ZAP Pen Test Job

The E2E stage of the pipeline has a job called "pen test". This job executes a ZAP pen test against the deployed staging environment of your application. We run a baseline scan against your application to automatically detect common security problems from black-box perspective. ZAP pen test reports are uploaded to SonarQube project named < APP NAME >-staging-dso-mil-zap.

Limitations

Pen Test does not work for cross-IL situations (e.g., code base in IL2, but deploying to IL4). Any team in this situation needs to run their tests locally, save the results, and provide them to Cyber.

Requirements

We require development teams to fix all issues greater than Low.

Exceptions

If you believe the findings are invalid or false-positives, please comment on the finding in SonarQube with your reasoning and then create a help desk ticket to have the exception granted: SonarQube/Fortify Whitelist Request