From 6efd389f65d63e918327f4aef5ea578e7aade978 Mon Sep 17 00:00:00 2001 From: PollyS6 Date: Fri, 10 Jul 2026 23:43:11 +0300 Subject: [PATCH] feat(lab10): defectdojo governance report + capstone walkthrough --- submissions/lab10-walkthrough.md | 43 ++++++++++++++++ submissions/lab10.md | 86 ++++++++++++++++++++++++++++++++ 2 files changed, 129 insertions(+) create mode 100644 submissions/lab10-walkthrough.md create mode 100644 submissions/lab10.md diff --git a/submissions/lab10-walkthrough.md b/submissions/lab10-walkthrough.md new file mode 100644 index 000000000..c75517021 --- /dev/null +++ b/submissions/lab10-walkthrough.md @@ -0,0 +1,43 @@ +# 5-Minute DevSecOps Program Walkthrough — Juice Shop + +## (0:00–0:30) Context +[1 sentence: I built a DevSecOps program around OWASP Juice Shop as the target... +1 sentence: Tools used, scope, what's signed/scanned/verified.] +I built a DevSecOps program around OWASP Juice Shop, whcih is vulnerable. Program uses tools liek SAST, runtime monitoring etc. + +## (0:30–2:00) Layers +[Draw the diagram from Lecture 9 slide 18 in your words. Talk through: +- Pre-commit: gitleaks for secrets + SSH-signed commits +- Build: SBOM (Syft), SCA (Grype), SAST (Semgrep) +- Pre-deploy: Checkov on IaC, Cosign sign + Conftest gate +- Runtime: Falco eBPF detection +- Program: DefectDojo aggregation + SLA matrix + MTTR/age] + +On pre-commit stage there are signed commits and Gitleaks scan. Then CI (Syft, Grype and Semgrep). Pre-deploy: Checkov scans Terraform, Cosign signs images and also there is Conftest. There is Falco for runtime and DefectDojo then summarizes all findings. + +## (2:00–3:00) Findings + Closures +[Talk through: +- "We closed Critical findings this term." +- "Here's one I risk-accepted — — expiring , why: ." +- "Strongest correlated finding: — caught by both Semgrep and ZAP, fix was ."] +347 findings were identified from 6 tools. Currently none have been closed, however I am eager to work further. Currently there were no risk accepted items, and there is no dedup, however manually there was found a finding that was found by two versions of grype. Finding GHSA-c7hr-j4mj-j2w6. + +## (3:00–4:00) Metrics +[Talk through: +- MTTR: days (compare to DORA Elite which is <1 day, Lecture 9 slide 13) +- Vuln-age median: days +- SLA compliance: % +- Backlog trend: ] + +Current metrics are unfortunately poorly established, since there are yet no mitigated findings. There fore MTTR and SLA comliance cannot be established. New baseline is 347 active findings. + +## (4:00–4:30) Next Steps +[1 sentence: "If I had another quarter, I'd ship..." +1 sentence: tied to OWASP SAMM ladder progression.] +If I had another quarter, I'd ship move to level 2 of SAMM ladder, i'd try to ship that when DefectDojo found a critical bug, it automatically created a Jira ticket. + +## (4:30–5:00) Q&A Anticipation +Anticipate 2 likely questions and answer them in your script: +1. "How would you handle a Log4Shell scenario?" → I would keep SBOM lists of every package, that would be checked by Grype. Then in case of Log4Shell appearance, I would be able to track everything in DefectDojo. + +2. "Why didn't you use IAST/paid tools?" → I used open-source tools. This project was for introductory study, therefore there was no need in paid tools. \ No newline at end of file diff --git a/submissions/lab10.md b/submissions/lab10.md new file mode 100644 index 000000000..696fabaef --- /dev/null +++ b/submissions/lab10.md @@ -0,0 +1,86 @@ +# Lab 10 — Submission + +## Task 1: DefectDojo Setup + Import + +### DefectDojo version +- Version installed: 3.1.0 + +### Product + Engagement +- Product ID: 1 +- Product name: OWASP Juice Shop +- Engagement ID: 1 +- Engagement status: In Progress + +### Imports completed +| Lab | Scan type | File | Findings imported | +|-----|-----------|------|------------------:| +| 4 | Anchore Grype | grype-from-sbom.json | 104 | +| 4 | Trivy Scan | trivy.json | 105 | +| 5 | Semgrep JSON Report | semgrep.json | 0 | +| 5 | ZAP Scan | auth-report.json | Failed, different format needed | +| 6 | Checkov Scan | results_json.json | 80 | +| 6 | KICS Scan | kics-ansible/results.json | 10 | +| 6 | KICS Scan | kics-pulumi/results.json | 6 | +| 7 | Trivy Scan (image) | trivy-image.json | 42 | +| 7 | Trivy Operator Scan | trivy-k8s.json | No such file due to skipped optional task 2 of lab 7 | +| **Total raw imports** | | | 347 | +| **After dedup** | | | 347 | +Deduplication is not enabled, therefore i have no way other than manual to get the "after dedup" number. + +### Dedup example (Lecture 10 slide 11) +Find ONE finding that DefectDojo dedupped across tools (same CVE/issue from ≥2 scanners). Quote: +- CVE/ID: GHSA-c7hr-j4mj-j2w6 +- Number of source tools: 1, Grype, but 2 different findings(different versions) +- DefectDojo's single finding ID: 2 + +## Task 2: Governance Report + +### Executive Summary (3 sentences) +Juice Shop, scanned across 6 tools, currently has 347 open findings (17 Critical + 136 High). +Mean Time to Remediate (MTTR) on closed-this-period findings is 0 days. % of findings closed +within their SLA. + +### Findings by severity (active only) +| Severity | Count | +|----------|------:| +| Critical | 17 | +| High | 136 | +| Medium | 158 | +| Low | 27 | + +### Findings by source tool +| Tool | Active | Mitigated | False Positive | Risk Accepted | +|------|-------:|----------:|---------------:|--------------:| +| Anchore Grype | 104 | 0 | 0 | 0 | +| Trivy Scan (Lab 4) | 105 | 0 | 0 | 0 | +| Semgrep | 0 | 0 | 0 | 0 | +| ZAP Scan | 0 | 0 | 0 | 0 | +| Checkov | 80 | 0 | 0 | 0 | +| KICS (Ansible) | 10 | 0 | 0 | 0 | +| KICS (Pulumi) | 6 | 0 | 0 | 0 | +| Trivy Scan (Lab 7) | 42 | 0 | 0 | 0 | +| **Total** | **347** | **0** | **0** | **0** | + +### Program metrics +- **MTTD** (Mean Time to Detect): n/a - no data available +- **MTTR** (Mean Time to Remediate): n/a - no mitigated findings +- **Vuln-age median** (open findings): n/a - no data available +- **Backlog trend**: 347 findings, baseline not yet established +- **SLA compliance**: n/a - no mitigated yet + +### Risk-accepted items (must have expiry) +No findings are currently "risk accepted" + +### Next-quarter goal (OWASP SAMM ladder step — Lecture 9 slide 15) +What ONE concrete SAMM practice would you mature next quarter, and why? +(2-3 sentences with specific data — e.g., "Defect Management — current MTTR for High +is X days, target Y; add Falco-runtime ingestion via custom parser.") + +Defect Management. Since now there are 347 vulnerabilities and 17 are critical, none yet fixed. Next quarter a process must be created to fix them with compliance to SLA. + +## Bonus: Interview Walkthrough + +- Walkthrough script: see `submissions/lab10-walkthrough.md` +- Practiced runtime: 8:50 +- Two anticipated Q&A questions covered: yes +- Strongest claim in the script (most-quoted-by-interviewer line, in your view): 347 findinfs were idenified with 6 tools. \ No newline at end of file