Course Outline
1. DevSecOps Essentials: Embedding Security Early
🔍 Key Takeaways: Core DevSecOps principles & secure SDLC practices
🛠️ Demonstration: Comparing legacy workflows with modern secure pipelines
🔧 Hands-on Lab: Construct your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
💣 Breach Simulation:
- Deploy a vulnerable application containing SQLi & XSS flaws
- Utilize OWASP ZAP to identify and neutralize threats
⚙️ Defensive Strategies:
- Automated scanning using ZAP
- CI/CD integration via ZAP API
🧪 Lab: Customize ZAP baseline scans and attack rules
🎯 Challenge: "Locate the concealed admin panel within 10 minutes"
3. Dependency Challenges: Supply Chain Protection
💣 Breach Simulation:
- Introduce a malicious npm package containing CVEs
🛡️ Defensive Strategies:
- Monitor vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon detecting critical CVEs
🧪 Lab: Develop vulnerability policies & alert workflows
⚠️ Shocking Demo: "How a single compromised dependency can compromise your infrastructure"
4. Vulnerability Management Command Center
💣 Breach Simulation:
- Exploit unpatched container vulnerabilities
🛡️ Defensive Strategies:
- Centralize reporting with OWASP DefectDojo
- Scan containers using Trivy
🧪 Lab: Create real-time dashboards for CISO/executive reporting
🏁 Competition: "Triaging 50 findings faster than your peers"
5. Secrets & Configuration Emergency Drill
💣 Breach Simulation:
- Extract secrets from Git history using truffleHog
🛡️ Defensive Strategies:
- Pre-commit hooks to block patterns like
password=.* - Use ZAP’s config spider to expose dangerous settings
🧪 Lab: Implement GitHub Actions secrets scanning
🚨 Reality Check: "Your database password might already be exposed in Slack"
6. Conclusion: Your DevSecOps Battle Plan
🧭 OWASP Integration Roadmap:
- Plan your adoption of DefectDojo, Dependency-Track, and ZAP
📋 Personal Action Plan:
- Draft your 30-day security checklist
- Define your DevSecOps KPIs & reporting dashboards
Requirements
Basic software development and SDLC background
Target Audience
DevOps, Security, and Cloud Engineers who prefer practical exercises over theoretical security lectures
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
