Sherlocked Security – Shift-Left Training & Workshops
Embed Secure Development Practices Early in the SDLC
1. Statement of Work (SOW)
Service Name: Shift-Left Secure Dev Training & Workshops
Client Type: Engineering Teams, DevOps, QA, Security Champions
Service Model: Instructor-Led + Hands-On Labs + Code Review Simulations
Compliance Coverage: OWASP ASVS, NIST SSDF, ISO 27034, PCI-DSS Dev Guidance
Training Types:
- Secure SDLC & Threat Modeling Workshops
- Secure Coding Practices (Lang-Specific)
- Secure Code Review and Static Analysis
- CI/CD Security and Pipeline Hardening
- Developer-Focused Attack & Defense Labs
2. Our Approach
[Skill & Role Mapping] → [Threat Modeling Simulations] → [Code-Level Exercises] → [Secure CI/CD Demos] → [Hands-On Remediation Labs] → [Assessment & Certification]
3. Methodology
[Pre-Training Survey] → [Customized Curriculum Design] → [Live Instructor Workshops + Lab Access] → [Use-Case Based Scenarios] → [Final Evaluation] → [Report & Certification]
4. Deliverables to the Client
- Custom Training Curriculum Based on Role/Stack
- Hands-On Secure Code Labs (IDE, Git, CI/CD)
- Threat Modeling Templates & Real-World Case Studies
- Pre/Post Assessment Reports with Skill Gap Analysis
- Secure Coding Cheat Sheets and Playbooks
- DevSecOps Pipeline Security Guides
- Participation Certificates and Completion Badges
5. What We Need from You (Client Requirements)
- Target audience (roles: developer, QA, DevOps, etc.)
- Programming languages and tech stack (e.g., Java, Node.js, Python, Go)
- CI/CD tools in use (Jenkins, GitHub Actions, GitLab CI, etc.)
- Access to representative codebases or mock projects
- Preferred delivery model (in-person, remote, hybrid)
- NDA and engagement scope confirmation
6. Tools & Technology Stack
- Secure Coding Tools: SonarQube, Semgrep, CodeQL
- Threat Modeling: OWASP Threat Dragon, MS Threat Modeling Tool
- CI/CD Security: GitSecrets, Checkov, TFSec, Snyk, OPA
- Lab Platforms: SecureCodeBox, Katacoda, Instruqt, VS Code Dev Containers
- Attack Simulation: Burp Suite, ZAP, Metasploit (safe lab use only)
7. Engagement Lifecycle
1. Kickoff & Audience Profiling → 2. Curriculum Customization → 3. Workshop Delivery → 4. Lab Completion & Q&A → 5. Final Evaluation → 6. Post-Training Report & Feedback
8. Why Sherlocked Security?
| Feature | Sherlocked Advantage |
|---|---|
| Role-Based Content Customization | Tailored modules for backend, frontend, DevOps, QA, etc. |
| Language-Specific Secure Coding | Framework-aware exercises for Java, Python, JS, Go, etc. |
| Hands-On CI/CD Attack Simulations | Real-world pipeline vulnerabilities and fix practices |
| Threat Modeling Integration | Live modeling using STRIDE, DREAD, and LINDDUN |
| Post-Training Reports & Roadmap | Skill gap insights and maturity roadmap suggestions |
9. Real-World Case Studies
API Injection via Misconfigured Input Handling
Issue: Dev team lacked awareness of injection prevention in Node.js APIs
Impact: User input led to NoSQL injection and data exposure
Fix: Workshop covered input validation, query sanitization, and automated testing with JS-specific tools
Insecure CI/CD Pipeline Secrets
Issue: GitHub Actions workflows exposed secrets via plaintext logs
Impact: Token theft led to privilege escalation in prod environment
Fix: Hands-on lab to implement GitHub Secrets, OPA policies, and signed workflows
10. SOP – Standard Operating Procedure
- Conduct Pre-Training Survey with Team Leads
- Define Audience Roles and Skill Levels
- Design Custom Learning Path by Language/Toolchain
- Deliver Live Sessions + Labs (1–3 days per batch)
- Provide Secure Coding and Threat Modeling Labs
- Perform Post-Training Evaluation
- Generate Summary Report with Learning Outcomes
- Issue Certifications and Optional Continued Learning Paths
11. Shift-Left Training Checklist
1. Threat Modeling Awareness
- Introduction to STRIDE, DREAD, LINDDUN models
- Identification of trust boundaries, data flow, and threat actors
- Live modeling session with client-specific applications
- Output actionable mitigation techniques tied to business impact
2. Secure Coding (Language-Specific)
- OWASP Top 10 + Language-Specific CWE training
- Avoiding insecure deserialization, injection, and path traversal
- Safe API design practices (input validation, auth, rate limiting)
- Secure use of third-party packages and dependency scanning
- Secure logging, error handling, and exception management
3. CI/CD Pipeline Hardening
- Secrets management in pipelines (Vault, GitHub Secrets, SealedSecrets)
- Signed commits and verified artifact builds
- Preventing insecure shell execution (
curl | bash) - Least privilege access for runners and automation bots
- Detecting exposed keys or hardcoded credentials in SCM
4. Static & Dependency Scanning Integration
- SAST setup using tools like Semgrep, SonarQube, CodeQL
- SBOM generation and dependency audits (Syft, Snyk, Grype)
- IDE integration with secure coding plugins
- Shift-left scanning during PR or merge process
- Pipeline gates for code quality + security thresholds
5. Runtime Security Awareness
- Container and cloud runtime security concepts
- Logging and monitoring readiness for deployed code
- Live demos of runtime exploits and mitigation (e.g., SSRF, RCE)
- Role of EDR, WAFs, and observability tools
6. Labs & Hands-On Exercises
- Secure code challenges (IDE-based or web sandbox)
- Threat modeling for real-world app or microservice
- Misconfiguration hunting in CI/CD pipelines
- Simulated attack-defense games (e.g., XSS, SSRF, API abuse)
- Live debugging of insecure code with secure fix walkthrough
7. Reporting & Certification
- Pre vs. post assessment metrics
- Individual and team-level learning scores
- Role-specific next steps and training roadmap
- Issuance of secure dev badges or LinkedIn-ready certifications