Course Outline
1. DevSecOps Essentials: Inherent Security
Key Concepts: Core DevSecOps principles & secure SDLC
Demonstration: Comparative analysis of legacy vs. modern secure pipelines
Practical Exercise: Construct your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Attack Scenario:
- Deploy an application vulnerable to SQLi & XSS
- Leverage OWASP ZAP to identify and neutralize threats
Mitigation Strategies:
- Automated scanning utilizing ZAP
- Integration into CI/CD via ZAP API
Practical Exercise: Configure ZAP baseline scans + attack rules
Challenge: “Locate the hidden admin panel within 10 minutes”
3. Supply Chain Security: Managing Dependency Risks
Attack Scenario:
- Introduce a malicious npm package containing CVEs
Mitigation Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon critical CVEs
Practical Exercise: Develop vulnerability policies & alert workflows
Case Study: “How a single faulty dependency can compromise your entire infrastructure”
4. Vulnerability Management Command Center
Attack Scenario:
- Exploit unpatched container vulnerabilities
Mitigation Strategies:
- Centralize reporting via OWASP DefectDojo
- Perform container scans with Trivy
Practical Exercise: Create real-time dashboards for CISO/executive reporting
Competitive Exercise: “Prioritize 50 findings more efficiently than competitors”
5. Secrets & Configuration Crisis Simulation
Attack Scenario:
- Extract secrets from Git history using truffleHog
Mitigation Strategies:
- Pre-commit hooks to block patterns like
password=.* - Utilize ZAP’s config spider to uncover risky settings
Practical Exercise: Deploy GitHub Actions secrets scannin
Scenario Analysis: “Your database credentials are currently exposed in Slack”
6. Conclusion: DevSecOps Strategic Action Plan
OWASP Integration Strategy:
- Map out the adoption of DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Formulate your 30-day security checklist
- Establish your DevSecOps KPIs & reporting dashboards
Requirements
Basic software and SDLC knowledge
Target Audience
DevOps, Security & Cloud Engineers who dislike abstract security discussions
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
