Docker, DevOps & Security in Enterprise Environments

Docker, Microservices, Containers, DevOps, Continuous Integration/Deployment/Delivery - all of those terms heavily dominate modern application development teams and processes. This training will explain the key DevOps technologies and focus on the following main questions:

• How strong and reliable are the isolation capabilities of Docker/Linux/OS containers?
• How do containers affect typical application and network architectures?
• Which changes are introduced by the CI/CD/Microservice paradigm into traditional development environments?
• How does a typical CI/CD pipeline look like?
• How can “security” be integrated into these new development/architecture paradigms?
• What additional attack surface and security challenges are introduced by the changed development landscape and additional tools?

All agenda topics will be supported by practical exercises and/or demos. At the end of the training, each attendee will have an automated environment where code changes can be deployed to staged hosting environments while being covered by various functional and/or security-related tests. The attendees will also know the concept behind the main buzzwords and tools described above and understand how they impact application architectures, development, and security posture.

Who should visit the training and why?

• IT Security Professionals who want to

• understand the technology behind the recent and common buzzwords listed above
• be able to evaluate the isolation capabilities of container solutions

• get ideas on how to integrate security into typical DevOps environments and continuous workflows

• Software Architects and Developers who want to

• learn about potential security vulnerabilities in common practices and tools
• understand the concerns of the security people
• improve their development chain by adding automated security checks

Due to the large amount of tools and technologies, this training will not be able to cover security aspects of every single technology in detail. However, we’re happy to receive specific questions before the training to potentially prepare additional material and you will get an overview how to approach unknown/new technologies from a security perspective.

Requirements

The attendees should have

• basic knowledge of the Linux bash and a command line-based text editor (e.g. nano or vim)
• a system with WLAN and an SSH client (i.e. PuTTY) which is able to connect via SSH to systems in the Internet.

For the exercises, we provide the needed infrastructure in a cloud environment which the attendees can connect to via SSH.