CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications

## Project Overview This mini-project is the culmination of the 'Application Security Principles and Threat Modeling' chapter. You will consolidate everything you have practiced so far — components/assets identification, CIA, STRIDE, Data Flow Diagra...

THEORETICAL RECAP Threat modeling connects two artifacts you have already built: the Data Flow Diagram (DFD) and the STRIDE taxonomy. A DFD represents your application as external entities (users, third parties), processes (services, APIs), data stor...

A Data Flow Diagram, often abbreviated as DFD, is a visual representation of how information moves through an application or a system. In threat modeling, it is the foundation on which everything else is built. Before you can apply STRIDE, identify a...

THEORETICAL RECAP A Data Flow Diagram (DFD) is a graphical model that shows how data moves through an application. It relies on four core symbols: external entities (rectangles) representing actors or systems outside your control (users, third-party ...

THEORETICAL RECAP STRIDE is a threat modeling framework that classifies threats into six categories: Spoofing (impersonating an identity), Tampering (altering data or code), Repudiation (denying an action without traceability), Information Disclosure...

THEORETICAL RECAP STRIDE is a threat classification model created by Microsoft that maps six threat categories to the security properties they violate: Spoofing (breaks Authentication), Tampering (breaks Integrity), Repudiation (breaks Non-repudiatio...

THEORETICAL RECAP Threat modeling always starts with understanding what you are protecting. Before you can identify threats, you must decompose the application into its components. A component is any distinct part of the system that stores, processes...

Threat modeling is a structured way of thinking about what can go wrong with an application before attackers find out for you. In the previous activities, you learned about assets (things worth protecting), the Confidentiality, Integrity and Availabi...

THEORETICAL RECAP The CIA triad describes three security properties every asset can require: Confidentiality (only authorized parties can read the data), Integrity (data cannot be altered or destroyed without authorization or detection), and Availabi...

In the previous activities you learned the essential vocabulary of security — asset, threat, vulnerability, risk — and you explored the three foundational properties of information security: Confidentiality, Integrity, and Availability. You also prac...

In the previous activities, you learned the essential vocabulary of security: asset, threat, vulnerability, and risk. You also practiced locating assets inside a simple application such as a Todo List. Now we build on that foundation with the single ...

THEORETICAL RECAP On Debian-based Linux systems, /var/log/auth.log records authentication and authorization events: SSH connections (successful and failed), sudo invocations, su attempts, PAM messages, and session open/close events. On RHEL-based sys...

THEORETICAL RECAP On Linux, every process runs with the privileges of a user and its groups. The principle of least privilege dictates that an account should hold only the permissions strictly required for its tasks—nothing more. A pentester frequent...

Advanced user and sudoer management is a cornerstone of Linux security. On a Linux system, every process and every file is tied to an identity. Understanding how users, groups, and privilege elevation work allows you to reduce the attack surface, app...

THEORETICAL RECAP A Bash script is just a text file until you grant it execute permission and provide an interpreter. The shebang line (#!/bin/bash) on the first line tells the system which interpreter to use. Permissions are managed with chmod: chmo...

Scripting is one of the most powerful tools a security professional has. A well-written Bash or Python script can automate reconnaissance, parse thousands of log lines, back up critical files, or orchestrate a deployment. But a poorly written script ...

THEORETICAL RECAP The /etc directory is the heart of Linux system configuration. It contains critical files: user accounts (/etc/passwd, /etc/shadow), network settings, service configurations, firewall rules, and repository definitions you manipulate...

Bash (Bourne Again Shell) is the default command interpreter on most Linux distributions. Writing scripts in Bash allows you to automate repetitive tasks, chain together the network and system tools you have already studied (ip, ss, nmap, apt, system...

On a Linux system, software is installed and updated through package managers such as apt (Debian, Ubuntu) or yum/dnf (Red Hat, CentOS, Fedora). These package managers download software from repositories. A repository is a server that hosts packages ...

THEORETICAL RECAP Before any penetration test or network analysis, you need a reconnaissance toolkit. Two tools are foundational: nmap and Wireshark. Nmap (Network Mapper) is an active scanner: it sends crafted packets to hosts to discover live machi...

Package management is one of the most important skills for anyone administering or securing a Linux system. A package is a compressed archive that contains a program, its libraries, configuration files, and metadata describing what the software needs...

THEORETICAL RECAP Documenting network status means capturing a reliable snapshot of what your Linux host exposes and communicates on the network at a given moment. The core mental model is a layered inventory: interfaces (link and IP configuration), ...

THEORETICAL RECAP A network interface is a connection point between your machine and a network. On Linux, interfaces such as 'lo' (loopback, 127.0.0.1), 'eth0' or 'enp0s3' (wired), and 'wlan0' (wireless) each carry one or more IP addresses. A port is...

In the previous chapters you learned to manage processes, signals, and services with systemd. A running service almost always listens on the network, so the next logical step is to inspect the local network configuration and the network activity of y...

When a Linux service fails to start, crashes unexpectedly, or behaves in an unexpected way, you need a systematic method to diagnose the problem. On modern Linux distributions, services are managed by systemd, and their logs are collected by a compon...

THEORETICAL RECAP On modern Linux systems, systemd is the init system and service manager (PID 1). A 'service' is a unit described by a unit file (usually ending in .service) located under /lib/systemd/system/ or /etc/systemd/system/. The core mental...

After learning to manage processes, permissions, and signals, the next step is to understand how a modern Linux system starts, supervises, and stops the services that run in the background. On most current distributions (Debian, Ubuntu, Red Hat, Cent...

THEORETICAL RECAP A signal is an asynchronous software interrupt sent to a process by the kernel, another process, or the user. It tells the process something happened and, unless caught or ignored, triggers a default action. Each signal has a name a...

THEORETICAL RECAP On Linux, a process is a running instance of a program, identified by a unique PID (Process ID) and linked to its parent through a PPID. Each process has an owner (the user who launched it), a state (Running, Sleeping, Zombie, Stopp...

Process management is one of the fundamental pillars of Linux system administration and security. Just as you have learned to control who can read or write files through permissions, you now need to understand who is running what on the system, with ...

This chapter serves as a comprehensive memo sheet and consolidation of everything covered in the Linux advanced permissions and navigation module. It is designed to be your go-to reference before moving on to security-focused practical exercises, and...

Building on your understanding of standard Linux permissions (read, write, execute for owner, group, and others), digital chmod notation, and ownership management with chown and chgrp, this lesson introduces three additional permission bits that go b...

**Theoretical Recap** In Linux, a shared folder is a directory accessed by multiple users or groups simultaneously. Securing it correctly means applying the right combination of ownership, permissions, and special bits to ensure that only authorized ...

THEORETICAL RECAP In Linux, every file and directory has two ownership attributes: a user owner and a group owner. These are distinct from permissions (which you have already practiced with chmod), but they work hand in hand: permissions only mean so...

When working in a Linux environment, especially in a security or DevSecOps context, permission errors are among the most frequently encountered issues. They can block scripts, prevent services from starting, expose sensitive files, or hide misconfigu...

**Theoretical Recap** Linux permissions are expressed numerically using an octal (base-8) system. Each file or directory has three permission groups: owner (user), group, and others. Each group is assigned a value based on three binary bits: read (r ...

**Theoretical Recap** File permissions in Linux are a foundational security mechanism. Every file and directory has three permission sets: owner (u), group (g), and others (o). Each set can carry three types of permissions: read (r), write (w), and e...

Linux is a multi-user operating system, which means that multiple users can work on the same machine simultaneously or sequentially. To ensure that each user can only access what they are entitled to — and nothing more — Linux relies on a system of p...

THEORETICAL RECAP In Linux, copying, moving, and deleting files are everyday operations — but in a security context, each action carries real risk. The commands cp, mv, and rm are powerful and unforgiving: there is no Recycle Bin, no undo, and no pro...

Now that you have a solid understanding of how to navigate the Linux file system — using commands like cd, pwd, ls, and tree — and that you understand the overall hierarchy of directories on a Linux system, it is time to move on to the next essential...

Understanding the Linux file system hierarchy is a fundamental skill for anyone working in cybersecurity or system administration. You have already practiced navigating the file system using commands like pwd, ls, cd, and tree. Now it is time to unde...

THEORETICAL RECAP The `tree` command is a Linux utility that recursively displays the directory structure of a filesystem path in a visual, hierarchical format — much like a branching diagram. Unlike `ls`, which only lists the immediate contents of a...

Now that you have learned the foundational Linux commands — pwd, ls, cd, and how to interpret paths — it is time to go deeper. Mastering navigation in a Linux terminal is not just about knowing the commands. It is about understanding the subtle mista...

**Theoretical Recap** Navigating the Linux filesystem is a foundational skill for any security professional. Every file and directory in Linux lives within a single hierarchical tree rooted at /. Understanding how to move through this tree efficientl...

**Theoretical Recap** Before diving into the hands-on tasks, let's consolidate the key concepts from the previous lesson on Linux terminal fundamentals. The Linux terminal (also called the shell or command-line interface) is your primary tool as a se...

The Linux terminal is one of the most powerful and essential tools in cybersecurity and DevSecOps practice. Unlike graphical interfaces, the terminal gives you direct, precise, and scriptable control over a system. Understanding how it works, what it...

Welcome to the chapter 'Operating systems: Linux advanced for security', part of the course 'CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications'. This chapter is designed for learners who are at a beginner level in Lin...

## Project Overview This final mini-project consolidates everything you have practiced throughout the chapter: port scanning with Nmap, HTTP header analysis with the Requests library, date/timestamp manipulation, output formatting (text, CSV, JSON), ...

THEORETICAL RECAP Secure scripting best practices are not optional additions — they are the foundation of any professional automation script, especially in a security context. When you write a Python script intended for security tasks, several non-ne...

When you write Python scripts for security automation — whether for port scanning, HTTP analysis, report generation, or any other task you have already practiced — you are not just writing code that works. You are writing code that will run in sensit...