Course Outline
1. DevSecOps Fundamentals: Integrating Security by Design
🔍 Learn: Core DevSecOps principles & secure SDLC practices
🛠️ Demo: Side-by-side comparison of legacy vs modern secure pipelines
🔧 Lab: Build your first DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Bootcamp
💣 Breach Simulation:
- Deploy a vulnerable application with SQLi & XSS flaws
- Utilize OWASP ZAP to detect and mitigate threats
⚙️ Defense Tactics:
- Automated scanning with ZAP
- CI/CD integration via ZAP API
🧪 Lab: Customize ZAP baseline scans + attack rules
🎯 Challenge: “Locate the hidden admin panel within 10 minutes”
3. Dependency Challenges: Securing the Supply Chain
💣 Breach Simulation:
- Inject a malicious npm package containing CVEs
🛡️ Defense Tactics:
- Monitor vulnerabilities using OWASP Dependency-Track
- Enforce policy gates that halt builds upon detecting critical CVEs
🧪 Lab: Create vulnerability policies & alert workflows
⚠️ Shocking Demo: “How a single compromised dependency can compromise your infrastructure”
4. Vulnerability Management War Room
💣 Breach Simulation:
- Exploit unpatched container vulnerabilities
🛡️ Defense Tactics:
- Centralize reporting with OWASP DefectDojo
- Scan containers using Trivy
🧪 Lab: Build real-time dashboards for CISO/executive reporting
🏁 Competition: “Triage 50 findings faster than your peers”
5. Secrets & Configuration Crisis Management
💣 Breach Simulation:
- Exfiltrate secrets from Git history using TruffleHog
🛡️ Defense Tactics:
- Implement pre-commit hooks to block patterns like
password=.* - Utilize ZAP’s configuration spider to surface risky settings
🧪 Lab: Implement GitHub Actions secrets scanning
🚨 Reality Check: “Your database password may be exposed in Slack right now”
6. Wrap-Up: DevSecOps Strategic Plan
🧭 OWASP Integration Roadmap:
- Plan your adoption of DefectDojo, Dependency-Track, and ZAP
📋 Personal Action Plan:
- Draft your 30-day security checklist
- Define your DevSecOps KPIs & reporting dashboards
Requirements
Foundational experience in software development and the Software Development Life Cycle (SDLC)
Target Audience
DevOps, Security, and Cloud Engineers who prefer practical application over theoretical security discussions
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
