DevSecOps › Module 6 › Lesson 3
Checkov Named
Checkov literacy — policy ID, framework mapping, scan command stub, fail/warn severity, baseline file — named Checkov rows on YOUR `$DEVSEC_LAB` stubs.
Visual · t36_checkov_named
Checkov = named scan literacy. $DEVSEC_LAB. Original Cyberlium.
Opening
Checkov scans YOUR Terraform — name policy IDs and severity rows on YOUR lab stubs, never weaponize scan output against stranger org pipelines.
Checkov named literacy names: policy ID row category (CKV_AWS literacy stub), framework mapping category (Terraform, CloudFormation literacy), scan command stub category, fail vs warn severity category, and baseline/suppression file category. Analyst documents Checkov scan card on `$DEVSEC_LAB` Terraform stub — command stub, three policy IDs from sample output, severity mapping — without running Checkov against stranger org repos, without publishing scan results to shame third parties, without pipeline sabotage using forged findings. Cyberlium teaches Checkov vocabulary on YOUR labeled notes — defender shift-left only. Refused: stranger org scans, forged findings, sabotage recipes. Lab row: Checkov scan card (command stub, three policy IDs, severity, baseline note).
1. Named Checkov rows
Policy ID, framework mapping, scan command, severity, baseline file — five literacy anchors.
Each policy ID cites YOUR lab stub output — not copied stranger org reports.
Command guide
Try these commands — Named Checkov rows
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Aqua Trivy action (https://github.com/aquasecurity/trivy-action); NIST SSDF PO.3 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Severity discipline
Fail vs warn mapping documented — not all findings treated equal.
Baseline file literacy explains accepted risk on lab stub — not silent ignore.
3. Refused
No Checkov runs against stranger org repos; no forged findings; no pipeline sabotage.
Checkov literacy supports YOUR IaC hygiene — not offensive CI abuse.
4. What you ship: Checkov scan card
Command stub + three policy IDs + severity mapping + baseline note + NEVER stranger org scan line.
5. What you record before the next lesson
Checkov scan card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Checkov against stranger org public Terraform repo and publish results to 'expose' their misconfigs.
Right
Checkov scan card from `$DEVSEC_LAB` stub. Next: IaC Lab.
Mission: Checkov scan card
1) Name five Checkov literacy rows. 2) Scan command stub for lab Terraform. 3) Three policy IDs with severity each. 4) Write NEVER stranger org scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Baseline vs suppression — literacy split?”
Knowledge Check
APPLY: Checkov literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Publishing stranger org Checkov results is course lab.
True or False
Knowledge Check
APPLY: Checkov scan card includes:
Multiple choice