Course Outline
1. DevSecOps Essentials: Security Integrated from the Start
🔍 Key Takeaways: Core DevSecOps principles & secure SDLC practices
🛠️ Demonstration: Comparing legacy systems against modern secure pipelines
🔧 Hands-on Lab: Constructing your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
💣 Breach Simulation:
- Deploy a vulnerable application featuring SQLi & XSS
- Utilise OWASP ZAP to identify and neutralise threats
⚙️ Defense Strategies:
- Automated scanning using ZAP
- Integrating ZAP API into CI/CD workflows
🧪 Lab: Customising ZAP baseline scans and attack rules
🎯 Challenge: “Locate the concealed admin panel within 10 minutes”
3. Navigating Dependency Challenges: Supply Chain Security
💣 Breach Simulation:
- Introduce a malicious npm package containing CVEs
🛡️ Defense Strategies:
- Monitor vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon detecting critical CVEs
🧪 Lab: Establishing vulnerability policies & alert workflows
⚠️ Impactful Demo: “How a single compromised dependency can compromise your infrastructure”
4. Vulnerability Management Command Centre
💣 Breach Simulation:
- Exploit unpatched container vulnerabilities
🛡️ Defense Strategies:
- Consolidate reporting using OWASP DefectDojo
- Scan containers with Trivy
🧪 Lab: Developing real-time dashboards for CISO and executive reporting
🏁 Competition: “Triage 50 findings faster than your competitors”
5. Secrets & Configuration Emergency Drill
💣 Breach Simulation:
- Extract secrets from Git history using truffleHog
🛡️ Defense Strategies:
- Employ pre-commit hooks to block patterns such as
password=.* - Use ZAP’s config spider to reveal hazardous configurations
🧪 Lab: Implementing GitHub Actions secrets scanning
🚨 Reality Check: “Your database password is currently exposed in Slack”
6. Conclusion: Your DevSecOps Battle Plan
🧭 OWASP Integration Roadmap:
- Outline your adoption strategy for DefectDojo, Dependency-Track, and ZAP
📋 Personal Action Plan:
- Draft your 30-day security checklist
- Define your DevSecOps KPIs & reporting dashboards
Requirements
Basic understanding of software development and the Software Development Life Cycle (SDLC)
Target Audience
DevOps, Security, and Cloud Engineers who prefer practical application over theoretical discussions
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
