Skip to main content

Cross-cutting Integration with the Technical Chapters

🌟 Objective​

To describe how continuous and applied training can be integrated into the practical activities of each technical chapter of the SbD-ToE manual.
The objective is to guarantee that learning is not parallel to real execution, but rather incorporated into the rituals, decisions and processes of the development cycle.

Training becomes sustainable when it is active, rotating, practical and visible.

The integration of training with other domains of the SbD-ToE does not presuppose delegating responsibility to automated mechanisms, but rather upskilling for their correct and conscious use.

🧬 Principles of cross-cutting learning​

  • Every security practice must be teachable and replicable
  • Knowledge must circulate through rotation of roles and leadership
  • Learning must be linked to real rituals (e.g. sprint, release, incident)
  • Retention must be measured on the basis of practical application

📘 Examples of integration by chapter​

1. Risk Management​

  • Periodic workshops with the teams on classification and impact
  • Sharing sessions between teams on risk decisions (e.g. exceptions, rationale)
  • Practical training with risk mapping exercises per application

2. Security Requirements​

  • Labs with examples of badly written user stories
  • Monthly cross-review of requirements between teams
  • Practical session: write and review 3 real requirements

3. Threat Modelling​

  • Rotation of leadership among devs, QA and Champions
  • Practical sessions based on real features
  • Review of old models after bugs or incidents

4. Secure Architecture​

  • Collective review of architecture decisions (monthly or per epic)
  • Comparative workshops between approaches (e.g. API vs events)
  • Repository of "before/after" architectures with annotations

5. Dependency Control​

  • Labs with real scenarios of vulnerable dependencies
  • PR Clinics focused on SBOM, SCA, lockfiles and pinning
  • Rotation of responsibility for triage and update decisions

6. Secure Development​

  • Public and educational PR reviews
  • Peer sessions on recurring anti-patterns
  • Use of historical PRs as the basis for training and discussion

7. Secure CI/CD​

  • Simulations of a compromised pipeline
  • Rotation of ownership of critical stages (e.g. secrets, deploy)
  • Workshops to build stages with security validators

8. Secure IaC​

  • Labs with real Terraform code and tools such as Checkov or TFSec
  • Collaborative refactors of insecure IaC
  • Rotation in the review of infrastructure changes

9. containers and Images​

  • Hardening workshops on real Dockerfiles
  • Rotating vulnerability analysis with tools such as Trivy
  • Practical demonstrations of security improvements on real images

10. Security Testing​

  • Gamified activities with fuzzing and API exploration
  • Collective review of SAST/DAST coverage
  • Rotating participation in scanner tuning

11. Secure Deployment​

  • Rollout simulations with induced failures (e.g. wrong feature flag)
  • Shadowing between teams during critical deploys
  • Workshops on validation of configurations in production

12. Monitoring and Operations​

  • Analysis of real alerts and false positives
  • Mini war rooms with detections via logs or dashboards
  • Rotating analyses and sharing of lessons learnt

13. Training and Onboarding​

  • Recurring use of PR Clinics, CTFs, shadowing between peers
  • Champions as facilitators of practical integration
  • Co-learning in sprint planning or technical onboarding

14. Governance and Contracting​

  • Training sessions for contractors and suppliers
  • Review of contractual clauses based on past incidents
  • Case studies of contractual failures as part of internal training

✅ Good practices​

  • Plan 1 learning action per sprint or release
  • Promote rotation and co-leadership between roles
  • Use lightweight and reusable materials (e.g. 1 slide, draw.io file, annotated PR)
  • Link training to real events (bugs, incidents, releases)
  • Record actions in the backlog or internal repository

📎 Cross-references​

DocumentRelevance
01-catalogo-formativo.mdBasis of the content by chapter and role
04-tecnicas-formativas.mdPractical techniques for cross-cutting application
03-programa-champions.mdChampions as local facilitators
15-aplicacao-lifecycle.mdPractical application in the development lifecycle
90-indicadores-metricas.mdMeasurement of the effectiveness of integrated training actions

📚 Continuous training is not parallel to the work - it is part of work done well.

The SbD-ToE manual works as a structured source of living, practical and adaptable training, covering the whole development cycle.