DevSecOps › Module 10 › Lesson 1
Checklist
Topic 36 capstone checklist — DevSec mindset, pipeline security, SAST/secrets, DAST, IaC, containers, runtime/supply chain, findings/governance on `$DEVSEC_LAB`.
Visual · t36_capstone_checklist
Checklist consolidates DevSecOps literacy pillars. $DEVSEC_LAB only. Original Cyberlium.
Opening
Capstone proves DevSecOps literacy on YOUR authorized `$DEVSEC_LAB` repos — not stranger org pipelines or sabotage recipes.
Assemble checklist covering Modules 1–9: DevSec mindset and lab scope, DevSecOps fundamentals, pipeline security, SAST and secrets, DAST literacy, IaC security, containers in pipeline, runtime and supply chain, findings and governance. Use on capstone walk of YOUR `$DEVSEC_LAB` — never stranger org pipeline scans, never pipeline sabotage recipes, never unauthorized prod deploy or merge bypass, never malicious image or package recipes. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t36-devsec/. Integrity rows: `$DEVSEC_LAB` only, YOUR repos authorized, no sabotage recipes, limitations documented.
1. Scope and ethics
$DEVSEC_LAB named with repo inventory reference. NEVER stranger org pipeline scans, NEVER sabotage recipes, NEVER unauthorized prod deploy, NEVER malicious image/package guides.
Checkov/Trivy modules = scan YOUR stubs and images — not weaponized CI abuse.
Command guide
Try these commands — Scope and ethics
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Pipeline, SAST/secrets, DAST, IaC, containers, runtime/supply chain, findings/governance — linked rows.
Cross-link Topic 35 Purple Teaming as upstream context — separate authorized track.
3. Teardown
Notes secured chmod 600, evidence pack ready, lab stubs archived per brief.
Retention note for mentor handoff.
4. What you ship: Topic 36 capstone checklist
One-page DevSecOps literacy capstone checklist for $DEVSEC_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'pipeline sabotage recipe for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Pipeline sabotage recipes required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice