Feature/lab10

[raaller]

Goal

Aggregate security findings from Labs 4–9 in DefectDojo, apply vulnerability-management SLAs, calculate program metrics, and prepare a five-minute DevSecOps walkthrough.

Changes

• Added submissions/lab10.md with:

  • DefectDojo Product and Engagement details
  • imported scan report summary
  • finding counts by severity and source tool
  • MTTD, MTTR, vulnerability-age, backlog, and SLA metrics
  • cross-tool deduplication analysis
  • risk-acceptance status
  • next-quarter OWASP SAMM improvement goal

• Added submissions/lab10-walkthrough.md with the bonus five-minute interview walkthrough.

• Imported 7 reports across 6 DefectDojo scan types:

  • Anchore Grype
  • Semgrep JSON Report
  • Checkov Scan
  • KICS Scan
  • Trivy Scan
  • Trivy Operator Scan

• Applied the following SLA targets:

  • Critical: 1 day
  • High: 7 days
  • Medium: 30 days
  • Low: 90 days

• Documented unavailable or unsupported reports instead of inventing results.

Testing

# Verify that DefectDojo services are running
cd labs/lab10/work/dd
docker-compose ps

# Result:
# PostgreSQL, Valkey, uWSGI, Celery worker, Celery beat, and nginx are running.
# DefectDojo is available at http://127.0.0.1:8081.

# Verify the Product and Engagement
curl -s \
  -H "Authorization: Token $DD_TOKEN" \
  "$DD_URL/api/v2/products/1/" \
  | jq '{id, name}'

# Result:
# {
#   "id": 1,
#   "name": "OWASP Juice Shop"
# }

curl -s \
  -H "Authorization: Token $DD_TOKEN" \
  "$DD_URL/api/v2/engagements/1/" \
  | jq '{id, name, status}'

# Result:
# {
#   "id": 1,
#   "name": "Course Semester Run",
#   "status": "In Progress"
# }

# Count imported findings
curl -s \
  -H "Authorization: Token $DD_TOKEN" \
  "$DD_URL/api/v2/findings/?engagement=1&limit=1" \
  | jq .count

# Result:
# 275

# Check the active finding distribution by severity
curl -s \
  -H "Authorization: Token $DD_TOKEN" \
  "$DD_URL/api/v2/findings/?engagement=1&active=true&limit=500" \
  | jq '[.results[].severity]
        | group_by(.)
        | map({severity: .[0], count: length})'

# Result:
# Critical: 12
# High: 119
# Medium: 128
# Low: 7
# Informational: 9

# Validate the submission files
test -f submissions/lab10.md
test -f submissions/lab10-walkthrough.md
git diff --check

# Result:
# Both submission files exist.
# No whitespace errors were reported.

Artifacts & Screenshots

• submissions/lab10.md — DefectDojo governance report and program metrics
• submissions/lab10-walkthrough.md — five-minute DevSecOps interview walkthrough
• DefectDojo deployment verified locally at http://127.0.0.1:8081
• 275 findings imported from 7 reports across 6 scan types
• Cross-tool deduplication was evaluated using common Grype and Trivy vulnerability IDs

Checklist

[x] Title is clear (feat(labN): <topic> style)
[x] No secrets/large temp files committed
[x] Submission file at submissions/lab10.md exists
[x] Task 1 — DefectDojo setup + imports + dedup proof
[x] Task 2 — Governance report with MTTD/MTTR/SLA/backlog
[x] Bonus — 5-minute walkthrough script with timed practice