Course Outline
1. DevSecOps Foundations: Security by Design
Explore Core DevSecOps principles & secure SDLC
Demonstration: Comparative analysis of legacy versus modern secure pipelines
Practical Exercise: Develop an initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Bootcamp
Breach Simulation:
- Implement a vulnerable application featuring SQLi & XSS
- Leverage OWASP ZAP to identify and neutralize threats
Defense Strategies:
- Execute automated scanning with ZAP
- Integrate into CI/CD workflows via ZAP API
Practical Exercise: Configure ZAP baseline scans & custom attack rules
Challenge: Locate the concealed admin panel within 10 minutes
3. Dependency Hell: Supply Chain Defense
Breach Simulation:
- Introduce a malicious npm package containing CVEs
Defense Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Establish policy gates that halt builds upon critical CVEs
Practical Exercise: Formulate vulnerability policies & alert workflows
Demonstration: Illustrate how a single flawed dependency can compromise infrastructure
4. Vulnerability Management War Room
Breach Simulation:
- Exploit unpatched container vulnerabilities
Defense Strategies:
- Centralize reporting using OWASP DefectDojo
- Scan containers with Trivy
Practical Exercise: Construct dashboards for CISO/executive reporting
Competition: Prioritize 50 findings more rapidly than competitors
5. Secrets & Configuration Fire Drill
Breach Simulation:
- Extract secrets from Git history utilizing truffleHog
Defense Strategies:
- Deploy pre-commit hooks to intercept patterns like
password=.* - Employ ZAP’s config spider to reveal dangerous settings
Practical Exercise: Implement GitHub Actions secrets scanning
Reality Check: Highlight the risk of database passwords being exposed in Slack
6. Wrap-Up: DevSecOps Battle Plan
OWASP Integration Roadmap:
- Strategize the adoption of DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Formulate a 30-day security checklist
- Establish DevSecOps KPIs & reporting dashboards
Requirements
Basic software and SDLC experience
Target Audience
DevOps, Security & Cloud Engineers who prefer practical application over theoretical security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
