Course Outline
1. DevSecOps Foundations: Security by Design
Core DevSecOps principles and secure Software Development Life Cycle (SDLC) integration
Demonstration: Comparative analysis of legacy pipelines versus modern secure architectures
Practical Exercise: Establish a foundational DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Bootcamp
Offensive Security Simulation:
- Deployment of a vulnerable application exhibiting SQL Injection and Cross-Site Scripting vulnerabilities
- Utilization of OWASP ZAP to identify and remediate security threats
Defensive Strategies:
- Implementation of automated security scanning using ZAP
- Integration of ZAP API into Continuous Integration/Continuous Deployment workflows
Practical Exercise: Configuration of ZAP baseline scans and custom attack rules
Assessment: Identification of concealed administrative access within a designated timeframe
3. Dependency Management: Supply Chain Security
Compromise Simulation:
- Injection of malicious npm packages containing known Common Vulnerabilities and Exposures
Defensive Strategies:
- Continuous vulnerability monitoring via OWASP Dependency-Track
- Enforcement of policy controls that reject builds containing critical vulnerabilities
Practical Exercise: Definition of vulnerability policies and alerting workflows
Critical Demonstration: Illustration of the systemic risk posed by compromised dependencies to infrastructure integrity
4. Vulnerability Management Operations
Exploitation Simulation:
- Exploitation of unpatched container vulnerabilities
Defensive Strategies:
- Centralization of vulnerability reporting through OWASP DefectDojo
- Container security scanning using Trivy
Practical Exercise: Development of dashboards for executive-level security reporting
Performance Assessment: Efficient triage of a standardized set of vulnerability findings
5. Secrets and Configuration Security Assurance
Exfiltration Simulation:
- Extraction of sensitive credentials from version control history using truffleHog
Defensive Strategies:
- Implementation of pre-commit hooks to prevent submission of sensitive data patterns (e.g.,
password=.*) - Use of ZAP configuration spidering to identify insecure settings
Practical Exercise: Deployment of secret scanning capabilities within GitHub Actions
Compliance Audit: Verification of credential exposure across internal communication channels
6. Conclusion: DevSecOps Implementation Roadmap
OWASP Tooling Integration Strategy:
- Formulation of an adoption plan for DefectDojo, Dependency-Track, and ZAP
Operational Action Plan:
- Development of a 30-day security implementation checklist
- Definition of DevSecOps Key Performance Indicators and reporting dashboards
Requirements
Basic proficiency in software development and SDLC processes
Target Audience
DevOps, Security, and Cloud Engineers seeking applied security training rather than theoretical overviews
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
High level of commitment and knowledge of the trainer
