Add learning guides for DevSecOps roadmap skills

[bobbyonmagic]

Summary

The DevSecOps roadmap (/roadmap/devsecops) currently has 30+ skills across 6 milestones, but most skills don't have "Start Learning" links to guides like the Junior DevOps roadmap does.

Current State

Only 6 skills have links (to existing checklists):

• Linux Security Basics → /checklists/ssh-hardening
• Pipeline Hardening → /checklists/cicd-pipeline-setup
• Image Security → /checklists/docker-security
• Kubernetes Security → /checklists/kubernetes-security
• IAM Best Practices → /checklists/aws-security
• Security Monitoring → /checklists/monitoring-observability

Skills Needing Learning Guides

Milestone 1: Security Fundamentals

• Security Principles (CIA triad, defense in depth, least privilege, zero trust) ✅ /guides/security-principles (PR docs: Add Security Principles guide #752)
• OWASP Top 10 (web application security risks) ✅ /guides/owasp-top-10 (PR docs: Add OWASP Top 10 guide #753)
• Threat Modeling (STRIDE, DREAD, attack trees) ✅ /guides/threat-modeling (PR feat: Add Threat Modeling guide for DevSecOps roadmap #812)
• Cryptography Essentials (encryption, hashing, TLS/SSL, PKI) ✅ /guides/cryptography-essentials (PR feat: Add Cryptography Essentials guide #813)

Milestone 2: Secure Development

• Secure Coding Practices (input validation, output encoding, error handling) ✅ /guides/secure-coding-practices (PR feat: Add Secure Coding Practices guide #814)
• SAST Tools (SonarQube, Semgrep, CodeQL) ✅ /guides/sast-tools (PR feat: Add SAST Tools guide for DevSecOps roadmap #815)
• Dependency Scanning (Snyk, Dependabot, npm audit) ✅ /guides/dependency-scanning (PR feat: Add Dependency Scanning guide #816)
• Pre-commit Hooks (gitleaks, detect-secrets, pre-commit framework) ✅ /guides/pre-commit-hooks (PR feat: Add Pre-commit Hooks guide #818)
• Code Review for Security (security-focused code review techniques) ✅ /guides/code-review-security (PR feat: Add Code Review for Security guide #819)

Milestone 3: CI/CD Security

• Secrets Management (HashiCorp Vault, AWS Secrets Manager, SOPS) ✅ /guides/secrets-management (PR feat: Add Secrets Management guide #822)
• Pipeline Hardening ✅ /guides/pipeline-hardening (PR feat: Add Pipeline Hardening guide #820)
• DAST Integration (OWASP ZAP, Burp Suite)
• Supply Chain Security (SBOM, Sigstore, SLSA framework)
• Security Gates (quality gates, break builds on vulnerabilities)

Milestone 4: Container Security

• Container Runtime Security (Seccomp, AppArmor, non-root users)
• Runtime Threat Detection (Falco, Sysdig, Aqua)
• Service Mesh Security (mTLS, Istio, Linkerd)

Milestone 5: Cloud Security

• Infrastructure as Code Security (Checkov, tfsec, KICS)
• Cloud Security Posture (CSPM, Prowler, ScoutSuite)
• Data Protection (encryption at rest/in transit, key management)
• Network Security (VPCs, security groups, WAF, DDoS)

Milestone 6: Security Operations

• Incident Response (playbooks, runbooks, tabletop exercises)
• Vulnerability Management (tracking, prioritization, remediation)
• Compliance Automation (policy as code, audit trails)
• Security Metrics (KPIs, dashboards, reporting)

Acceptance Criteria

• Each skill should have a dedicated guide page at /guides/<skill-slug>
• Guide should include:
  • Overview/introduction
  • Key concepts
  • Practical examples/code snippets
  • Hands-on exercises
  • Further reading
• Update app/roadmap/devsecops/page.tsx to add link property to each skill

Progress

Completed: 11/25 guides

• Milestone 1: 4/4 ✅
• Milestone 2: 5/5 ✅
• Milestone 3: 2/5
• Milestone 4: 0/3
• Milestone 5: 0/4
• Milestone 6: 0/4

Related

• DevSecOps Roadmap PR: feat: Add DevSecOps roadmap #749
• Issue Feature: DevSecOps Roadmap #732 (original DevSecOps roadmap feature request)

[bobbyonmagic]

Progress Update

✅ Completed: Security Principles Guide

PR #752 merged - added the Security Principles guide covering:

• CIA Triad - Confidentiality, Integrity, Availability with practical examples
• Defense in Depth - Layered security strategies with code snippets
• Least Privilege - Minimal access controls for IAM, Kubernetes, Linux
• Zero Trust - Never trust, always verify architecture

Files added:

• content/guides/security-principles/index.md
• content/guides/security-principles/01-cia-triad.md
• content/guides/security-principles/02-defense-in-depth.md
• content/guides/security-principles/03-least-privilege.md
• content/guides/security-principles/04-zero-trust.md

DevSecOps roadmap updated: The "Security Principles" skill now has a "Start Learning" link.

---

Remaining Skills (23 guides left)

Milestone 1: Security Fundamentals (3 remaining)

• OWASP Top 10
• Threat Modeling
• Cryptography Essentials

Milestones 2-6: 20 guides not yet started

[bobbyonmagic]

Progress Update

Completed (2 of 24 skills)

Milestone 1: Security Fundamentals

• Security Principles - PR docs: Add Security Principles guide #752 (merged)
• OWASP Top 10 - PR docs: Add OWASP Top 10 guide #753 (merged)
• Threat Modeling
• Cryptography Essentials

Milestones 2-6: Not yet started (20 skills remaining)

What was added in PR #753:

• Comprehensive OWASP Top 10 guide with 11 files covering all security risks
• Cover images for both Security Principles and OWASP Top 10 guides
• Link added from DevSecOps roadmap to the new guide

[bobbyonmagic]

Progress Update

Threat Modeling guide added via PR #812 ✅

Completed Skills (3 of 24)

• Security Principles (/guides/security-principles) - previously existed
• OWASP Top 10 (/guides/owasp-top-10) - previously existed
• Threat Modeling (/guides/threat-modeling) - just added

Guide Contents

The Threat Modeling guide includes:

• 01-stride.md - STRIDE threat classification (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege)
• 02-dread.md - DREAD risk assessment scoring
• 03-attack-trees.md - Attack tree visualization methodology
• 04-practical-exercises.md - 5 hands-on exercises

Next Up

Cryptography Essentials (encryption, hashing, TLS/SSL, PKI)

[bobbyonmagic]

Progress Update

Skill 4: Cryptography Essentials - PR #813 created

Guide covers:

• Symmetric vs asymmetric encryption (AES-GCM, RSA, Ed25519)
• Hashing (SHA-256, password hashing with Argon2id/bcrypt, HMAC)
• TLS/SSL (handshake, certificates, mTLS, common misconfigurations)
• PKI (trust chains, CAs, revocation, private PKI)

Status:

• Security Principles
• OWASP Top 10
• Threat Modeling (PR feat: Add Threat Modeling guide for DevSecOps roadmap #812)
• Cryptography Essentials (PR feat: Add Cryptography Essentials guide #813)