Course Outline for E|CDE:
-
Understanding DevOps Culture
-
Introduction to DevSecOps
-
DevSecOps Pipeline—Plan Stage
-
DevSecOps Pipeline—Code Stage
-
DevSecOps Pipeline—Build and Test Stage
-
DevSecOps Pipeline—Release and Deploy Stage
-
DevSecOps Pipeline—Operate and Monitor Stage
EC-COUNCIL C|CDE
Description:
The DevSecOps market is rapidly growing, driven by the increasing number of cyberattacks and the need for secure applications to be delivered quickly. The average cost of a data breach is significant, as highlighted by IBM's report, reaching USD 401 million for breaches involving 50-65 million records. According to the Identity Theft Resource Center, in the first quarter of 2022, there were 398 data breach incidents affecting over 13 million victims. The DevSecOps market, valued at USD 3.73 billion in 2021, is projected to reach USD 41.66 billion by 2030, with an annual growth rate of 30.76%.
To meet this growing demand, the Certified DevSecOps Engineer (E|CDE) certification program from EC-Council provides hands-on training focused on practical skills to develop and secure applications and infrastructure. The course covers both on-premises and cloud-native environments (including AWS and Azure) and offers more than 80 practical labs. With 70% of the curriculum dedicated to labs, the E|CDE certification is highly regarded for integrating security into every stage of the Secure Software Development Lifecycle (SSDLC), making it one of the most sought-after certifications in the DevSecOps field.
Course Program E|CIH V2:
-
Introduction to Incident Handling and Response
-
Incident Handling and Response Process
-
Forensic Readiness and First Response
-
Handling and Responding to Malware Incidents
-
Handling and Responding to Email Security Incidents
-
Handling and Responding to Network Security Incidents
-
Handling and Responding to Web Application Security Incidents
-
Handling and Responding to Cloud Security Incidents
-
Handling and Responding to Insider Threats
Course Objectives for E|CDE:
-
Understand DevOps security bottlenecks and discover how the culture, philosophy, practices, and tools of DevSecOps can enhance collaboration and communication across development and operations teams.
-
Understand the DevSecOps toolchain and how to include security controls in automated DevOps pipelines.
-
Integrate Eclipse and GitHub with Jenkins to build applications.
-
Align security practices like security requirement gathering, threat modeling, and secure code reviews with development workflows.
-
Integrate threat modeling tools like Threat Dragon, ThreatModeler, and Threatspec; manage security requirements with Jira and Confluence; and use Jenkins to create a secure CI/CD pipeline.
-
Understand and implement continuous security testing with static, dynamic, and interactive application security testing and SCA tools (e.g., Snyk, SonarQube, StackHawk, Checkmarx SAST, Debricked, WhiteSource Bolt).
-
Integrate runtime application selfprotection tools like Hdiv, Sqreen, and Dynatrace that protect applications during runtime with fewer false positives and remediate known vulnerabilities.
-
Integrate SonarLint with the Eclipse and Visual Studio Code IDEs.
-
Implement tools like the JFrog IDE plugin and the Codacy platform.
-
Integrate automated security testing into a CI/CD pipeline using Amazon CloudWatch; Amazon Elastic Container Registry; and AWS CodeCommit, CodeBuild, CodePipeline, Lambda, and Security Hub.
-
Implement various automation tools and practices, including Jenkins, Bamboo, TeamCity, and Gradle.
-
Perform continuous vulnerability scans on data and product builds using automated tools like Nessus, SonarCloud, Amazon Macie, and Probely.
-
Implement penetration testing tools like gitGraber and GitMiner to secure CI/CD pipelines.
-
Use AWS and Azure tools to secure applications.
-
Integrate automated tools to identify security misconfigurations that could
-
expose sensitive information and result in attacks.
-
Understand the concept of infrastructure as code and provision and configure infrastructure using tools like Ansible, Puppet, and Chef.
-
Audit code pushes, pipelines, and compliance using logging and monitoring tools like Sumo Logic, Datadog, Splunk, the ELK stack, and Nagios.
-
Use automated monitoring and alerting tools (e.g., Splunk, Azure Monitor, Nagios) and create a real-time alert and control system.
-
Integrate compliance-as-code tools like Cloud Custodian and the DevSec framework to ensure that organizational regulatory or compliance requirements are met without hindering production.
-
Scan and secure infrastructure using container and image scanners (Trivy and Qualys) and infrastructure security scanners (Bridgecrew and Checkov).
-
Integrate tools and practices to build continuous feedback into the DevSecOps pipeline using Jenkins and Microsoft Teams email notifications.
-
Integrate alerting tools like Opsgenie with log management and monitoring tools to enhance operations performance and security
Exam Information:
• Exam name: E|CDE 312-97
• Test format: Multiple Choice
• Total number of questions: 100
• Test duration: 4 hours
• Required score: 70%
Course Duration:
6 Days | 24 Hours | 4 hours per day
Target Audience:
-
C|ASE-certified professionals
-
Application security professionals
-
DevOps engineers
-
Software engineers and testers
-
IT security professionals
-
Cybersecurity engineers and analysts
-
Anyone with prior knowledge of application security who wants to go to DevSecOps
Job Roles Aligned with the E|CDE
DevSecOps engineer
Senior DevSecOps engineer
Cloud DevSecOps engineer
Azure DevSecOps enginee
AWS DevSecOps engineer
DevSecOps analyst
DevSecOps specialist
DevSecOps operations engineer
DevSecOps systems administrator
DevSecOps systems engineer
DevSecOps consultant
DevSecOps CI/CD engineer
Infrastructure DevSecOps engineer
Course Brochures (click the icon)