Curriculum Scope: Certified DevSecOps Professional (CDP) & Cloud-Native Security Standard
Production-grade study plan for embedding shift-left security verification across the continuous delivery pipeline. Covers automated Static Application Security Testing (SAST with Semgrep), Dynamic Application Security Testing (DAST with OWASP ZAP), pre-commit and pipeline secrets detection (Gitleaks), Software Composition Analysis (SCA with OWASP Dependency-Check & Grype), and admission policy enforcement (Kyverno).
Normalize vulnerability findings using standard SARIF (Static Analysis Results Interchange Format) reports.
Author vulnerability exception policies and time-boxed security waiver lifecycles.
Hands-On Operational Lab Challenge:
Configure a CI/CD pipeline stage that ingests multi-tool SARIF findings and automatically fails the build if any unexempted Critical vulnerability is detected, while publishing actionable PR annotations.
Static Application Security Testing (SAST with Semgrep)
Deploy lightweight, high-speed SAST using Semgrep. Enforce language-agnostic security rules targeting SQL injection, XSS, SSRF, and custom organizational anti-patterns.
Syllabus Mastery Objectives:
Integrate Semgrep CLI into continuous integration pipelines targeting pull requests.
Run OWASP Top 10 and CWE Top 25 rulepacks across polyglot codebases (Python, Node.js, Go, Java).
Author custom Semgrep pattern rules to detect internal insecure coding practices and deprecated cryptographic libraries.
Implement differential scanning (semgrep ci) to analyze changed files without slowing pipeline cycle times.
Hands-On Operational Lab Challenge:
Write a custom Semgrep YAML rule that flags unescaped SQL string concatenation and weak HMAC algorithms in a microservice codebase; verify that PRs violating the rule are blocked.
Prevent confidential tokens, private keys, and API credentials from ever reaching Git remotes using pre-commit hooks and automated CI verification with Gitleaks.
Execute in-pipeline secret verification on all commits, pull requests, and merges.
Perform historical Git repository scans to uncover legacy leaked credentials and rotate compromised tokens.
Author custom regex patterns and baseline ignore files (.gitleaksignore) for authorized test stubs.
Hands-On Operational Lab Challenge:
Install a pre-commit hook that intercepts an accidental commit of a cloud API key; simulate a bypass attempt and verify that the remote CI Gitleaks check fails and rejects the push.
Step 04·Runtime Penetration Testing & API Vulnerability Scanning
Dynamic Application Security Testing (DAST with OWASP ZAP)
Execute automated runtime dynamic analysis against staging applications and RESTful APIs using OWASP ZAP, verifying real-world defenses against OWASP Top 10 attacks.
Syllabus Mastery Objectives:
Deploy OWASP ZAP in containerized headless mode within staging deployment pipelines.
Configure automated baseline scans checking for security headers, cookie flags, and misconfigurations.
Execute full dynamic API scans utilizing OpenAPI / Swagger specifications to fuzz endpoints.
Tune ZAP context files, authentication session tokens, and alert thresholds to minimize false positives.
Hands-On Operational Lab Challenge:
Spin up an ephemeral staging environment, trigger a containerized OWASP ZAP API scan against its Swagger endpoint, simulate an XSS and missing CSP header, and generate an automated vulnerability summary report.
Identify known CVEs in third-party libraries and container base images using OWASP Dependency-Check and Grype, generate SBOMs, and enforce Kyverno admission policies.
Syllabus Mastery Objectives:
Execute Software Composition Analysis (SCA) with OWASP Dependency-Check to detect CVEs in open-source dependencies.
Generate Software Bill of Materials (SBOM) using Syft and scan container images for operating-system vulnerabilities with Grype.
Enforce Kyverno admission control policies in Kubernetes to block deployment of images with unfixed Critical CVEs or running as root.
Automate continuous dependency upgrade monitoring and patch verification.
Hands-On Operational Lab Challenge:
Scan a Docker image containing an outdated package with Grype; generate its CycloneDX SBOM with Syft; deploy a Kyverno ClusterPolicy that intercepts and denies deployment of any container image with Critical CVEs.
Tooling:grype <image-name> --fail-on highsyft <image-name> -o cyclonedx-json > sbom.jsondependency-check --project 'App' --scan ./kubectl get clusterpolicy -A