PollyS6 · PollyS6 · Jul 10, 2026
diff --git a/submissions/lab10-walkthrough.md b/submissions/lab10-walkthrough.md
@@ -0,0 +1,43 @@
+# 5-Minute DevSecOps Program Walkthrough — Juice Shop
+
+## (0:00–0:30) Context
+[1 sentence: I built a DevSecOps program around OWASP Juice Shop as the target...
+1 sentence: Tools used, scope, what's signed/scanned/verified.]
+I built a DevSecOps program around OWASP Juice Shop, whcih is vulnerable. Program uses tools liek SAST, runtime monitoring etc.
+
+## (0:30–2:00) Layers
+[Draw the diagram from Lecture 9 slide 18 in your words. Talk through:
+- Pre-commit: gitleaks for secrets + SSH-signed commits
+- Build: SBOM (Syft), SCA (Grype), SAST (Semgrep)
+- Pre-deploy: Checkov on IaC, Cosign sign + Conftest gate
+- Runtime: Falco eBPF detection
+- Program: DefectDojo aggregation + SLA matrix + MTTR/age]
+
+On pre-commit stage there are signed commits and Gitleaks scan. Then CI (Syft, Grype and Semgrep). Pre-deploy: Checkov scans Terraform, Cosign signs images and also there is Conftest. There is Falco for runtime and DefectDojo then summarizes all findings.
+
+## (2:00–3:00) Findings + Closures
+[Talk through:
+- "We closed <n> Critical findings this term."
+- "Here's one I risk-accepted — <name> — expiring <date>, why: <reason>."
+- "Strongest correlated finding: <name> — caught by both Semgrep and ZAP, fix was <X>."]
+347 findings were identified from 6 tools. Currently none have been closed, however I am eager to work further. Currently there were no risk accepted items, and there is no dedup, however manually there was found a finding that was found by two versions of grype. Finding GHSA-c7hr-j4mj-j2w6.
+
+## (3:00–4:00) Metrics
+[Talk through:
+- MTTR: <n> days (compare to DORA Elite which is <1 day, Lecture 9 slide 13)
+- Vuln-age median: <n> days
+- SLA compliance: <n>%
+- Backlog trend: <stable/falling/rising>]
+
+Current metrics are unfortunately poorly established, since there are yet no mitigated findings. There fore MTTR and SLA comliance cannot be established. New baseline is 347 active findings.
+
+## (4:00–4:30) Next Steps
+[1 sentence: "If I had another quarter, I'd ship..."
+1 sentence: tied to OWASP SAMM ladder progression.]
+If I had another quarter, I'd ship move to level 2 of SAMM ladder, i'd try to ship that when DefectDojo found a critical bug, it automatically created a Jira ticket.
+
+## (4:30–5:00) Q&A Anticipation
+Anticipate 2 likely questions and answer them in your script:
+1. "How would you handle a Log4Shell scenario?" → I would keep SBOM lists of every package, that would be checked by Grype. Then in case of Log4Shell appearance, I would be able to track everything in DefectDojo.
+
+2. "Why didn't you use IAST/paid tools?" → I used open-source tools. This project was for introductory study, therefore there was no need in paid tools.
diff --git a/submissions/lab10.md b/submissions/lab10.md
@@ -0,0 +1,86 @@
+# Lab 10 — Submission
+
+## Task 1: DefectDojo Setup + Import
+
+### DefectDojo version
+- Version installed: 3.1.0
+
+### Product + Engagement
+- Product ID: 1
+- Product name: OWASP Juice Shop
+- Engagement ID: 1
+- Engagement status: In Progress
+
+### Imports completed
+| Lab | Scan type | File | Findings imported |
+|-----|-----------|------|------------------:|
+| 4 | Anchore Grype | grype-from-sbom.json | 104 |
+| 4 | Trivy Scan | trivy.json | 105 |
+| 5 | Semgrep JSON Report | semgrep.json | 0 |
+| 5 | ZAP Scan | auth-report.json | Failed, different format needed |
+| 6 | Checkov Scan | results_json.json | 80 |
+| 6 | KICS Scan | kics-ansible/results.json | 10 |
+| 6 | KICS Scan | kics-pulumi/results.json | 6 |
+| 7 | Trivy Scan (image) | trivy-image.json | 42 |
+| 7 | Trivy Operator Scan | trivy-k8s.json | No such file due to skipped optional task 2 of lab 7 |
+| **Total raw imports** | | | 347 |
+| **After dedup** | | | 347 |
+Deduplication is not enabled, therefore i have no way other than manual to get the "after dedup" number.
+
+### Dedup example (Lecture 10 slide 11)
+Find ONE finding that DefectDojo dedupped across tools (same CVE/issue from ≥2 scanners). Quote:
+- CVE/ID: GHSA-c7hr-j4mj-j2w6
+- Number of source tools: 1, Grype, but 2 different findings(different versions)
+- DefectDojo's single finding ID: 2
+
+## Task 2: Governance Report
+
+### Executive Summary (3 sentences)
+Juice Shop, scanned across 6 tools, currently has 347 open findings (17 Critical + 136 High).
+Mean Time to Remediate (MTTR) on closed-this-period findings is 0 days. <n>% of findings closed
+within their SLA.
+
+### Findings by severity (active only)
+| Severity | Count |
+|----------|------:|
+| Critical | 17 |
+| High | 136 |
+| Medium | 158 |
+| Low | 27 |
+
+### Findings by source tool
+| Tool | Active | Mitigated | False Positive | Risk Accepted |
+|------|-------:|----------:|---------------:|--------------:|
+| Anchore Grype | 104 | 0 | 0 | 0 |
+| Trivy Scan (Lab 4) | 105 | 0 | 0 | 0 |
+| Semgrep | 0 | 0 | 0 | 0 |
+| ZAP Scan | 0 | 0 | 0 | 0 |
+| Checkov | 80 | 0 | 0 | 0 |
+| KICS (Ansible) | 10 | 0 | 0 | 0 |
+| KICS (Pulumi) | 6 | 0 | 0 | 0 |
+| Trivy Scan (Lab 7) | 42 | 0 | 0 | 0 |
+| **Total** | **347** | **0** | **0** | **0** |
+
+### Program metrics
+- **MTTD** (Mean Time to Detect): n/a - no data available
+- **MTTR** (Mean Time to Remediate): n/a - no mitigated findings
+- **Vuln-age median** (open findings): n/a - no data available
+- **Backlog trend**: 347 findings, baseline not yet established
+- **SLA compliance**: n/a - no mitigated yet
+
+### Risk-accepted items (must have expiry)
+No findings are currently "risk accepted"
+
+### Next-quarter goal (OWASP SAMM ladder step — Lecture 9 slide 15)
+What ONE concrete SAMM practice would you mature next quarter, and why?
+(2-3 sentences with specific data — e.g., "Defect Management — current MTTR for High
+is X days, target Y; add Falco-runtime ingestion via custom parser.")
+
+Defect Management. Since now there are 347 vulnerabilities and 17 are critical, none yet fixed. Next quarter a process must be created to fix them with compliance to SLA.
+
+## Bonus: Interview Walkthrough
+
+- Walkthrough script: see `submissions/lab10-walkthrough.md`
+- Practiced runtime: 8:50
+- Two anticipated Q&A questions covered: yes 
+- Strongest claim in the script (most-quoted-by-interviewer line, in your view): 347 findinfs were idenified with 6 tools.