Course Outline
1. DevSecOps Foundations: Security by Design
Grasp: Fundamental DevSecOps concepts & secure SDLC integration
Demonstration: Comparative analysis of legacy versus contemporary secure pipelines
Exercise: Construct an initial DevSecOps-integrated pipeline template
2. OWASP ZAP Security Testing Bootcamp
Threat Simulation:
- Provision a susceptible application exhibiting SQLi & XSS vulnerabilities
- Leverage OWASP ZAP to identify and neutralize threats
Mitigation Strategies:
- Automate scanning processes using ZAP
- Embed CI/CD workflows via the ZAP API
Exercise: Tailor ZAP baseline scans + offensive rules
Challenge: "Uncover the concealed admin interface within 10 minutes"
3. Dependency Hell: Supply Chain Defense
Threat Simulation:
- Introduce a malicious npm package containing CVEs
Mitigation Strategies:
- Track vulnerabilities via OWASP Dependency-Track
- Enforce policy controls that reject builds with critical CVEs
Exercise: Formulate vulnerability policies & alert protocols
Insightful Demonstration: "How a single flawed dependency can compromise your infrastructure"
4. Vulnerability Management War Room
Threat Simulation:
- Exploit unpatched container vulnerabilities
Mitigation Strategies:
- Consolidate reporting using OWASP DefectDojo
- Inspect containers with Trivy
Exercise: Develop live dashboards for CISO/leadership reporting
Competition: "Prioritize 50 detections more rapidly than competitors"
5. Secrets & Configuration Fire Drill
Threat Simulation:
- Extract sensitive data from Git history utilizing truffleHog
Mitigation Strategies:
- Apply pre-commit hooks to filter patterns such as
password=.* - Utilize ZAP's configuration spider to reveal risky settings
Exercise: Deploy GitHub Actions secrets scannin
Reality Check: "Your database credentials are currently exposed on Slack"
6. Wrap-Up: DevSecOps Battle Plan
OWASP Adoption Roadmap:
- Strategize your implementation of DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Outline your 30-day security audit checklist
- Establish your DevSecOps KPIs & reporting dashboards
Requirements
Basic software and SDLC knowledge
Target Audience
DevOps, Security & Cloud Engineers who prefer practical over theoretical security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
