Course Outline
1. DevSecOps Fundamentals: Security Integrated from the Start
Understand: Essential DevSecOps concepts & secure SDLC practices
Demonstration: Direct comparison between traditional and modern secure pipelines
Exercise: Develop your initial DevSecOps-compliant pipeline template
2. OWASP ZAP Security Assessment Intensive
Attack Scenarios:
- Release a vulnerable application containing SQLi & XSS flaws
- Leverage OWASP ZAP to identify and neutralize threats
Mitigation Strategies:
- Execute automated scans using ZAP
- Integrate with CI/CD via the ZAP API
Exercise: Tailor ZAP baseline scans + attack configurations
Challenge: “Locate the concealed admin interface within 10 minutes”
3. Dependency Risks: Protecting the Supply Chain
Attack Scenarios:
- Introduce a malicious npm package containing known CVEs
Mitigation Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Apply policy checkpoints that halt builds upon critical CVE detection
Exercise: Establish vulnerability policies & alerting workflows
Impactful Demonstration: “How a single flawed dependency can compromise your entire infrastructure”
4. Vulnerability Management Command Center
Attack Scenarios:
- Exploit security gaps in unpatched containers
Mitigation Strategies:
- Consolidate reporting through OWASP DefectDojo
- Perform container scans using Trivy
Exercise: Develop executive-level dashboards for CISO reporting
Competition: “Process 50 security findings more efficiently than your competitors”
5. Secrets & Configuration Emergency Drill
Attack Scenarios:
- Steal credentials from Git history using truffleHog
Mitigation Strategies:
- Configure pre-commit hooks to intercept patterns like
password=.* - Utilize ZAP’s configuration spider to reveal risky settings
Exercise: Deploy GitHub Actions for secret scanning
Reality Check: “Your database credentials are likely currently exposed in Slack”
6. Conclusion: DevSecOps Strategic Roadmap
OWASP Adoption Plan:
- Chart the course for adopting DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Outline a 30-day security implementation checklist
- Establish DevSecOps KPIs & monitoring dashboards
Requirements
Basic knowledge of software and the SDLC lifecycle
Target Audience
DevOps, Security & Cloud Engineers who prefer action over abstract security discussions
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
