CYBER-0 initial concept ready

2026-09-22 00:00:45 +02:00
parent 29eecd4f70
commit edb6cde069
70 changed files with 1976 additions and 3140 deletions
@@ -0,0 +1,15 @@
+# OWASP ZAP Methodology
+
+ZAP performs web application tests from ephemeral GitLab Kubernetes-executor pods. Targets come from the `web_applications` group in root `assets.yml`; authentication values come from environment-scoped GitLab variables.
+
+The OWASP ASVS source material used to develop the finding-to-control mapping is retained under `reference/OWASP_ASVS`.
+
+`run.sh` executes ZAP baseline scanning and a focused TLS preflight, because ZAP
+does not enumerate all protocol and cipher weaknesses. `scripts/normalize.py`
+maps both evidence sources to OWASP ASVS 5 controls using `asvs-mapping.json`.
+
+Run with:
+
+```bash
+./methodologies/zap/run.sh https://target.example
+```