Course Outline
1. DevSecOps Fundamentals: Engineering for Security
Core Concepts: Key DevSecOps tenets and secure SDLC practices
Demonstration: Direct comparison between legacy and contemporary secure pipelines
Practical Exercise: Develop your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Breach Scenario:
- Deploy an application vulnerable to SQLi and XSS
- Leverage OWASP ZAP to identify and neutralize these threats
Defensive Strategies:
- Automate security scanning using ZAP
- Integrate ZAP into your CI/CD workflow via its API
Practical Exercise: Tailor ZAP baseline scans and configure custom attack rules
Challenge: Locate a concealed admin panel within a 10-minute window
3. Supply Chain Security: Mastering Dependencies
Breach Scenario:
- Introduce a malicious npm package containing known CVEs
Defensive Strategies:
- Track and monitor vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon critical CVE detection
Practical Exercise: Formulate vulnerability policies and automated alert workflows
Impact Demonstration: Illustrate how a single compromised dependency can compromise entire infrastructure
4. Vulnerability Management Command Center
Breach Scenario:
- Exploit security gaps in unpatched containers
Defensive Strategies:
- Centralize vulnerability reporting with OWASP DefectDojo
- Perform container scanning using Trivy
Practical Exercise: Construct real-time dashboards for CISO and executive-level reporting
Competition: Triage 50 security findings more rapidly than competing teams
5. Secrets & Configuration Crisis Management
Breach Scenario:
- Extract confidential secrets from Git history using truffleHog
Defensive Strategies:
- Deploy pre-commit hooks to intercept sensitive patterns like
password=.* - Utilize ZAP’s configuration spider to reveal risky settings
Practical Exercise: Establish secret scanning within GitHub Actions
Reality Check: Simulate a scenario where database credentials are exposed in Slack
6. Conclusion: The DevSecOps Action Plan
OWASP Integration Strategy:
- Map out the adoption plan for DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Draft a comprehensive 30-day security improvement checklist
- Establish your DevSecOps KPIs and design executive reporting dashboards
Requirements
Essential software development and SDLC background
Target Audience
DevOps, Security, and Cloud Engineers who prefer actionable insights over abstract security theory
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
