DevSecOps and Cloud Security Roadmap

Build security into pipelines and cloud infrastructure instead of bolting it on at the end.

10 milestones · ~135 hours total

1. 1

   Security fundamentals

   ~15h

   CIA triad, threat modelling, authentication vs authorization, TLS and common attack types.

   Practice this →
2. 2

   Web application security

   ~20h

   OWASP Top 10, injection, XSS, CSRF, broken access control and how to fix each in code.

   Practice this →
3. 3

   Git, CI/CD and pipeline basics

   ~10h

   Understand a typical pipeline in GitHub Actions or GitLab CI before you try to secure it.

   Practice this →
4. 4

   Secrets management

   ~8h

   Keep secrets out of repositories, use Vault or a cloud secrets manager and scan history with gitleaks.

   Practice this →
5. 5

   Static and dependency scanning

   ~14h

   SAST with Semgrep, dependency checks with tools like Trivy or OWASP Dependency-Check and triaging false positives.

   Practice this →
6. 6

   Container and image security

   ~12h

   Minimal base images, non-root users, image scanning, signing and Kubernetes pod security settings.

   Practice this →
7. 7

   Cloud IAM and least privilege

   ~18h

   Roles, policies, service accounts and permission boundaries on AWS or Azure; spot over-permissive policies.

   Practice this →
8. 8

   Infrastructure as Code security

   ~12h

   Scan Terraform with tfsec or Checkov, enforce policies and prevent public buckets and open security groups.

   Practice this →
9. 9

   Cloud network and data protection

   ~14h

   VPCs, security groups, private endpoints, encryption at rest and in transit and key management.

   Practice this →
10. 10

    Logging, detection and compliance basics

    ~12h

    Audit logs such as CloudTrail, alert on suspicious activity and map controls to a framework like CIS Benchmarks.

    Practice this →