Course Outline
1. DevSecOps Foundations: Security by Design
Key Concepts: Core DevSecOps principles & secure SDLC
Demonstration: Side-by-side comparison of legacy vs. modern secure pipelines
Exercise: Build your first DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Bootcamp
Breach Simulation:
- Deploy a vulnerable application containing SQLi & XSS
- Leverage OWASP ZAP to detect and mitigate threats
Defense Strategies:
- Automated scanning using ZAP
- CI/CD integration via the ZAP API
Exercise: Customize ZAP baseline scans and attack rules
Challenge: “Locate the hidden admin panel within 10 minutes”
3. Dependency Management: Supply Chain Defense
Breach Simulation:
- Inject a malicious npm package containing CVEs
Defense Strategies:
- Monitor vulnerabilities using OWASP Dependency-Track
- Implement policy gates that fail builds on critical CVEs
Exercise: Create vulnerability policies and alert workflows
Demonstration: “How a single flawed dependency can compromise your infrastructure”
4. Vulnerability Management War Room
Breach Simulation:
- Exploit unpatched container vulnerabilities
Defense Strategies:
- Centralize reporting using OWASP DefectDojo
- Scan containers using Trivy
Exercise: Build real dashboards for CISO/executive reporting
Competition: “Triage 50 findings faster than your competitors”
5. Secrets & Configuration Fire Drill
Breach Simulation:
- Exfiltrate secrets from Git history using truffleHog
Defense Strategies:
- Pre-commit hooks to block patterns like
password=.* - Utilize ZAP’s config spider to surface dangerous settings
Exercise: Implement GitHub Actions secrets scanning
Reality Check: “Your database password is currently exposed in Slack”
6. Wrap-Up: DevSecOps Battle Plan
OWASP Integration Roadmap:
- Plan the adoption of DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Draft your 30-day security checklist
- Define your DevSecOps KPIs and reporting dashboards
Requirements
Basic experience with software development and the SDLC
Audience
DevOps, Security, and Cloud Engineers who prefer practical application over theoretical security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
