Course Outline
1. DevSecOps Fundamentals: Security by Design
Explore: Core DevSecOps principles & secure SDLC
Demonstration: Comparative analysis of legacy versus modern secure pipelines
Practical Exercise: Create a foundational DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Attack Simulation:
- Deploy a vulnerable application featuring SQLi & XSS
- Leverage OWASP ZAP to identify and counter threats
Mitigation Strategies:
- Perform automated scans using ZAP
- Integrate into CI/CD workflows via ZAP API
Practical Exercise: Customize ZAP baseline scans and attack rules
Challenge: “Locate the hidden admin panel within 10 minutes”
3. Dependency Risks: Supply Chain Protection
Attack Simulation:
- Introduce a malicious npm package containing CVEs
Mitigation Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Implement policy gates that trigger build failures on critical CVEs
Practical Exercise: Develop vulnerability policies and alerting workflows
Demonstration: “How a single flawed dependency can compromise your infrastructure”
4. Vulnerability Management Command Center
Attack Simulation:
- Exploit unpatched vulnerabilities in containers
Mitigation Strategies:
- Centralize reporting via OWASP DefectDojo
- Scan containers using Trivy
Practical Exercise: Develop real-time dashboards for CISO and executive reporting
Competition: “Triage 50 findings more quickly than competitors”
5. Secrets & Configuration Emergency Response
Attack Simulation:
- Extract secrets from Git history using truffleHog
Mitigation Strategies:
- Use pre-commit hooks to block patterns like
password=.* - Utilize ZAP’s configuration spider to expose risky settings
Practical Exercise: Implement secrets scanning in GitHub Actions
Reality Check: “Your database password is currently exposed in Slack”
6. Conclusion: DevSecOps Strategic Roadmap
OWASP Integration Strategy:
- Outline the adoption plan for DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Prepare a 30-day security checklist
- Establish DevSecOps KPIs and reporting dashboards
Requirements
Basic software and SDLC knowledge
Target Audience
DevOps, Security & Cloud Engineers who prefer practical application over theoretical security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
