Course Outline
1. DevSecOps Fundamentals: Inherent Security
Learn: Key DevSecOps concepts & secure SDLC practices
Demo: Comparative analysis of legacy versus modern secure pipelines
Lab: Create your initial DevSecOps-integrated pipeline template
2. OWASP ZAP Security Testing Intensive
Breach Simulation:
- Set up a vulnerable application featuring SQLi & XSS
- Utilize OWASP ZAP to identify and counteract threats
Defensive Strategies:
- Implement automated scanning with ZAP
- Integrate ZAP into CI/CD workflows via its API
Lab: Configure ZAP baseline scans + custom attack rules
Challenge: “Locate the hidden admin panel within 10 minutes”
3. Dependency Risks: Supply Chain Security
Breach Simulation:
- Introduce a malicious npm package containing CVEs
Defensive Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Establish policy gates that halt builds for critical CVEs
Lab: Develop vulnerability policies & alert workflows
Impactful Demo: “How a single flawed dependency can compromise your infrastructure”
4. Vulnerability Management Command Center
Breach Simulation:
- Exploit vulnerabilities in unpatched containers
Defensive Strategies:
- Aggregate reporting through OWASP DefectDojo
- Perform container scans using Trivy
Lab: Construct real-time dashboards for CISO/executive reporting
Competition: “Prioritize 50 findings quicker than your competitors”
5. Secrets & Configuration Emergency Drill
Breach Simulation:
- Extract secrets from Git history using truffleHog
Defensive Strategies:
- Deploy pre-commit hooks to block patterns like
password=.* - Leverage ZAP’s configuration spider to reveal dangerous settings
Lab: Establish GitHub Actions secrets scanning
Reality Check: “Your database credentials are exposed in Slack right now”
6. Conclusion: DevSecOps Strategic Roadmap
OWASP Integration Plan:
- Outline your adoption strategy for DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Prepare your 30-day security checklist
- Define your DevSecOps KPIs & reporting dashboards
Requirements
Basic knowledge of software and the SDLC
Target Audience
DevOps, Security & Cloud Engineers who prefer practical over theoretical security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
