Ravindra BagaleCourses & study guides Track your progress

Chapter 7: Volume 1 Recap

By Last updated:

Raju closes the notebook. The wooden bridge is back in its box. The three chairs are pushed in. The payment sheet is folded once, not thrown away. Guru-ji taps the cover. "Volume 1 is the map. You can tell the tale, name the three chairs, and stop a wrong amount with a sentence. The scanners have another book. They are not this afternoon." Raju repeats the belt story without looking down. That is enough for tonight. I am Ravindra Bagale. This recap does not add a new attack, a new tool lab, or a second volume.

What you will learn in this chapter

  • Which pictures to keep
  • Which teaching numbers to keep
  • What you can explain aloud
  • What this volume does not teach

Use this chapter as a spoken test. If a line is fuzzy, go back. Do not memorise this page instead of the pictures.

7.1 The pictures to keep

Four ways to build, from the code city:

  1. Waterfall is a giant stone bridge. Twelve months of design can hide a mistake until month 11, and the span comes down.
  2. Agile is small weekly brickwork. A two-week sprint gets feedback sooner. Operations may still deploy by hand.
  3. DevOps is an automated conveyor belt. Dev and Ops ship daily. In the tale, safety checks were left off.
  4. DevSecOps is the safe high-speed belt. Security scans ride on the belt.

Operations means the server-side people. If that sentence still sounds like a buzzword, say it again in your own words: the people who run the servers.

Three chairs:

  1. Dev wants speed and features.
  2. Sec wants risk and compliance under control.
  3. Ops wants uptime.

Friction is expected. After a bad change, a blameless note asks what the system made easy, then changes the belt. It does not hunt a name for sport.

One payment sheet:

  1. External entity: the mobile app user.
  2. Process: the payment API.
  3. Data store: Postgres, holding balances.
  4. Data flow: the request over HTTPS.
  5. The feared change, in one sentence: the amount goes from 5000 to 1.
  6. The fixes: enforce TLS in transit, sign payloads with HMAC, re-check the amount on the server.

This is for learning only, and only inside a system you are allowed to test. The recap does not relax that line.

7.2 The numbers to keep

The cost rows are teaching numbers from this volume, not a survey and not a company's invoice.

  1. Requirement: 1x, about Rs 100, erase a sentence.
  2. Coding on a laptop: 5x, about Rs 500.
  3. CI/CD SAST: 10x, about Rs 1000, the pipeline rejects the commit.
  4. QA on staging: 15x, about Rs 1500, a Jira ticket.
  5. Production: 100x and beyond, Rs 100,000 and beyond, because a leak, fines, and lost trust do not stay on a neat multiple.

The rule of 100x: catch bugs on the left.

DORA goals in this book, not a measured industry table:

  1. Deployment Frequency: multiple times a day.
  2. Lead Time for Changes: under 1 hour.
  3. MTTR: under 30 minutes.
  4. Change Failure Rate: under 5%.

Security scan coverage is the share of builds that ran a security scan. It is not a DORA metric. Class arithmetic only: 16 of 20 builds is 80%. Not a company statistic.

Pencil check: requirement about Rs 100, pipeline about Rs 1000, which is ten times the first row in this tale. Do not flatten production into a tidy Rs 1000. The plus sign is the memory test.

Where these numbers come from

Good security numbers come from public reports, not guesses. Quote the source and the year.

SourceWhat it measuresWhy it helps
Verizon DBIR (yearly)How breaches start, from thousands of casesShows the human element and stolen credentials keep leading
IBM Cost of a Data Breach (yearly)Average breach cost and time to containGives a business reason for faster detection
DORA / Accelerate State of DevOpsDeploy frequency, lead time, failure rate, recovery timeShows speed and stability can grow together

7.3 What you can say out loud

Give this talk in under three minutes.

  1. I can describe waterfall, Agile, DevOps, and DevSecOps with the bridge, the bricks, and the belt.
  2. I can say why a bug in a requirement sentence is cheaper than the same bug in production.
  3. I can name Dev, Sec, and Ops without mocking any of them.
  4. I can list four DORA goals and refuse to invent a company's score.
  5. I can add security scan coverage and label it as not DORA.
  6. I can draw the payment picture and state the 5000-to-1 threat in one sentence.
  7. I can name TLS, HMAC, and the server-side amount check as fixes, without telling anyone how to tamper with a request.
  8. I can say that STRIDE is six threat types and PASTA is seven thinking steps.

One sentence each, then stop. Netflix: a small release beats a year-long bridge, and the daily belt still needs a safety station. Instagram: Dev, Sec, and the server-side people look at one change together. Infosys on a client project: a file copied by hand is not a belt. An Indian payment API: the server re-checks 5000 and does not store 1 because a phone said so.

Practice task

Record yourself once, or tell a friend. Use the eight lines above as a checklist. Any line you cannot say, write the chapter number beside it and reread only that chapter.

Ravindra Bagale's Tip

A recap that copies the same sentence ten times feels long and teaches nothing. If you are bored, you are ready to speak. Close the page and speak. The gap you feel is the real review.

Practise saying it in an interview

Try each answer in under thirty seconds, with one real example.

  • "Shift left means we find issues in the pull request. Microsoft built its SDL on that idea."
  • "A threat model is a diagram plus STRIDE questions at each trust boundary."
  • "Secrets in Git must be rotated, not just deleted. Toyota's 2022 key leak shows why."
  • "Patch speed matters. Equifax was breached through a Struts flaw that already had a fix."

7.4 What this volume does not teach

Say the boundary out loud so you do not bluff in an interview.

  1. This site's DevSecOps course is Volume 1 only: foundations, culture, and threat modeling on paper.
  2. It does not teach OWASP Top 10 fixes.
  3. It does not teach SAST tools, including SonarQube and Semgrep, and it has no scan commands.
  4. It does not teach SCA, and it does not teach SBOM formats such as CycloneDX or SPDX.
  5. It does not contain exploit steps, interception steps, or payload recipes. Those do not belong in a later chapter of this volume either, because those chapters are not here.
  6. It does not ask you to attack a payment system, a bank, or a classmate's project.

Those later names are a signpost, not a promise that a second volume is published on this website. When you meet the tools at work, bring this volume's questions with you: where is the check on the belt, which STRIDE word is this, and does the server know the real amount?

Raju leaves with the folded sheet, not a bag of commands. Guru-ji says the diploma for Volume 1 is teaching the belt to someone who has never seen it.

Keep the pocket list

  • Left is cheap, right is a leak.
  • Three chairs, four DORA goals, one extra scan share that is not DORA.
  • 5000 must not become 1 just because a phone said so.
  • Pencil first. Tools later, in a book this site does not claim to host.

If you can tell the belt story and the payment sentence without this page, Volume 1 did its job. Samajla ka? अगर बेल्ट की कहानी और पेमेंट वाला वाक्य बिना इस पन्ने के आ जाता है, तो यह खंड पूरा है.