Course Outline
1. DevSecOps Essentials: Security by Design
Discover: Fundamental DevSecOps principles & secure SDLC integration
Demonstration: Comparative analysis of legacy versus modern secure pipelines
Practical Session: Constructing your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Simulated Breach:
- Deployment of a vulnerable application containing SQLi & XSS
- Utilizing OWASP ZAP for threat identification and mitigation
Defensive Strategies:
- Implementing automated scans with ZAP
- Integrating ZAP API into CI/CD workflows
Practical Session: Customizing ZAP baseline scans + attack rules
Challenge: “Locate the concealed admin panel within 10 minutes”
3. Dependency Chaos: Supply Chain Protection
Simulated Breach:
- Introducing a malicious npm package with CVEs
Defensive Strategies:
- Tracking vulnerabilities using OWASP Dependency-Track
- Applying policy gates that halt builds on critical CVEs
Practical Session: Developing vulnerability policies & alert workflows
Illustrative Demo: “How a single flawed dependency can compromise your infrastructure”
4. Vulnerability Management Command Center
Simulated Breach:
- Exploiting unpatched container vulnerabilities
Defensive Strategies:
- Centralizing reports via OWASP DefectDojo
- Scanning containers using Trivy
Practical Session: Creating real-time dashboards for CISO/executive reporting
Competition: “Triage 50 findings faster than your competitors”
5. Secrets & Configuration Emergency Drill
Simulated Breach:
- Extracting secrets from Git history using truffleHog
Defensive Strategies:
- Configuring pre-commit hooks to block patterns like
password=.* - Leveraging ZAP’s config spider to reveal risky settings
Practical Session: Deploying GitHub Actions secrets scanning
Reality Check: “Your database credentials are currently exposed in Slack”
6. Conclusion: DevSecOps Strategic Roadmap
OWASP Integration Strategy:
- Planning the adoption of DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Drafting your 30-day security checklist
- Defining your DevSecOps KPIs & reporting dashboards
Requirements
Basic software development and SDLC experience
Target Audience
DevOps, Security & Cloud Engineers who dislike abstract security lectures
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
