Course Outline
1. DevSecOps Basics: Security by Design
Key Concepts: Fundamental DevSecOps principles & secure SDLC
Demonstration: Comparative analysis of legacy vs. modern secure pipelines
Exercise: Develop your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Attack Simulation:
- Install a vulnerable application containing SQLi & XSS
- Leverage OWASP ZAP to identify and neutralize threats
Defense Strategies:
- Automated scanning using ZAP
- CI/CD integration through ZAP API
Exercise: Adapt ZAP baseline scans + attack rules
Challenge: "Locate the concealed admin panel within 10 minutes"
3. Dependency Risks: Supply Chain Protection
Attack Simulation:
- Introduce a malicious npm package containing CVEs
Defense Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds on critical CVEs
Exercise: Establish vulnerability policies & alert workflows
Impactful Demo: "How a single faulty dependency can compromise your infrastructure"
4. Vulnerability Management Command Center
Attack Simulation:
- Exploit unpatched container vulnerabilities
Defense Strategies:
- Consolidate reporting via OWASP DefectDojo
- Analyze containers using Trivy
Exercise: Create live dashboards for CISO/executive reporting
Competition: "Prioritize 50 findings quicker than your competitors"
5. Secrets & Configuration Emergency Exercise
Attack Simulation:
- Extract secrets from Git history utilizing truffleHog
Defense Strategies:
- Pre-commit hooks to prevent patterns such as
password=.* - Leverage ZAP’s configuration spider to reveal dangerous settings
Exercise: Integrate GitHub Actions secrets scannin
Reality Check: "Your database credentials are currently in Slack"
6. Conclusion: DevSecOps Strategy
OWASP Implementation Roadmap:
- Strategize your adoption of DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Develop your 30-day security checklist
- Establish your DevSecOps KPIs & reporting dashboards
Requirements
Basic software and SDLC knowledge
Target Audience
DevOps, Security & Cloud Engineers who dislike abstract security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
