This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Free Linux Foundation Courses

Educational courses for securing the software delivery lifecycle, including AI development, software supply chain security, and DevSecOps from the OpenSSF and Linux Foundation.

Free OpenSSF and Linux Foundation Cybersecurity Education

The Open Source Security Foundation (OpenSSF) and Linux Foundation provide free educational resources covering secure software development, AI security, software supply chain security, DevSecOps, vulnerability management, and cybersecurity compliance.

These courses are available online at no cost and provide practical training for developers, DevOps teams, platform engineers, security professionals, and open-source maintainers.

Training catalogs:

For practitioners who are new to software security, the following progression provides a practical starting point.

Step Course Learning Objective
1 Developing Secure Software (LFD121) Understand secure software development fundamentals.
2 Secure AI/ML-Driven Software Development (LFEL1012) Learn secure practices for AI-assisted software development.
3 Introduction to DevSecOps for Managers (LFS180) Understand how security fits into CI/CD workflows.
4 Automating Supply Chain Security (LFEL1007) Learn SBOMs, provenance, and software supply chain controls.
5 Securing Your Software Supply Chain with Sigstore (LFS182) Learn software artifact signing and verification.
6 Securing Projects with OpenSSF Scorecard (LFEL1006) Automate assessment of open-source project security.
7 Understanding the EU Cyber Resilience Act (LFEL1001) Understand software cybersecurity regulatory obligations.

1. Securing AI Development

Course Course ID Description Link
Secure AI/ML-Driven Software Development LFEL1012 Security risks of AI coding assistants, protecting development environments, prompt injection, secure AI-generated code, and code review. Course
Conversational AI: Ensuring Compliance and Mitigating Risks LFS120 AI risk management, NIST AI RMF, EU AI Act, ISO/IEC 42001, privacy, and operational risk mitigation. Course
Ethical Principles for Conversational AI LFS118 Responsible AI development, ethical risks, privacy, transparency, and trustworthy AI practices. Catalog

2. Software Supply Chain Security

Course Course ID Description Link
Securing Your Software Supply Chain with Sigstore LFS182 Software artifact signing, verification, Cosign, Fulcio, Rekor, and software supply chain integrity. Course
Automating Supply Chain Security: SBOMs and Signatures LFEL1007 SBOM generation, software provenance, signatures, dependency tracking, attestations, and supply chain security automation. Catalog
Securing Projects with OpenSSF Scorecard LFEL1006 Automated assessment of open-source repository security practices and integration of OpenSSF Scorecard into development workflows. Course
Security Self-Assessments for Open Source Projects LFEL1005 Evaluating open-source project security practices, identifying security gaps, and preparing for security reviews and audits. Catalog
Developing Secure Software LFD121 Secure coding, dependency security, vulnerability prevention, threat modeling, and secure software development fundamentals. Course

3. DevSecOps and CI/CD Security

Course Course ID Description Link
Introduction to DevSecOps for Managers LFS180 DevSecOps principles, integrating security into CI/CD, organizational transformation, security processes, and development workflows. Course
Developing Secure Software LFD121 Secure software engineering, defensive programming, security testing concepts, and dependency management. Course
Introduction to JavaScript Security LFS184 JavaScript security risks, identifying vulnerabilities, defensive development practices, and securing JavaScript applications. Catalog
Authentication & Authorization for Web/API LFEL1004 Authentication, authorization, API security, protecting sensitive data, and designing secure access controls. Catalog
Understanding the OWASP Top 10 Security Threats SKF100 Common application security vulnerabilities, including injection, broken access control, security misconfiguration, and vulnerable dependencies. Catalog

4. Security Governance and Compliance

Course Course ID Description Link
Security for Software Development Managers LFD125 Managing software security programs, identifying vulnerabilities, security leadership, and implementing secure development practices. Course
Understanding the EU Cyber Resilience Act (CRA) LFEL1001 EU CRA requirements, manufacturer responsibilities, cybersecurity risk management, and compliance preparation. Catalog
Cybersecurity Essentials LFC108 Cybersecurity fundamentals, identifying security risks, protecting organizational information, and security awareness. Catalog
Introduction to Zero Trust LFS183 Zero Trust security principles, access controls, identity verification, and protecting digital environments. Catalog
Conversational AI: Ensuring Compliance and Mitigating Risks LFS120 AI governance, compliance, privacy, NIST AI RMF, EU AI Act, and operational risk management. Course

5. Education Mapped to the CI/CD Cybersecurity Guide

The following table maps OpenSSF and Linux Foundation courses to the three phases of the CI/CD Cybersecurity Guide.

CI/CD Phase Security Focus Recommended Courses
Phase 1: Code and Prebuild Secure coding, threat modeling, dependency security, AI-assisted development, application security, and security planning. Developing Secure Software (LFD121); Secure AI/ML-Driven Software Development (LFEL1012); Understanding the OWASP Top 10 (SKF100); Authentication & Authorization for Web/API (LFEL1004); Introduction to JavaScript Security (LFS184)
Phase 2: Build and Deploy Software supply chain security, SBOM generation, provenance, artifact signing, dependency security, and CI/CD security. Automating Supply Chain Security (LFEL1007); Sigstore (LFS182); OpenSSF Scorecard (LFEL1006); Introduction to DevSecOps for Managers (LFS180)
Phase 3: Post Deployment Vulnerability identification, security assessments, vulnerability management, regulatory compliance, and ongoing security practices. Security Self-Assessments (LFEL1005); Developing Secure Software (LFD121); Understanding the EU CRA (LFEL1001); Security for Software Development Managers (LFD125)