Practical DevSecOps Logo
+1 (415) 800 4768

Certified Software Supply Chain Security ExpertTM

Master the art of securing modern software supply chains from code to cloud. Implement frameworks like NIST SSDF and SLSA while defending code repositories, container registries, Kubernetes clusters, and cloud environments. Deploy SBOM scanning, artifact signing, and CI/CD security.
Enroll Now
Watch course overview

Over 5,000+
Learners Certified

Video thumbnail

Monitor iconSelf-paced learning

Globe iconBrowser based lab access

Headset icon24/7 Instructor support

Monitor iconSelf-paced learning mode

Globe iconBrowser based lab access

Headset icon24/7 Instructor support

Monitor iconSelf-paced learning mode

Globe iconBrowser based lab access

Headset icon24/7 Instructor support

Trusted by top companies across industries, empowering thousands of professionals worldwide. Join the ranks of security leaders

Prerequisites

  1. Course participants should have knowledge of running basic Linux commands like ls, cd, mkdir, etc.,
  2. Basic knowledge of Git, CI/CD pipelines, containers, and Cloud Platforms.
  3. A good understanding of OWASP Top 10 vulnerabilities.
  4. Familiarity with any scripting language like Python, Golang, or ruby helps. However, it’s not a necessity.

Chapter 1: Introduction to Supply Chain Security

  1. Course Introduction (About the course, syllabus, and how to approach it) 
  2. About Certification and how to approach it
  3. Course Lab Environment
  4. Lifetime course support (Mattermost)
  5. An overview of the Supply Chain Security
  6. Supply Chain Security Building Blocks
    1. Code Creation
      1. Source Code Management (SCM)
      2. Internal and external (third-party) software inventory
      3. Build system (CI/CD)
      4. Application
    2. Containers
    3. Clusters
    4. Cloud
  7. Threat Model of Software Supply Chain
    1. Overview of Code Creation (SCM, CI/CD and Application)
    2. Overview of Containers
    3. Overview of Clusters
    4. Overview of Cloud
  8. Evolution of Software Supply Chain Security
  9. Hands-on Exercise:
    1. Learn how to use our browser-based lab environment
    2. How CI/CD Works
    3. Working with Gitlab CI/CD
    4. Understanding Stages in CI/CD Pipelines
    5. Continuous Deployment
    6. How the Equifax Hack Happened

Chapter 2: Attacking Code and Application Supply Chain

  1. Introduction to code supply chain
  2. Code creation process and systems involved
    1. Source code management (git, svn)
    2. Package managers
    3. Build and CI/CD systems
  3. Attacks on SCM systems
    1. Breaking out of restricted Git shells
    2. Git servers leaking confidential information
    3. Exploiting pre-commit hooks
    4. Repo Jacking
    5. Executing Arbitrary Code With Git Commands
    6. Risks of unencrypted Git traffic
    7. Insufficient Authentication In Git Servers
  4. Supply Chain Attacks on package managers
    1. Magecart attack in an Airways
    2. Supply Chain Attacks on CDNs
    3. Bypassing security mechanisms like CSP
    4. Typo-squatting techniques
    5. Combosquatting
    6. Brandjacking
    7. Dependency confusion
    8. Abusing IDE behaviors through dependency confusion
    9. Package Masquerading
    10. Abusing Generative AI for package masquerading
  5. Attacks on Build and CI/CD Systems
    1. Poisoning build pipelines for complete pwnage
    2. Manual code reviews and sneaking PR/MR
    3. Abusing webhooks to compromise CI/CD systems
    4. Cross Build Injection (XBI) Attacks
    5. Misconfigured Github Actions
  6. Attacks on Application Side
    1. Injection attacks
    2. Cross Site Scripting (XSS)
    3. Server Side Request Forgery
  7. Real-World case studies of code supply chain attack
    1. Stealing environment variables from build servers
    2. Exposing private source code on GitHub
    3. Leaking source code of patented technologies
    4. Stolen code-sign certificates or signed malicious apps
  8. Best practices for securing application supply chain
    1. SBOMs
    2. Code Signing and Commit Signing
    3. Artifact Signing
    4. Dependency Hashing
    5. Dependency Pinning
    6. Defending GitHub Actions With Pinning
  9. Technologies and solutions for securing applications
    1. SCA
    2. SAST
    3. DAST
    4. Fuzz Testing
  10. Hands-on Exercises:
    1. Dependency confusion
    2. GitLab privilege escalation
    3. Git commit spoofing
    4. Git commit signing
    5. Typosquatting dependency
    6. How the Codecov attack happened
    7. Working with pre-commit hooks
    8. Exploiting pre-commit hooks
    9. Software Component Analysis (SCA)
    10. Static Application Security Testing (SAST)
    11. SCA/SAST using pre-commit hooks
    12. Dynamic Analysis
CSSE-image

What you’ll learn from the Certified Software Supply Chain Security Expert Course?

Shield your organization from advanced software supply chain attacks that target your source code, container registries, Kubernetes clusters, and cloud infrastructure.

Detect and neutralize potential vulnerabilities and dependency confusion attacks before malicious actors exploit your CI/CD pipeline.

Create robust DevSecOps defense strategies that protect your entire development ecosystem from repository to production deployment.

Implement industry-leading security frameworks including NIST SDF, CIS, SLSA, and OWASP SCVS to secure your supply chain security posture.

Integrate software supply chain security controls directly into your enterprise risk management framework for NIST CSF compliance.

Enforce rigorous security standards across all third-party vendors, external service providers, and contractors who access your development systems.

Enroll Now

Chapter 3: Attacking Container Supply Chain

  1. Introduction to container technology
    1. What is a container
    2. Basics of container
  2. Ways to interact with containers ecosystem
  3. Attack surface of containers and supply chain risks
    1. Overview of container security
    2. Attack surface of the container ecosystem
    3. Attack surface analysis using native and third party tools
      1. Attack surface analysis with native tools
      2. Kernel features: Namespaces, Cgroups, Capabilities
  4. Attacking Container Supply Chain ecosystem
    1. Malicious images
    2. Insecure container registry
    3. Attacking through container misconfigurations
  5. Best practices for securing container applications
    1. Container Image Security
      1. Distroless and scratch image
      2. Multi-stage builds
    2. Securing Docker daemon
  6. Technologies and solutions for securing containerized applications
    1. Docker host security configurations
      1. Seccomp
      2. Apparmour
      3. Image signing and Content Trust
  7. Hands-on Exercises:
    1. Working with docker command
    2. Creating container snapshots
    3. Malicious container image
    4. Backdooring docker image
    5. Attacking docker registry
    6. Exploiting containerized apps
    7. Unsecured docker daemon
    8. Minimize docker security misconfigurations
    9. Build a secure, miniature image to minimize attack footprint
    10. Typosquatting attack in docker image
    11. Backdooring docker image
    12. Malicious container image

Chapter 4: Attacking Kubernetes/Cluster Supply Chain

  1. Microservices and Kubernetes
    1. Introduction to Microservices Architecture
    2. Introduction to Kubernetes Architecture
  2. Core Components of Kubernetes
  3. Supply Chain Threats for a cluster
  4. Kubernetes Package Manager
    1. Helm and its security
    2. Understanding Helm charts workflow
    3. Creating Helm Charts
  5. Abusing Kubernetes Request Pipeline
    1. Authentication, Authorization, and Admission Controllers
    2. Attacks on Admission Controllers and webhooks
    3. Insecure RBAC rules
  6. Common Attack Vectors in Kubernetes Clusters
  7. Technologies and solutions for securing container orchestration
    1. Static analysis of Kubernetes clusters
    2. Dynamic analysis and runtime security of Kubernetes clusters
  8. Hands-On Exercises:
    1. Kubernetes basic commands
    2. Working with Kubernetes
    3. Kuberntes secrets
    4. Kubernetes service accounts
    5. Kubernetes networking using Calico
    6. Reconnaissance using Kube-hunter
    7. Stealing Kubernetes secrets
    8. Exploiting Kubelet API
    9. Privileged pods in Kubernetes
    10. Sniffing Kubernetes network traffic
    11. Kubernetes image scanning
    12. Static analysis of Kubernetes manifests

Chapter 5: Attacking Cloud Supply Chain

  1. Introduction to Cloud Ecosystem (Public, On-Premise)
  2. Cloud Attack Surface and Threat Matrix
  3. Shared Security Model of the Cloud
  4. Attack Vectors in AWS
    1. Misconfigurations (exposed secrets, metadata service, etc.)
    2. Attacking Managed Services Like S3, CloudFront CDN
    3. Attacking Serverless Computing
    4. Attacking Application Deployment Services
  5. Attack Vectors in Azure
    1. Misconfigurations (exposed secrets, metadata services, etc.)
    2. Attacking Azure Blob storage, Azure Application Gateway
    3. Attacking Azure Functions
    4. Attacking Web Apps
  6. Attack Vectors in GCP
    1. Misconfigurations (exposed secrets, metadata services, etc.)
    2. Attacking Google Cloud Storage GCS, Cloud CDN
    3. Attacking Google Cloud Functions
    4. Attacking Google Kubernetes Engine
  7. Best Practices for Securing the Cloud

Chapter 6: Common Defenses Against Supply Chain Attacks

  1. Prove the sanity of the software components using Cryptography
    1. Code Signing
    2. Component Signing
    3. Artifact signing
    4. The Update Framework
  2. Evaluate dependencies before use
    1. Analyze the security and compliance of dependencies
    2. Implement integrity checks or policies
  3. Implement Change Control
    1. Protected Branches
    2. Licensed Code
    3. Configuration management and change control
  4. Create asset Inventory
  5. Generate a Software Bill Of Materials
    1. Application SBOM
    2. Container SBOM
    3. Hosts SBOM
  6. Code Isolation and Sandboxing
  7. Automation of Common Controls in CI/CD
    1. Software Component Analysis of Code, and Containers
    2. Static Security Analysis of Application Code, Infrastructure as Code
    3. Dynamic Security Analysis of Applications, APIs, Containers, and Clusters
    4. Detecting Unexpected Behaviors Through Fuzz Testing
  8. Compliance and Governance of Supply Chain Risk
  9. Hands-On Exercises:
    1. Generate the SBOM for Application using Syft
    2. Generate the SBOM for Docker Image using Syft
    3. Create an SBOM with Tern
    4. Identify malicious Package using guarddog
    5. Finding Risky Packages using packj
    6. Secrets Scanning using Trivy
    7. Secrets Scanning using TruffleHog
    8. False Positive Analysis (FPA)
    9. Container Registry using Harbor
    10. Container Vulnerability Scanning using Snyk
    11. Scanning Docker for Vulnerabilities with Trivy
    12. Signing Container Images for Trust
    13. Container Malware Scanning using YaraHunter
    14. Find Misconfigured RBAC Using KubiScan
    15. Finding Misconfigurations Using Kubescape
    16. Finding Helm Charts Misconfigurations using Kubescape
    17. How to Embed Syft into CI/CD pipeline
    18. Scan SBOM for Vulnerabilities using bomber
    19. Implement SAST as part DevOps pipelines
    20. Implement DAST as part DevOps pipelines

Chapter 7: Managing a Secure Software Supply Chain Program

  1. Problems with current Supply Chain Attack Visibility
    1. Detection of only known vulnerabilities
    2. Detection of unknown vulnerabilities
  2. Creating a vetting process for software components (Commercial, Open Source, Third Party, and Proprietary Code) used throughout SDLC
  3. Automation of vetting and third-party code
  4. Software Supply Chain Industry Standards and Best Practices
    1. NIST C-SRM or SLSA
    2. NIST SSDF
    3. Software Component Verification Standard (SCVS)
    4. Secure Supply Chain Consumption Framework (S2C2F)
    5. Supply Chain Integrity Model
    6. Software Supply Chain Best Practices
    7. SBOM
    8. CycloneDX
    9. OpenSSF  – Automated
  5. Core Infrastructure Initiative  – Self Assessment
  6. Hands-on Exercises:
    1. Achieving SLSA Level 1 using GitLab
    2. Achieving SLSA Level 2 using GitLab
    3. Establish a vetting process for open-source components
    4. Working with Defect Dojo
    5. Vulnerability Management With DefectDojo
    6. Handling Dependency Hell

Practical DevSecOps Certification Process

  1. After completing the course, you can schedule the CSSE exam on your preferred date.
  2. Process of achieving Practical DevSecOps CSSE Certification can be found here.

    Benefits of enrolling in the

    Practical DevSecOps Courses

    Master today’s security challenges with our updated curriculum and hands-on labs, preparing you for real-world threats.

    Browser-based lab

    Access all tools and exercises directly in your browser. Enjoy a practical, hassle-free learning experience - no downloads or installations needed!

    Enroll now

    Explore commands with our new AI-Powered 'Explain to me' feature

    Gain detailed insights into any command with our AI-powered feature, designed to enhance your understanding and accelerate your learning.

    Enroll now

    Master cutting-edge tools

    Enhance your security skills through hands-on experience with the latest industry tools in our labs. Get equipped for real-world applications and stay ahead of industry changes.

    Enroll now

    Frequently asked questions (FAQs)

    What are the prerequisites required before enrolling in the Software Supply Chain Security certification Course?
    Learners need to know basic Linux commands, Git, CI/CD pipelines, containers, cloud platforms, and OWASP Top 10 vulnerabilities. Python scripting knowledge helps but remains optional.
    What’s included in the Software Supply Chain Security course package?

    3-years of access to the videos and checklists, 60 days of browser-based labs, PDF Manual, 24/7 student support, and one exam attempt.

    Do the labs for the course start immediately after enrollment?

    No, the course doesn’t start automatically after you enroll. You’ll choose your preferred start date after completing your purchase. Once your selected start date arrives, we’ll provide access to all course materials and resources.

    Does the course come with CPE points?

    Yes, the course comes with 36 hours of CPE points.

    What is the exam format?

    You must solve 5 challenges within 6 hours during this task-oriented exam. After completing the challenges, you have 24 additional hours to write and submit your report for evaluation. For more information, visit this link.

    Should I go to an exam center, or is the exam online?

    Yes, this is an online exam. You can take it from your home or office without traveling to a testing center.

    How long is the Software Supply Chain Security Expert Certification Valid?

    Once you earn it, the certification remains valid for a lifetime, hence no renewal requirements.

    Why Certified Software Supply Chain Security Course?

    The Certified Software Supply Chain Security Expert Course delivers complete protection against emerging software supply chain threats across the entire software ecosystem. We deliver practical training that spans code creation, containers, Kubernetes clusters, and cloud environments through intensive hands-on labs and 50+ guided exercises based on actual real-world attacks – setting us apart from other training programs.

    We align with industry frameworks like SLSA, OWASP SCVS, and NIST while offering student support through our dedicated Mattermost community. Organizations choose us to develop internal expertise in:

    • Identifying advanced supply chain vulnerabilities
    • Implementing security controls at each layer
    • Automating security verification in CI/CD pipelines
    • Creating effective risk management programs

    Transform your Organizations into software supply chain security experts and safeguard your enterprise from today’s most dangerous attacks. 

    We also offer Instructor-Led Training (ILT) for enterprises

    Hear from our learners

    Explore the global impact of our Software Supply Chain Security Certification through our learners’ testimonials.

    After two months of studying and a grueling 12-hour exam last Saturday, I'm happy to share I can now call myself a Certified DevSecOps Professional!

    Would recommend the course to anyone that wants to really get hands-on and technical with tooling such as SCA, SAST, DAST, IaC and CaC.

    Danilo Verhaert

    Cyber Security Technology Specialist at Microsoft

    I received good news over the Thanksgiving week: I passed my Certified Container Security Expert exam! This is exam is provided by the Practical DevSecOps training group, which I highly recommend for hands-on skills in the DevSecOps field. The practical labs and 6 hour exam covers a number of security strategies and tools, including: Harbor, Cosign, Trivy, Grype, Snyk, Dockle, Seccomp and many more! The training is FIRST CLASS!

    Jason Lutz, MPA

    AWS Sr. Technical Account Manger (Cloud Security)...

    I am happy to share that I have lately gained the Practical DevSecOps Professional Certification (CDP).

    Thanks to the Practical DevSecOps team, for both excellent material and a lot of great practical labs.

    The certification finished off with a challenging 12 hours practical exam and extensive report writing.

    Stephan Kaas Johansen

    CTO at WinLas - Leading development of next genera...

    I'm excited to share that I have successfully obtained the CCNSE certification!

    This accomplishment has provided me with advanced abilities to effectively secure microservices, containers and Kubernetes environments.

    I now possess comprehensive expertise in handling attacks, implementing defenses, and ensuring compliance within these complex systems.

    I would like to give big thanks to the very responsive team at Practical DevSecOps.

    Ahmad Tabbara

    Cybersecurity Engineer | Penetration Tester | Cyberse...

    The course in general was a great experience, really well structured and quite intense. The teacher was really happy to cover and answer all of our question and make sure we understand the connection between various DevOps processes.

    Spyridon Manglis

    ING

    Oops I did it again 🙂

    I'm happy to share that I pass the Certified Container Security Expert course and exam. Many thanks to the Practical DevSecOps Team for an interesting course

    Batel Zohar Tova

    Developer Advocate at JFrog

    After two months of studying and a grueling 12-hour Practical exam, I'm happy to share that I can now call myself a Certified DevSecOps Professional!

    Warmly recommend this excellent course for technical architects, or engineers who want to gain hands-on skills on how to embed security across modern SDLC.

    The labs covered running below mentioned security tools using Docker and building E2E DevOps pipeline with integrated security automation using GitLab, Jenkins, CircleCI, and GitHub Actions.

    SCA, SAST, DAST, Infra as Code/hardening (IaC), Compliance as Code(CaC), Vulnerability mgmt

    Thanks Practical DevSecOps

    Ahmed AlaaEldin

    Sr. Application Security Consultant @ AppSec...

    This was a great course with practical training for how to embed automated security scanning into a CI/CD pipeline, plus hardening and compliance checks using an everything-as-code approach. Finishing off with a challenging 12 hour practical exam and extensive report writing requirement and assessment to gain the Certified DevSecOps Professional (CDP) certificate. Thanks to Mohammed A. Imran and Raj Shekar of Practical DevSecOps.

    Paul Cullum

    Security Operations Lead @Balyasny...

    After very challenging 12-hours hands-on exam and preparing extensive exam report I am now Certified DevSecOps Professional (CDP)!

    The quality of the course material was surprisingly good and the lab environment is better than any other that I've come across. And in the AppSec field, I have seen quite a few of them. If you want to learn about application security, CI/CD pipelines, Docker, IaC, CaC, SAST, DAST, SCA and these other crazy but very cool acronyms and buzzwords, you would be very wise to join this course.

    Tuomas Tiensuu

    Chief Information Security Officer @ JAY Solutions...

    Whoa! After completing 139 lab exercises and intensive 12 hour exam in 1,5 months, I am finally a Certified DevSecOps Professional too. 🎉

    Warmly recommend this excellent course for technical Product Owners, architects or engineers who want to gain hands-on skills on how to embed security across modern SDLC.

    The labs covered running below mentioned security tools using Docker and building E2E DevOps pipeline with integrated security automation using GitLab, Jenkins, CircleCI and GitHub Actions.

    SCA: Safety, pip-audit, RetireJS, dependency-check, Snyk, npm audit, auditjs, bundler-audit SAST: Trufflehog, detect-secrets, Bandit, Gosec, semgrep, hadolint, FindSecBugs, njsscan, pylint, Brakeman, SonarQube DAST: nikto, nmap, SSLyze, ZAP, Dastardly Infra as Code/hardening: Ansible, AnsibleVault, TFLint, Checkov, Terrascan, tfsec, Snyk Compliance as Code: Inspec for CIS Benchmark, ASVS, Docker compliance Vulnerability mgmt using DefectDojo

    Vilma Blomberg

    Cybersecurity

    I am happy to share that I have lately gained the Practical DevSecOps Professional Certification (CDP).

    Thanks to the Practical DevSecOps team, for both excellent material and a lot of great practical labs.

    The certification finished off with a challenging 12 hours practical exam and extensive report writing.

    Tu Ngo Van

    CyberSecurity Enthusiast

    I recently took the Certified DevSecOps Professional (CDP) certification from Practical DevSecOps. I would recommend the course for anybody that is interested in DevSecOps. The course material was well-written and presented. The labs were very helpful for real-world applications, and the test was a fun challenge.

    Jamy Casteel

    GSE #316 | MSISE | MBA | CISSP | SANS...

    Another awesome certificate to the collection 🙂 Thanks Practical DevSecOps for very valuable course and certificate. Can't wait to attend another one of your courses!

    Bartlomiej Czesak

    4Code

    Another awesome certificate to the collection 🙂 Thanks Practical DevSecOps for very valuable course and certificate. Can't wait to attend another one of your courses!

    Bartlomiej Czesak

    4Code

    Read more reviews

    Future-Proof Your Career with Software Supply Chain Security Training

    Unlock your potential with Software Supply Chain Security Training! Our Certified Software Supply Chain Security Expert Course equips you with job-ready skills. Conquer the 6-hour exam with confidence and open doors to exciting opportunities and Challenges.

    Train my team
    Enroll now

    Unmatched practical focus

    70% hands-on labs for Master real-world scenario’s.

    Expert-crafted curriculum

    Get real-world insights from the experienced Security Experts.

    Practical exam

    6-hours hands-on examination to assess the learning.

    24/7 expert support

    Unbeatable guidance throughout your learning journey.