Course Outline
1. DevSecOps Foundations: Security by Design
Core Concepts: DevSecOps principles and secure Software Development Life Cycle (SDLC) integration.
Demonstration: A comparative analysis of legacy versus modern secure pipelines.
Practical Exercise: Constructing an initial DevSecOps-enabled pipeline template.
2. OWASP ZAP Security Testing Bootcamp
Attack Simulation:
- Implementing a vulnerable application exhibiting SQL injection and XSS flaws.
- Utilizing OWASP ZAP for threat detection and mitigation.
Defensive Strategies:
- Executing automated scans using ZAP.
- Integrating ZAP into CI/CD workflows via its API.
Practical Exercise: Configuring ZAP baseline scans and custom attack rules.
Challenge: Locating a hidden admin panel within a ten-minute timeframe.
3. Supply Chain Resilience: Managing Dependency Risks
Attack Simulation:
- Introducing a malicious npm package containing known CVEs.
Defensive Strategies:
- Tracking vulnerabilities using OWASP Dependency-Track.
- Establishing policy gates that reject builds with critical CVEs.
Practical Exercise: Developing vulnerability policies and alert workflows.
Critical Demo: Illustrating how a single compromised dependency can compromise infrastructure.
4. Vulnerability Management War Room
Attack Simulation:
- Exploiting unpatched vulnerabilities within containers.
Defensive Strategies:
- Centralizing reporting mechanisms with OWASP DefectDojo.
- Performing container scans using Trivy.
Practical Exercise: Creating dashboards tailored for CISO and executive reporting.
Competition: Prioritizing and triaging fifty findings more efficiently than competitors.
5. Secrets & Configuration Security Drill
Attack Simulation:
- Extracting secrets from Git history using truffleHog.
Defensive Strategies:
- Implementing pre-commit hooks to block sensitive patterns such as
password=.*. - Leveraging ZAP’s configuration spider to identify dangerous settings.
Practical Exercise: Setting up secrets scanning within GitHub Actions.
Scenario Analysis: The risk of sensitive database credentials being exposed in communication channels like Slack.
6. Conclusion: DevSecOps Strategic Roadmap
OWASP Integration Plan:
- Outlining the adoption strategy for DefectDojo, Dependency-Track, and ZAP.
Individual Action Plan:
- Drafting a comprehensive 30-day security checklist.
- Defining DevSecOps KPIs and establishing reporting dashboards.
Requirements
Basic software development and SDLC experience
Target Audience
DevOps, Security & Cloud Engineers seeking practical insights beyond theoretical security discussions
Testimonials (3)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
Jacek - Softsystem
Course - DevOps Engineering Foundation (DOEF)®
real life examples
