing the Cloud

Chapter 6: Common Defenses Against Supply Chain Attacks

  1. Prove the sanity of the software components using Cryptography
    1. Code Signing
    2. Component Signing
    3. Artifact signing
    4. The Update Framework
  2. Evaluate dependencies before use
    1. Analyze the security and compliance of dependencies
    2. Implement integrity checks or policies
  3. Implement Change Control
    1. Protected Branches
    2. Licensed Code
    3. Configuration management and change control
  4. Create asset Inventory
  5. Generate a Software Bill Of Materials
    1. Application SBOM
    2. Container SBOM
    3. Hosts SBOM
  6. Code Isolation and Sandboxing
  7. Automation of Common Controls in CI/CD
    1. Software Component Analysis of Code, and Containers
    2. Static Security Analysis of Application Code, Infrastructure as Code
    3. Dynamic Security Analysis of Applications, APIs, Containers, and Clusters
    4. Detecting Unexpected Behaviors Through Fuzz Testing
  8. Compliance and Governance of Supply Chain Risk
  9. Hands-on Exercises:
    1. Generate the SBOM for Application using Syft
    2. Generate the SBOM for Docker Image using Syft
    3. Create an SBOM with Tern
    4. Identify malicious Package using guarddog
    5. Finding Risky Packages using packj
    6. Secrets Scanning using Trivy
    7. Secrets Scanning using TruffleHog
    8. False Positive Analysis (FPA)
    9. Container Registry using Harbor
    10. Container Vulnerability Scanning using Snyk
    11. Scanning Docker for Vulnerabilities with Trivy
    12. Signing Container Images for Trust
    13. Container Malware Scanning using YaraHunter
    14. Find Misconfigured RBAC Using KubiScan
    15. Finding Misconfigurations Using Kubescape
    16. Finding Helm Charts Misconfigurations using Kubescape
    17. How to Embed Syft into CI/CD pipeline
    18. Scan SBOM for Vulnerabilities using bomber
    19. Implement SAST as part DevOps pipelines
    20. Implement DAST as part DevOps pipelines

Chapter 7: Managing a Secure Software Supply Chain Program

  1. Problems with current Supply Chain Attack Visibility
    1. Detection of only known vulnerabilities
    2. Detection of unknown vulnerabilities
  2. Creating a vetting process for software components (Commercial, Open Source, Third Party, and Proprietary Code) used throughout SDLC
  3. Automation of vetting and third-party code
  4. Software Supply Chain Industry Standards and Best Practices
    1. NIST C-SRM or SLSA
    2. NIST SSDF
    3. Software Component Verification Standard (SCVS)
    4. Secure Supply Chain Consumption Framework (S2C2F)
    5. Supply Chain Integrity Model
    6. Software Supply Chain Best Practices
    7. SBOM
    8. CycloneDX
    9. OpenSSF  – Automated
  5. Core Infrastructure Initiative  – Self Assessment
  6. Hands-on Exercises:
    1. Achieving SLSA Level 1 using GitLab
    2. Achieving SLSA Level 2 using GitLab
    3. Establish a vetting process for open-source components
    4. Working with Defect Dojo
    5. Vulnerability Management With DefectDojo
    6. Handling Dependency Hell

Practical DevSecOps Certification Process

  1. After completing the course, you can schedule the CSSE exam on your preferred date.
  2. Process of achieving Practical DevSecOps CSSE Certification can be found here.
Enroll Now
Back to course list