Course Outline
1. DevSecOps Fundamentals: Security by Design
Key Concepts: Core DevSecOps principles & secure SDLC implementation
Demonstration: Comparative analysis of legacy versus modern secure pipelines
Practical Exercise: Construct your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Breach Scenario:
- Deploy an application vulnerable to SQLi & XSS
- Leverage OWASP ZAP to identify and neutralize threats
Mitigation Strategies:
- Automate security scanning using ZAP
- Integrate ZAP into CI/CD workflows via the ZAP API
Practical Exercise: Tailor ZAP baseline scans and attack rules
Challenge: “Locate the concealed admin panel within 10 minutes”
3. Supply Chain Security: Managing Dependencies
Breach Scenario:
- Introduce a malicious npm package containing known CVEs
Mitigation Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon critical CVE detection
Practical Exercise: Develop vulnerability policies and automated alert workflows
Impact Demonstration: “How a single compromised dependency can compromise your entire infrastructure”
4. Vulnerability Management Command Center
Breach Scenario:
- Exploit unpatched vulnerabilities in containerized environments
Mitigation Strategies:
- Centralize vulnerability reporting with OWASP DefectDojo
- Perform container scans using Trivy
Practical Exercise: Create executive-level dashboards for CISO reporting
Competition: “Process 50 security findings faster than competitors”
5. Secrets & Configuration Emergency Response
Breach Scenario:
- Extract secrets from Git history utilizing truffleHog
Mitigation Strategies:
- Configure pre-commit hooks to intercept patterns like
password=.* - Utilize ZAP’s config spider to identify risky configurations
Practical Exercise: Deploy secret scanning within GitHub Actions
Reality Check: “Your database credentials are currently exposed in Slack”
6. Conclusion: DevSecOps Action Roadmap
OWASP Implementation Roadmap:
- Strategize the adoption of DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Formulate a 30-day security improvement checklist
- Establish DevSecOps KPIs and monitoring dashboards
Requirements
Basic proficiency in software engineering and the SDLC
Target Audience
DevOps, Security & Cloud Engineers who disprefer abstract security presentations
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
