feat(lab10): DefectDojo governance report + capstone walkthrough

[alberto-de-swerto]

Lab 10 (capstone) — vulnerability management with DefectDojo. Report in submissions/lab10.md, interview script in submissions/lab10-walkthrough.md.

What I did

• Task 1 — setup + import: ran DefectDojo 3.1.0 (compose release profile), created the OWASP Juice Shop product + engagement, and imported 6 scan types / 8 imports from Labs 4–7 (Grype, Trivy, Semgrep, Checkov, KICS, Trivy-Operator) — 356 raw findings. Enabled deduplication → 50 collapsed to 306 unique. Dedup example: lodash CVE-2019-10744 found by Grype + Trivy×2, DefectDojo merged the two Trivy hits (same parser hash).
• Task 2 — governance: applied the SLA matrix (Critical 24h / High 7d / Medium 30d / Low 90d), remediated 6 fixable Criticals, risk-accepted 2 unfixable ones with a hard expiry, and reported the 6-section governance report — active-by-severity, by-tool, MTTR ~20d, median vuln-age 21d, SLA compliance 59.9%, and a SAMM Defect-Management next step.
• Bonus: a 5-minute interview walkthrough (timed ~4:30) with two anticipated Q&A answers.

Notes

• The Lab 4–9 scan outputs are gitignored results/ files, so I regenerated them (Grype/Trivy/Semgrep/Checkov/KICS) before importing. Only the 2 submission files are committed; the DefectDojo clone (labs/lab10/work/dd/) and scan outputs stay gitignored.
• trivy-k8s.json parsed to 0 findings (the lab's documented trivy k8s CLI vs Trivy-Operator CRD format mismatch) — noted in the report; those CVEs are already covered by the Trivy image import.

Checklist

• Task 1 — DefectDojo setup + imports + dedup proof
• Task 2 — Governance report with MTTR/SLA/age/backlog
• Bonus — 5-minute walkthrough script with timed practice