Course Outline
1. DevSecOps Foundations: Security-First Design
Understand core DevSecOps principles & secure SDLC workflows
Demonstration: Direct comparison of legacy versus modern secure pipelines
Exercise: Develop your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Intrusion Simulation:
- Deploy a vulnerable application containing SQLi & XSS flaws
- Leverage OWASP ZAP to identify and neutralise threats
Mitigation Strategies:
- Implement automated scanning with ZAP
- Integrate into CI/CD workflows via ZAP API
Exercise: Customise ZAP baseline scans & attack rules
Challenge: “Locate the hidden admin panel within 10 minutes”
3. Supply Chain Resilience: Navigating Dependency Risks
Intrusion Simulation:
- Inject a malicious npm package containing known CVEs
Mitigation Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Establish policy gates that halt builds on critical CVEs
Exercise: Formulate vulnerability policies & alert workflows
Impactful Demo: “How a single bad dependency can compromise your infrastructure”
4. Vulnerability Management Command Centre
Intrusion Simulation:
- Exploit unpatched vulnerabilities within containers
Mitigation Strategies:
- Centralise reporting using OWASP DefectDojo
- Scan containers using Trivy
Exercise: Construct real dashboards for CISO/executive reporting
Competition: “Prioritise 50 findings faster than competitors”
5. Secrets & Configuration Emergency Response
Intrusion Simulation:
- Extract secrets from Git history using truffleHog
Mitigation Strategies:
- Deploy pre-commit hooks to block patterns such as
password=.* - Utilise ZAP’s config spider to expose risky settings
Exercise: Integrate GitHub Actions secret scanning
Reality Check: “Your database password is currently exposed in Slack”
6. Conclusion: DevSecOps Strategic Plan
OWASP Integration Roadmap:
- Map out your adoption strategy for DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Outline your 30-day security checklist
- Establish your DevSecOps KPIs & reporting dashboards
Requirements
Basic software and SDLC knowledge
Target Audience
DevOps, Security & Cloud Engineers who prefer practical application over abstract theory
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
