Chuyên viên Cao cấp DevSecOps (40001147)

## Ôn thi & Chuẩn bị cho vị trí Senior DevSecOps Engineer ### Lộ trình chuẩn bị 2 tuần (Full-time study) ``` TUẦN 1: Nền tảng & Deep Dive ├── Ngày 1-2: DevOps/DevSecOps fundamentals review ├── Ngày 3-4: CI/CD pipeline deep dive ├── Ngày 5-6: Cloud security (AWS/GCP/Azure) └── Ngày 7: Container & Kubernetes security TUẦN 2: Chuyên sâu & Mock Interview ├── Ngày 8-9: Security integration & threat modeling ├── Ngày 10-11: IaC & Configuration management ├── Ngày 12-13: Practice interviews & case studies └── Ngày 14: Light review & rest ``` ### Kiến thức nền bắt buộc phải nắm vững **1. DevSecOps Fundamentals:** ``` References: ├── Microsoft DevOps Fundamentals (free online) ├── DevOps Handbook - Gene Kim, Jez Humble ├── DevSecOps: How to Secure DevOps Pipeline - Raghwinder Soni └── OWASP DevSecOps Maturity Model Key concepts: ├── Three Ways: Flow, Feedback, Continuous Learning ├── CALMS framework (Culture, Automation, Lean, Measurement, Sharing) ├── DORA metrics (Deployment Frequency, Lead Time, MTTR, Change Failure Rate) └── Security in DevOps (DevSecOps) practices ``` **2. CI/CD Pipeline Architecture:** ``` Must understand: ├── Build tools: Maven, Gradle, npm, yarn ├── CI servers: Jenkins, GitLab CI, GitHub Actions, Azure DevOps ├── Artifact management: Nexus, Artifactory, GitLab Packages ├── Deployment strategies: Blue-green, Canary, Rolling ├── Git branching strategies: GitFlow vs Trunk-based └── Pipeline optimization: Caching, parallel execution, incremental builds ``` **3. Container & Kubernetes Security:** ``` Resources: ├── "Cloud Native DevOps with Kubernetes" - O'Reilly ├── Kubernetes Security (LFS260) - Linux Foundation ├── CKA exam curriculum (free to review) └── aquasec.com/blog Topics: ├── Container security best practices (least privilege, rootless) ├── Image scanning & signing (Trivy, Clair, Cosign) ├── Network policies & segmentation ├── Pod security policies / Pod Security Standards ├── RBAC configuration ├── Secrets management (HashiCorp Vault, AWS Secrets Manager) └── Runtime security (Falco, Sysdig) ``` **4. Cloud Security (AWS primary for Techcombank):** ``` AWS Services to master: ├── Compute: EC2, ECS, EKS, Lambda ├── Networking: VPC, Security Groups, NACLs, WAF, Shield ├── IAM: Roles, Policies, SSO, Permission Boundaries ├── Storage: S3 (encryption, versioning, lifecycle) ├── Monitoring: CloudTrail, Config, CloudWatch, GuardDuty ├── Security: Security Hub, Inspector, KMS, Certificate Manager └── DevOps: CodePipeline, CodeBuild, CodeDeploy, CodeCommit Certifications to reference: ├── AWS Solutions Architect Associate ├── AWS Security Specialty (for senior role) └── Well-Architected Framework - Security Pillar ``` **5. Infrastructure as Code & Configuration Management:** ``` Terraform (priority): ├── HCL syntax & best practices ├── State management (remote state, locking) ├── Modules & workspaces ├── Terragrunt for DRY configs └── Policy as Code (OPA, Sentinel) Ansible: ├── Playbooks & Roles ├── Inventory management ├── Vault for secrets └── Idempotency principles ``` **6. Security Tools & Practices:** ``` Application Security: ├── SAST: SonarQube, Checkmarx, Snyk Code, Semgrep ├── DAST: OWASP ZAP, Burp Suite, Netsparker ├── SCA: Snyk, Dependabot, WhiteSource ├── IAST: Contrast Security └── Secrets scanning: Gitleaks, TruffleHog Infrastructure Security: ├── Vulnerability scanning: Nessus, Qualys, OpenVAS ├── Penetration testing tools: Metasploit, Nmap └── Compliance: Chef InSpec, AWS Config Rules Monitoring & Logging: ├── SIEM: Splunk, ELK, Graylog ├── APM: Datadog, New Relic, AppDynamics └── Alerting: PagerDuty, Opsgenie ``` ### Tài liệu tham khảo bổ sung **Books (nên đọc trước):** 1. "The DevOps Handbook" - Gene Kim et al. (DevOps fundamentals) 2. "Accelerate" - Nicole Forsgren (DORA metrics, research) 3. "Infrastructure as Code" - Kief Morris (IaC philosophy) 4. "Security Engineering" - Ross Anderson (Security mindset) 5. "The Phoenix Project" - Gene Kim (DevOps culture) **Online Courses (free/paid):** - Pluralsight: DevOps and Security learning path - Udemy: DevSecOps with Docker and Kubernetes - A Cloud Guru: AWS DevOps learning path - Coursera: DevOps, Cloud, and Agile Foundations **Vietnamese Banking-specific:** - TTgDQT regulations (thông tư quản lý công nghệ ngân hàng) - PCI-DSS requirements overview - Vietnam banking cybersecurity guidelines ### Practice Exercises **Hands-on labs để luyện:** ``` 1. Build a complete CI/CD pipeline from scratch → Use: Jenkins + Docker + Kubernetes + Security scanning 2. Terraform project for multi-tier web application → Include: VPC, EC2, RDS, Security Groups, IAM 3. Kubernetes security hardening → Deploy: Pod security, network policies, RBAC 4. Security scanning integration → Integrate: SonarQube, Trivy, OWASP ZAP vào pipeline 5. Incident response simulation → Practice: Detection, containment, eradication, recovery ``` **Sample interview system design:** - "Design a secure CI/CD pipeline for a banking mobile app" - "How would you implement zero-trust for your organization's cloud infrastructure?" - "Design a multi-environment promotion strategy with security gates"