Security Automation with Ansible 2

Continuous scanning workflow using ZAP and Jenkins

Jenkins is an open source automation server. It is used extensively in CI/CD pipelines. These pipelines usually refer to a series of automated steps that occur based on triggers, such as code commits to version control software or a new release being created.

We already saw the example of ZAP Baseline's scans being part of the Mozilla release cycle. We can integrate ZAP with Jenkins. While there are many ways we can do this, a useful set of steps will be the following:

1. Based on a trigger, a new ZAP instance is ready for scanning
2. The ZAP instance runs against an automatically deployed application
3. The results of the scan are captured and stored in some format
4. If we choose, the results can ...