Practical DevSecOps

Practical DevSecOps Team
  • 0,0 (0)
  • KHÓA HỌC

Practical DevSecOps is a global cybersecurity education company specializing in hands-on DevSecOps, AI Security, and Application Security training and certifications. Listed on the NICCS/CISA National Initiative for Cybersecurity Careers and Studies platform, Practical DevSecOps has trained over 12,500 security professionals across 108+ countries and is trusted by organizations including Roche, Accenture, IBM, PWC, and Booz Allen Hamilton. 𝗪𝗵𝗮𝘁 𝗪𝗲 𝗢𝗳𝗳𝗲𝗿 Our certification programs are built for practitioners, not theory. Every course is delivered through browser-based labs where learners attack and defend real systems, with no downloads or installations required. Current certifications include: CDP - Certified DevSecOps ProfessionalCDE - Certified DevSecOps ExpertCAISP - Certified AI Security ProfessionalCCSE - Certified Container Security ExpertCCNSE - Certified Cloud Native Security ExpertCTMP - Certified Threat Modeling ProfessionalCASP - Certified API Security ProfessionalCSSE - Certified Software Supply Chain Security ExpertCSC -Certified Security Champion 𝗪𝗵𝗼 𝗪𝗲 𝗧𝗿𝗮𝗶𝗻 Security engineers, DevSecOps engineers, AppSec professionals, Red Teamers, and Security Leaders at Fortune 500 companies, Defense Agencies, and Government Organizations worldwide. 𝗛𝗲𝗮𝗱𝗾𝘂𝗮𝗿𝘁𝗲𝗿𝘀: San Francisco, USA𝗙𝗼𝘂𝗻𝗱𝗲𝗱: 2018𝗪𝗲𝗯𝘀𝗶𝘁𝗲: practical-devsecops.com

  1. OWASP MCP Top 10: 2026 Security Framework and MCP Security Certification

    6 GIỜ TRƯỚC

    OWASP MCP Top 10: 2026 Security Framework and MCP Security Certification

    In this episode, we dive deep into the OWASP MCP Top 10, the first official security framework dedicated to the Model Context Protocol (MCP).  Ready to lead your team’s AI security strategy and bridge the skills gap? Enroll in the Certified MCP Security Expert (CMCPSE) Course today! Get hands-on experience in tool poisoning labs, OAuth 2.1 hardening, MCP red-teaming, and shadow server detection. This is the definitive certification to secure agentic AI in 2026. This framework addresses a critical shift in the threat model: as agentic AI moves into production, agents no longer rely on a small, hardcoded toolset but instead discover tools at runtime from any reachable server. This transition has turned every MCP server into a high-stakes trust boundary. We explore the sobering reality of 2026 security, where over 30 CVEs targeting MCP were filed in the first two months of the year alone; with shell injections making up 43% of those attacks. We break down the most critical risks, including: MCP01 (Token Mismanagement): How attackers exploit hard-coded credentials and long-lived tokens through prompt injection. MCP03 (Tool Poisoning): The danger of malicious instructions hidden in tool descriptions that the model reads, but the user never sees. MCP05 (Command Injection): The leading attack pattern in 2026, where agents build dangerous shell commands from untrusted input. MCP09 (Shadow MCP Servers): The risk of rogue servers impersonating trusted ones to hijack tool calls. Finally, we discuss a week-by-week prioritization strategy to help security teams close the most dangerous gaps first, starting with token hygiene and OAuth 2.1 implementation. With a massive skills gap currently facing the industry, mastering these categories is no longer optional for AppSec engineers. https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    20 phút
  2. Navigating the Path to Application Security Manager in 2026

    24 THG 4

    Navigating the Path to Application Security Manager in 2026

    Transitioning from a technical engineer to an Application Security (AppSec) Manager is rarely a straight line; it requires balancing technical expertise with the strategic mindset needed to lead a department.  In this episode, we break down the realistic 5–8 year career path for aspiring leaders, moving from hands-on development to managing end-to-end security programs. We dive into the "messy reality" of the role, where you must act as the bridge between fast-moving engineering teams and CTOs focused on the bottom line. Learn why the Security Champion phase is the most critical step in your journey, helping you develop the "influence without authority" and communication skills that define successful managers.  We also explore the KPIs that actually matter to leadership—like Mean Time to Remediate (MTTR) and developer adoption rates—and the essential technical skills in SAST, DAST, and threat modeling you'll need to stay sharp. Whether you are a developer looking to pivot or a senior engineer ready for the manager's seat, this episode provides a step-by-step blueprint for running a modern AppSec program. Ready to accelerate your career? The transition from individual contributor to security leader happens in the Security Champion phase. Don't just find vulnerabilities—learn to build the systems that fix them. Enroll in the Certified Security Champion (CSC) course today for just $599. Gain hands-on experience with 40+ guided exercises in secure CI/CD pipelines, SAST/SCA tooling, and threat modeling to prove you’re ready for the next level. [Enroll in the Certified Security Champion Course Now] https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    22 phút
  3. DevSecOps Certification Guide: CDP vs. ECDE Comparison and Courses

    3 THG 4

    DevSecOps Certification Guide: CDP vs. ECDE Comparison and Courses

    Welcome to The DevSecOps Edge, the podcast dedicated to helping you become one of the top 1% of cybersecurity engineers in the industry. In a world where APIs account for 80% of internet traffic and 94% of web breaches start at the API layer, staying ahead of the curve isn't just an advantage—it's a necessity. In our featured episodes, we tackle the biggest questions facing security professionals today. Our deep-dive comparison, "CDP vs. ECDE: Which DevSecOps Certification Is Worth Your Time?", breaks down the critical differences between the Certified DevSecOps Professional (CDP) and EC-Council’s Certified DevSecOps Engineer (ECDE). We explore why seasoned practitioners are moving away from traditional multiple-choice exams (MCQs) in favour of hands-on, practical assessments. What you’ll learn in this series: Practical vs. Theoretical: Why the CDP’s 6-hour practical exam and 100+ browser-based labs are considered the gold standard for proving real-world capability compared to the 4-hour MCQ format of the ECDE. Career & Salary Impact: A look at the data showing that CDP holders frequently see a 15–20% salary increase within 12 months of certification, with senior roles in the US reaching average salaries of $174,900. The Toolset of 2026: How to master the tools engineers actually use, including GitLab CI, GitHub Actions, OWASP ZAP, and DefectDojo. Specialised Security Frontiers: Briefings on emerging tech, including AI Security (CAISP), Cloud-Native Security (CCNSE), and Software Supply Chain Security (CSSE). Lifetime Value: The benefits of a lifetime credential with no renewal fees or expiry-driven recertification cycles. This podcast is designed for Security Engineers, DevOps Engineers, Application Security Analysts, and Penetration Testers who want to demonstrate real-world pipeline security skills rather than just theoretical knowledge. Hosted by industry experts and drawing on insights from Practical DevSecOps—a specialist provider trusted by organisations like IBM, PwC, and Accenture—we provide research-backed insights you can actually use. Stop memorising study guides and start building secure CI/CD pipelines. Subscribe to The DevSecOps Edge and take the next step in your professional journey https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    20 phút
  4. Exploiting Hidden Endpoints and Centralizing Defense with Kong - Your API Documentation is a Lie

    20 THG 3

    Exploiting Hidden Endpoints and Centralizing Defense with Kong - Your API Documentation is a Lie

    Is your API documentation telling the truth? In this episode, we dive into the uncomfortable reality that API documentation is often a "lie" because of the gap between Swagger files and what is actually running in production. We explore how attackers exploit this gap using advanced fuzzing techniques and JWT manipulation, and why a centralised defense strategy using Kong API Gateway is the only way to effectively secure modern microservices. Key Topics Covered: The JWT Illusion: We debunk the myth that JSON Web Tokens (JWTs) are inherently secure. Because JWTs are encoded rather than encrypted, anyone who intercepts a token can read its payload in seconds. We discuss how attackers exploit servers that "trust" whatever a token says without a second opinion, leading to unauthorized admin access through signature flaws or "alg: none" exploits. The Power of API Fuzzing: Learn how attackers use the predictability of REST naming conventions to guess hidden routes. We highlight the use of high-speed tools like ffuf to fire tens of thousands of requests at a server to map out an application's shadow attack surface. The 405 Signal: Discover the "single most useful technique" in API discovery: the 405 Method Not Allowed response. While many security teams ignore this, it tells an attacker exactly where hidden admin or registration endpoints exist, even if they are unauthorized to access them at that moment. The Microservice Security Trap: Why writing security logic into every individual microservice is a "losing strategy". We explain how this creates a patchwork of inconsistent controls where one weak, legacy service can compromise the entire perimeter. Centralising Defense with Kong Gateway: We break down how Kong acts as a gatekeeper, ensuring no request reaches the backend without passing through global security controls. Learn how to use rate limiting to kill automated attacks and the critical importance of disabling direct access to backend server IP addresses. Featured Experts: This episode draws on a hands-on workshop led by Marudhamaran Gunasekaran, Principal Security Consultant, and insights from Aditya Patni, Security Research Writer at Practical DevSecOps. Call to Action: Stop relying on optional security suggestions. If you want to build real-world API security skills, check out the Certified API Security Professional (CASP) program, which focuses on hands-on labs rather than multiple-choice theory. You can also watch the full API Security Workshop on the Practical DevSecOps YouTube channel to see these exploits and defenses in action. Don't let an attacker find your hidden endpoints before you do. https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    21 phút
  5. CAISP vs. OSAI Certification Comparison Guide

    5 THG 3

    CAISP vs. OSAI Certification Comparison Guide

    n this episode, we tackle the rapidly evolving landscape of artificial intelligence and the critical need for specialized security expertise. As Large Language Models (LLMs) and autonomous agents become integrated into the modern enterprise, they bring a new set of risks, including prompt injection, training data poisoning, and insecure plugin designs.  To help you navigate your career path in this high-demand field, we provide an in-depth comparison of two premier certifications: the Certified AI Security Professional (CAISP) from Practical DevSecOps and the Advanced AI Red Teaming (OSAI) from OffSec. What You’ll Learn in This Episode: The Full-Spectrum Defensive Path: We explore why CAISP is the top choice for security engineers, AppSec leads, and DevSecOps professionals. Discover how it covers the full AI security lifecycle, from threat modeling with STRIDE and StrideGPT to securing AI pipelines against "poisoned pipeline" attacks. The Offensive Specialist Path: We dive into the OffSec OSAI, a certification designed for dedicated Red Teamers. Learn about its focus on adversarial operations, Retrieval Augmented Generation (RAG) abuse, and its grueling 48-hour endurance exam. Practical Skills for the Real World: We discuss the importance of hands-on experience. CAISP offers browser-based labs that allow you to start practicing immediately, covering essential frameworks like the OWASP LLM Top 10 and MITRE ATLAS. Career Growth and ROI: Understand the market demand that is driving a 15-20% salary increase for professionals who transition into AI-focused roles. We also explain how digital badges from platforms like Credly can help you prove your expertise to hiring managers. The Ultimate Comparison: We break down the key differences in exam styles—CAISP’s 6-hour practical challenge versus OSAI’s 48-hour red team engagement—to help you decide which path aligns with your professional goals. Which Certification is Right for You? Whether you are looking to build and defend production AI systems or specialize in high-level offensive exploitation, this episode provides the roadmap you need to stay relevant. CAISP is the industry favourite for those needing versatile, job-aligned skills to manage supply chain risks with AIBOMs and model signing, while OSAI is the definitive choice for full-time penetration testers. Join us as we break down the complexities of AI security and help you take the next step in your cybersecurity journey. https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    22 phút
  6. SLSA Framework: The Definitive Guide for Securing Your Software Supply Chain

    28 THG 2

    SLSA Framework: The Definitive Guide for Securing Your Software Supply Chain

    In this episode, we dive deep into the SLSA (Supply-chain Levels for Software Artifacts) framework, the definitive standard for securing your software supply chain. With software supply chain attacks increasing by 742% between 2019 and 2022, understanding frameworks like SLSA—pronounced "salsa"—is no longer optional; it is an operational reality. We explore the origins of SLSA, which began at Google as "Binary Authorization for Borg" before being contributed to the Open Source Security Foundation (OpenSSF) in 2021. We break down what SLSA provides: a common vocabulary for security maturity, verifiable provenance metadata, and incremental security levels that align with NIST SSDF and EO 14028 requirements. Join us as we dissect the four SLSA security levels, from Level 0 (the default state of no provenance) to Level 3, which mandates hardened builds with isolated and ephemeral environments. We discuss how these Level 3 protections could have potentially stopped major breaches like the SolarWinds attack by preventing persistent access to build environments and isolating signing keys. We also touch on other high-profile incidents like Codecov and Log4Shell that highlight the urgent need for artifact integrity. The episode also covers the technical mechanics of SLSA, specifically "provenance"—the tamper-evident metadata that answers who built an artifact, what sources were used, and how it was constructed. We examine the Sigstore toolchain, including Cosign, Fulcio, and Rekor, which enables the "keyless" cryptographic signing essential for modern supply chain security. For those ready to move from theory to practice, we outline a implementation roadmap starting from Level 1 (fully scripted builds) to Level 3 (enforced verification in production), a journey that typically takes between three to six months. We also highlight the critical roles of different stakeholders, from developers signing commits to organizations establishing policy enforcement at deployment boundaries. Finally, we address the limitations of the framework—noting that it focuses on build integrity rather than code quality or runtime security—and point you toward the Certified Software Supply Chain Security Expert (CSSE) course for those ready to master these concepts through hands-on labs. Whether you are an AppSec engineer, a security professional, or a cybersecurity analyst, this episode provides the practical, research-backed insights you need to defend against source tampering, dependency poisoning, and provenance forgery. Key Topics Covered: Defining SLSA and its role in the OpenSSF. The 742% increase in supply chain attacks and lessons from SolarWinds. The roadmap from Level 0 to Level 3 "Hardened Builds". The power of Sigstore and cryptographic provenance. Common implementation mistakes, such as skipping Level 1 or ignoring verification. How to get certified as a Software Supply Chain Security Expert. Upgrade your security career today by mastering the framework that secures the world's most critical workloads. https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    23 phút
  7. DevSecOps Statistics in 2026: Market Growth, Adoption Trends, and Strategic Insights

    20 THG 2

    DevSecOps Statistics in 2026: Market Growth, Adoption Trends, and Strategic Insights

    In this episode, we explore the explosive growth of the DevSecOps market, which is projected to reach between USD 8.58 billion and USD 10.88 billion by 2026. Driven by cloud-native transitions, AI integration, and intensifying regulatory pressures, the industry is witnessing a compound annual growth rate (CAGR) of up to 22.10%. Course Page:  https://www.practical-devsecops.com/certified-devsecops-professional/ What You’ll Learn in This Episode: • The Financial Landscape: Why DevSecOps engineering has become a high-demand career with massive salary potential. We break down the 2026 salary benchmarks, where entry-level roles average $100,000 and senior-level experts earn up to $210,000. • The Rise of AI & Emerging Threats: How AI-generated code is expanding attack surfaces and why 75% of organizations are now using or planning to use AI/ML bots for code reviews. • Skills That Move the Needle: Discover the high-value expertise in Kubernetes security, Terraform, Infrastructure as Code (IaC), and CI/CD automation that can lift your pay by 20-40% over traditional roles. • Market Dynamics: A look at why North America holds a dominant 36.5% market share, fueled by federal SBOM mandates, while the Asia-Pacific region emerges as the fastest-growing market with a 22.7% CAGR. Deep Dive into Education & Certification: We discuss the critical importance of specialized training to stay competitive. The sources highlight essential certifications like the Certified DevSecOps Professional (CDP), which focuses on securing the SDLC, and the Certified AI Security Professional (CAISP), covering the OWASP Top 10 for LLMs and MITRE ATLAS defenses. We also examine the role of Certified Cloud Native Security Experts (CCNSE) and Threat Modeling Professionals (CTMP) in building resilient, "shift-smart" workflows. Strategic Insights for 2026: • The Speed vs. Risk Tradeoff: Why nearly half of development teams still deploy vulnerable code under time pressure despite achieving 60% faster release cycles. • Vulnerability Trends: An analysis of why infrequently deployed services have 47% more outdated dependencies, often leaving them vulnerable to unpatchable CVEs. • The Shift to Managed Services: Why organizations are increasingly turning to managed services for AI tuning and red-teaming support. Whether you are looking to break into the field or are a seasoned professional aiming for the top 1% of cybersecurity engineers, this episode provides the research-backed insights and practical roadmaps needed to navigate the 2026 DevSecOps landscape. Tune in to learn how to integrate security into every stage of your workflow and secure your place in this multi-billion dollar industry. https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    16 phút
  8. LLM Jacking – The $46,000-a-Day Security Threat

    9 THG 2

    LLM Jacking – The $46,000-a-Day Security Threat

    In this episode, we dive deep into one of the most pressing financial and security threats facing organizations in 2026: Featured Resource: If you are responsible for securing AI infrastructure, this episode highlights the technical controls covered in the Certified AI Security Professional (CAISP) course, which includes hands-on labs for defending against the OWASP Top 10 LLM vulnerabilities and mastering the MITRE ATLAS framework. LLM Jacking. While many security discussions focus on prompt injection or model poisoning, LLM jacking is a different beast entirely—it is a direct infrastructure compromise where attackers hijack your cloud credentials to consume your expensive AI resources. A single hijacked Large Language Model can cost an organization over $46,000 a day in fraudulent charges. We break down why this has moved from a theoretical risk to a daily reality for security architects and AI developers. In this episode, we cover: • Defining the Threat: Understand why LLM jacking is an infrastructure failure, distinct from model manipulation like prompt injection. • The 3-Stage Anatomy of an Attack: We trace the attacker’s journey from the Initial Compromise (often through leaked API keys or unpatched software) to Discovery and Weaponization, where stolen access is sold or used to generate malicious content. • The "Smoking Gun": Learn the technical indicators of compromise (IoCs), such as specific ValidationException errors in AWS Bedrock or unusual geographic spikes in API traffic. • Real-World Case Study: We examine a fintech startup’s nightmare scenario—how a single static AWS key committed to GitHub led to a 700% cost overrun in just two weeks. • Defense & Incident Response: From architecting Zero Trust AI pipelines to a 15-minute containment playbook, we provide actionable strategies to protect your environment. • The Future of AI Security: Why the rising cost of model inference and the move toward proprietary, fine-tuned models make AI infrastructure a high-value target for 2026 and beyond. Tune in to learn how to ensure security is a foundational part of your AI strategy, rather than a costly afterthought. https://www.linkedin.com/company/practical-devsecops/ https://www.youtube.com/@PracticalDevSecOps https://twitter.com/pdevsecops

    13 phút
Xem tất cả (25)

Giới Thiệu

Practical DevSecOps is a global cybersecurity education company specializing in hands-on DevSecOps, AI Security, and Application Security training and certifications. Listed on the NICCS/CISA National Initiative for Cybersecurity Careers and Studies platform, Practical DevSecOps has trained over 12,500 security professionals across 108+ countries and is trusted by organizations including Roche, Accenture, IBM, PWC, and Booz Allen Hamilton. 𝗪𝗵𝗮𝘁 𝗪𝗲 𝗢𝗳𝗳𝗲𝗿 Our certification programs are built for practitioners, not theory. Every course is delivered through browser-based labs where learners attack and defend real systems, with no downloads or installations required. Current certifications include: CDP - Certified DevSecOps ProfessionalCDE - Certified DevSecOps ExpertCAISP - Certified AI Security ProfessionalCCSE - Certified Container Security ExpertCCNSE - Certified Cloud Native Security ExpertCTMP - Certified Threat Modeling ProfessionalCASP - Certified API Security ProfessionalCSSE - Certified Software Supply Chain Security ExpertCSC -Certified Security Champion 𝗪𝗵𝗼 𝗪𝗲 𝗧𝗿𝗮𝗶𝗻 Security engineers, DevSecOps engineers, AppSec professionals, Red Teamers, and Security Leaders at Fortune 500 companies, Defense Agencies, and Government Organizations worldwide. 𝗛𝗲𝗮𝗱𝗾𝘂𝗮𝗿𝘁𝗲𝗿𝘀: San Francisco, USA𝗙𝗼𝘂𝗻𝗱𝗲𝗱: 2018𝗪𝗲𝗯𝘀𝗶𝘁𝗲: practical-devsecops.com

Thông Tin

  • Nhà sáng tạo
    Practical DevSecOps Team
  • Năm hoạt động
    2025 - 2026
  • Tập
    25
  • Xếp hạng
    Sạch
  • Bản quyền
    © 2026 Practical DevSecOps
  • Trang web chương trình
    Practical DevSecOps

Có Thể Bạn Cũng Thích