Course Outline
1. DevSecOps Fundamentals: Security by Design
Explore: Essential DevSecOps principles & secure SDLC integration
Demo: A comparative analysis of legacy versus modern secure pipelines
Lab: Develop your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Breach Simulation:
- Deploy an application vulnerable to SQLi & XSS
- Utilize OWASP ZAP to identify and address threats
Defense Strategies:
- Implement automated scanning using ZAP
- Integrate into CI/CD workflows via the ZAP API
Lab: Adapt ZAP baseline scans & configure attack rules
Challenge: “Locate the concealed admin panel within 10 minutes”
3. Dependency Risks: Supply Chain Protection
Breach Simulation:
- Introduce a malicious npm package containing CVEs
Defense Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Establish policy gates that halt builds for critical CVEs
Lab: Define vulnerability policies & set up alert workflows
Impactful Demo: “How a single flawed dependency can compromise your entire infrastructure”
4. Vulnerability Management Command Center
Breach Simulation:
- Exploit unpatched container vulnerabilities
Defense Strategies:
- Consolidate reporting via OWASP DefectDojo
- Perform container scans using Trivy
Lab: Construct live dashboards for CISO/executive oversight
Competition: “Resolve 50 findings more quickly than your competitors”
5. Secrets & Configuration Emergency Drill
Breach Simulation:
- Extract secrets from Git history using truffleHog
Defense Strategies:
- Set up pre-commit hooks to filter patterns like
password=.* - Leverage ZAP’s configuration spider to reveal risky settings
Lab: Deploy secrets scanning in GitHub Actions
Reality Check: “Your database password is currently exposed in Slack”
6. Conclusion: DevSecOps Action Plan
OWASP Implementation Roadmap:
- Map out the adoption path for DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Create your 30-day security checklist
- Establish DevSecOps KPIs & reporting dashboards
Requirements
Basic knowledge of software development and the SDLC
Audience
DevOps, Security & Cloud Engineers who prefer practical security insights over theoretical discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
