Course Outline
1. DevSecOps Foundations: Security by Design
Understand: Core DevSecOps principles & secure SDLC
Demo: Parallel comparison of legacy vs modern secure pipelines
Lab: Construct your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Bootcamp
Breach Simulation:
- Deploy a vulnerable application with SQLi & XSS
- Leverage OWASP ZAP to identify and neutralize threats
Defense Strategies:
- Automated scanning using ZAP
- CI/CD integration via ZAP API
Lab: Configure ZAP baseline scans + attack rules
Challenge: “Locate the hidden admin panel within 10 minutes”
3. Dependency Hell: Supply Chain Defense
Breach Simulation:
- Introduce a malicious npm package with CVEs
Defense Strategies:
- Track vulnerabilities with OWASP Dependency-Track
- Enforce policy gates that terminate builds on critical CVEs
Lab: Develop vulnerability policies & alert workflows
Impressive Demo: “How a single flawed dependency can compromise your infrastructure”
4. Vulnerability Management War Room
Breach Simulation:
- Exploit unpatched container vulnerabilities
Defense Strategies:
- Centralise reporting with OWASP DefectDojo
- Scan containers with Trivy
Lab: Develop real dashboards for CISO/executive reporting
Competition: “Triage 50 findings more swiftly than your competitors”
5. Secrets & Configuration Fire Drill
Breach Simulation:
- Extract secrets from Git history using truffleHog
Defense Strategies:
- Pre-commit hooks to block patterns like
password=.* - Utilise ZAP’s config spider to reveal dangerous settings
Lab: Implement GitHub Actions secrets scanning
Reality Check: “Your database password is currently in Slack”
6. Wrap-Up: DevSecOps Battle Plan
OWASP Integration Roadmap:
- Map out the adoption of DefectDojo, Dependency-Track, and ZAP
Personal Action Plan:
- Draft a 30-day security checklist
- Establish DevSecOps KPIs & reporting dashboards
Requirements
Basic software development and SDLC knowledge
Audience
DevOps, Security & Cloud Engineers who dislike abstract security presentations
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
