Course Outline
1. DevSecOps Fundamentals: Embedding Security in Design
🔍 Learning: Core DevSecOps principles & secure SDLC practices
🛠️ Demonstration: Side-by-side comparison of legacy versus modern secure pipelines
🔧 Lab: Construct your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
💣 Breach Simulation:
- Deploy a vulnerable application featuring SQLi and XSS
- Utilize OWASP ZAP to identify and neutralize threats
⚙️ Defense Strategies:
- Automated scanning using ZAP
- CI/CD integration via the ZAP API
🧪 Lab: Customize ZAP baseline scans and attack rules
🎯 Challenge: "Locate the hidden admin panel within 10 minutes"
3. Dependency Management: Securing the Supply Chain
💣 Breach Simulation:
- Introduce a malicious npm package containing CVEs
🛡️ Defense Strategies:
- Monitor vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon detecting critical CVEs
🧪 Lab: Establish vulnerability policies and alert workflows
⚠️ Impactful Demo: "How a single compromised dependency can compromise your infrastructure"
4. Vulnerability Management Command Center
💣 Breach Simulation:
- Exploit unpatched container vulnerabilities
🛡️ Defense Strategies:
- Consolidate reporting with OWASP DefectDojo
- Scan containers using Trivy
🧪 Lab: Create real-time dashboards for CISO and executive reporting
🏁 Competition: "Triage 50 findings faster than your competitors"
5. Secrets & Configuration Crisis Management
💣 Breach Simulation:
- Extract secrets from Git history using truffleHog
🛡️ Defense Strategies:
- Deploy pre-commit hooks to block patterns like
password=.* - Leverage ZAP’s config spider to reveal risky settings
🧪 Lab: Implement GitHub Actions for secrets scanning
🚨 Reality Check: "Your database password is currently shared on Slack"
6. Conclusion: Your DevSecOps Battle Plan
🧭 OWASP Integration Roadmap:
- Outline your strategy for adopting DefectDojo, Dependency-Track, and ZAP
📋 Personal Action Plan:
- Draft your 30-day security checklist
- Define your DevSecOps KPIs and reporting dashboards
Requirements
Basic knowledge of software development and the Software Development Life Cycle (SDLC)
Target Audience
DevOps, Security & Cloud Engineers who prefer practical skills over theoretical lectures
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
