隨著 Web 在現代人生活中愈來愈重要，它的安全性也就愈應該受到重視。然而Web的改版頻率較之傳統的應用程式、或系統軟體，更為頻繁，要兼顧更新頻繁與資訊安全，就需要一個具有效率以及使用彈性的資安測試系統。雲端運算的一個重要概念，就是可以將任何東西轉為以服務的方式來提供 (as a service)，而且隨選隨用、用完即還，用多少算多少。 本論文提出一個資安測試即服務的系統 (Security Testing as a Service, STaaS) ，係利用Docker的容器技術，藉由OWASP ZAP的靜態掃描與動態分析等功能，提供資安測試服務。這個STaaS系統享有容易建立與部署、部署迅速、易於維護、與資源利用更有效率等好處。未來還可以加入自動化測試系統、與CI/CD整合，讓資訊安全也同時是軟體開發/部署流程的一個部份。;As people are more and more relying on web to get information and acquire services, the importance of web security can no longer be overstated. In the meantime, the web system is usually getting updated more often than traditional application systems. Therefore, it is more critical for web security testing to consider building a more flexible and efficient testing system in order to ensure the web security while being able to handle frequent updating cycles. One big advantage of cloud computing is to provide "anything as a service" meaning for the extensive variety of services and applications for people to access on demand and to “pay as you go”. This thesis aims to utilize the OS level virtualization technology provided by Docker and the powerful passive/active security scanning features provided by OSWAP ZAP, the web security testing application, to implement the Security Testing as a Service (STaaS). This STaaS system is not only quick to deploy, but also easy to maintain, and it’s even more efficient on resources utilization. In the future, STaaS can also be integrated with test automation, or CI/CD system to further embed security testing as a part of continuous development and deployment.
