Hands-On Labs

Objective Scan a public container image with Trivy and interpret the findings.

1. 01 Pull a deliberately outdated image

   bash

   Copy

   docker pull python:3.8-slim

2. 02 Run a vulnerability scan

   bash

   Copy

   trivy image --severity HIGH,CRITICAL python:3.8-slim

3. 03 Compare against a current base image

   bash

   Copy

   trivy image --severity HIGH,CRITICAL python:3.12-slim

4. 04 Filter to fixable issues only

   bash

   Copy

   trivy image --ignore-unfixed --severity CRITICAL python:3.8-slim

Objective Use Gitleaks to find a secret committed to git history and practise the response.

1. 01 Create a throwaway repository

   bash

   Copy

   mkdir secret-lab && cd secret-lab && git init

2. 02 Commit a fake credential

   bash

   Copy

   printf 'AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n' > .envgit add .env && git commit -m "add config"

3. 03 Remove it the naive way

   bash

   Copy

   rm .env && git commit -am "remove config"

4. 04 Scan the full history

   bash

   Copy

   gitleaks detect --source . --redact -v

5. 05 Add prevention at commit time

   bash

   Copy

   cat > .pre-commit-config.yaml <<'YAML'repos:  - repo: https://github.com/gitleaks/gitleaks    rev: v8.18.0    hooks:      - id: gitleaksYAMLpre-commit install

Objective Find and fix insecure Terraform configuration before applying it.

1. 01 Create an intentionally insecure bucket definition

   bash

   Copy

   mkdir tf-lab && cd tf-lab && cat > main.tf <<'HCL'resource "aws_s3_bucket" "data" {  bucket = "acme-lab-data"}HCL

2. 02 Scan the directory

   bash

   Copy

   checkov -d . --compact

3. 03 Remediate the highest-value findings

   bash

   Copy

   cat >> main.tf <<'HCL' resource "aws_s3_bucket_public_access_block" "data" {  bucket                  = aws_s3_bucket.data.id  block_public_acls       = true  block_public_policy     = true  ignore_public_acls      = true  restrict_public_buckets = true} resource "aws_s3_bucket_versioning" "data" {  bucket = aws_s3_bucket.data.id  versioning_configuration { status = "Enabled" }}HCL

4. 04 Re-scan and confirm the reduction

   bash

   Copy

   checkov -d . --compact

Objective Scan Kubernetes manifests, then enforce a policy with Kyverno in a local cluster.

1. 01 Create a local cluster

   bash

   Copy

   kind create cluster --name policy-lab

2. 02 Scan a manifest before applying it

   bash

   Copy

   trivy config ./k8s/

3. 03 Install Kyverno

   bash

   Copy

   helm repo add kyverno https://kyverno.github.io/kyvernohelm install kyverno kyverno/kyverno -n kyverno --create-namespace

4. 04 Apply a policy in Audit mode

   bash

   Copy

   kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/best-practices/disallow-latest-tag/disallow-latest-tag.yaml

5. 05 Review policy reports

   bash

   Copy

   kubectl get policyreport -A

6. 06 Switch to Enforce and retest

   bash

   Copy

   kubectl run bad --image=nginx:latest# expect the request to be rejected once validationFailureAction is Enforce

Objective Apply Pod Security Admission and fix a workload that fails the restricted profile.

1. 01 Label a namespace with the restricted profile

   bash

   Copy

   kubectl create namespace hardenedkubectl label namespace hardened pod-security.kubernetes.io/enforce=restricted

2. 02 Try to run a default nginx pod

   bash

   Copy

   kubectl -n hardened run web --image=nginx:1.27

3. 03 Deploy a compliant workload

   bash

   Copy

   kubectl -n hardened apply -f - <<'YAML'apiVersion: v1kind: Podmetadata:  name: webspec:  containers:    - name: web      image: nginxinc/nginx-unprivileged:1.27      securityContext:        runAsNonRoot: true        runAsUser: 101        allowPrivilegeEscalation: false        capabilities: { drop: ["ALL"] }        seccompProfile: { type: RuntimeDefault }YAML

Objective Assemble a pipeline containing SAST, SCA, secret detection, container scanning, SBOM generation and a security gate.

1. 01 Add code-level scanning stages

   yaml

   Copy

   stages: [scan, build, verify, deploy] sast:  stage: scan  image: returntocorp/semgrep  script: [semgrep --config auto --error .] secrets:  stage: scan  image: zricethezav/gitleaks  script: [gitleaks detect --source . --redact] sca:  stage: scan  image: aquasec/trivy  script: [trivy fs --ignore-unfixed --severity HIGH,CRITICAL .]

2. 02 Build and scan the image

   yaml

   Copy

   build:  stage: build  script:    - docker build -t "$IMAGE:$CI_COMMIT_SHA" . image_scan:  stage: verify  image: aquasec/trivy  script:    - trivy image --exit-code 1 --ignore-unfixed --severity CRITICAL "$IMAGE:$CI_COMMIT_SHA"

3. 03 Generate and store an SBOM

   yaml

   Copy

   sbom:  stage: verify  image: anchore/syft  script:    - syft "$IMAGE:$CI_COMMIT_SHA" -o cyclonedx-json=sbom.cdx.json  artifacts:    paths: [sbom.cdx.json]    expire_in: 400 days

4. 04 Add a manual production gate

   yaml

   Copy

   deploy_prod:  stage: deploy  environment: { name: production }  when: manual  rules:    - if: $CI_COMMIT_BRANCH == "main"  script: [./deploy.sh]

Objective Generate an SBOM, sign a container image with Cosign, and verify the signature.

1. 01 Build and push by digest

   bash

   Copy

   docker build -t "$REG/app:1.0.0" . && docker push "$REG/app:1.0.0"DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$REG/app:1.0.0")

2. 02 Generate an SBOM from the image

   bash

   Copy

   syft "$DIGEST" -o cyclonedx-json=sbom.cdx.json

3. 03 Sign the image

   bash

   Copy

   cosign sign --yes "$DIGEST"

4. 04 Attach the SBOM as an attestation

   bash

   Copy

   cosign attest --predicate sbom.cdx.json --type cyclonedx --yes "$DIGEST"

5. 05 Verify with a pinned identity

   bash

   Copy

   cosign verify --certificate-identity "you@example.com" \  --certificate-oidc-issuer "https://accounts.google.com" "$DIGEST"

Objective Install Falco and trigger a runtime detection inside a container.

1. 01 Install Falco

   bash

   Copy

   helm repo add falcosecurity https://falcosecurity.github.io/chartshelm install falco falcosecurity/falco -n falco --create-namespace

2. 02 Deploy a test workload

   bash

   Copy

   kubectl run target --image=alpine -- sleep 3600

3. 03 Trigger a detection

   bash

   Copy

   kubectl exec -it target -- sh -c 'cat /etc/shadow'

4. 04 Inspect the alerts

   bash

   Copy

   kubectl -n falco logs -l app.kubernetes.io/name=falco | grep -i warning

Objective Lint Ansible content, remove plaintext secrets and keep sensitive values out of job output.

1. 01 Create a playbook with a plaintext secret

   bash

   Copy

   mkdir ansible-lab && cd ansible-lab && cat > site.yml <<'YAML'- hosts: all  vars:    db_password: "SuperSecret123"  tasks:    - shell: echo "{{ db_password }}" > /etc/app/db.confYAML

2. 02 Lint with the production profile

   bash

   Copy

   ansible-lint --profile production site.yml

3. 03 Rewrite using safe modules and no_log

   bash

   Copy

   cat > site.yml <<'YAML'- name: Configure application  hosts: all  tasks:    - name: Write database configuration      ansible.builtin.copy:        content: "{{ db_password }}"        dest: /etc/app/db.conf        mode: "0600"      no_log: trueYAML

4. 04 Encrypt the variable

   bash

   Copy

   ansible-vault encrypt_string 'SuperSecret123' --name 'db_password' > group_vars/all/vault.yml

5. 05 Re-lint and confirm a clean run

   bash

   Copy

   ansible-lint --profile production site.yml

Objective Take raw scanner output and produce a prioritised, owner-assigned remediation list.

1. 01 Produce machine-readable output

   bash

   Copy

   trivy image --format json --output scan.json "$IMAGE"

2. 02 Extract fixable high and critical findings

   bash

   Copy

   jq -r '  .Results[].Vulnerabilities // []  | map(select(.Severity == "CRITICAL" or .Severity == "HIGH"))  | map(select(.FixedVersion != null))  | .[] | [.PkgName, .InstalledVersion, .FixedVersion, .VulnerabilityID] | @tsv' scan.json | sort -u

3. 03 Group by package to find the highest-leverage upgrade

   bash

   Copy

   jq -r '.Results[].Vulnerabilities // [] | .[].PkgName' scan.json | sort | uniq -c | sort -rn | head