Course Outline
1. DevSecOps Basics: Security by Design
Key Topics: Fundamental DevSecOps concepts & secure SDLC
Demonstration: Direct comparison between legacy and modern secure pipelines
Hands-on Exercise: Create your initial DevSecOps-enabled pipeline template
2. OWASP ZAP Security Testing Intensive
Attack Scenarios:
- Set up a vulnerable application featuring SQLi & XSS
- Leverage OWASP ZAP to identify and neutralize threats
Defense Strategies:
- Automated scanning using ZAP
- CI/CD integration through the ZAP API
Hands-on Exercise: Tailor ZAP baseline scans + attack rules
Challenge: “Locate the concealed admin panel within 10 minutes”
3. Dependency Risks: Supply Chain Protection
Attack Scenarios:
- Introduce a malicious npm package containing CVEs
Defense Strategies:
- Track vulnerabilities using OWASP Dependency-Track
- Implement policy gates that halt builds upon critical CVEs
Hands-on Exercise: Establish vulnerability policies & alert workflows
Compelling Demo: “How a single flawed dependency can compromise your infrastructure”
4. Vulnerability Management Command Center
Attack Scenarios:
- Exploit unpatched container vulnerabilities
Defense Strategies:
- Centralize reporting via OWASP DefectDojo
- Scan containers using Trivy
Hands-on Exercise: Develop real-time dashboards for CISO/executive reports
Competition: “Prioritize 50 findings quicker than competitors”
5. Secrets & Configuration Crisis Management
Attack Scenarios:
- Extract secrets from Git history using truffleHog
Defense Strategies:
- Pre-commit hooks to block patterns like
password=.* - Utilize ZAP’s configuration spider to reveal risky settings
Hands-on Exercise: Set up GitHub Actions secrets scannin
Reality Check: “Your database password is currently visible in Slack”
6. Conclusion: DevSecOps Strategic Roadmap
OWASP Integration Plan:
- Map out the adoption of DefectDojo, Dependency-Track, and ZAP
Individual Action Plan:
- Outline a 30-day security checklist
- Establish your DevSecOps KPIs & reporting dashboards
Requirements
Basic software and SDLC knowledge
Target Audience
DevOps, Security & Cloud Engineers who are tired of abstract security presentations
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 1600 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
Craig was extremely involved in the training, always making sure we are paying attention, adapted the examples to our day-to-day activities and always provided an answer when asked, even if the information was not added in the presentation.
Ecaterina Ioana Nicoale - BOOKING HOLDINGS ROMANIA SRL
Course - DevOps Foundation®
real life examples
