ZAP for Everybody | Venkata Subrahmanyam & Ved Mishra | ZAPCon 2022
Presents ZAP for Everybody | Venkata Subrahmanyam & Ved Mishra | ZAPCon 2022 and evaluates key implications for security practitioners.
Summary
Goldman Sachs ZAP Platform
Venkata Subrahmanyam and Ved Mishra describe scaling OWASP ZAP inside Goldman Sachs as customizable, cloud-friendly DAST beyond commercial scanners. Their internal "ARIES" project wraps ZAP plus downstream ticketing and data-lake integrations.
Why ZAP
They needed customizable rules from internal research, elastic scale toward 700–1000 applications, and hooks into existing GitLab, secret managers, and vulnerability workflows.
Headless Architecture
They skip ZAP GUI for speed, driving scans via GitLab jobs reading an applications list JSON with endpoints, auth, scan types, and whitelists. Conduit deploys Dockerized ZAP with custom rules to many Kubernetes pods acting as parallel scanners.
Scan Types and Onboarding
Three modes include scheduled scans, ad hoc pen tester runs, and event-driven scans on deploys to QA or production. Developers open Jira tickets, update JSON config documented on an internal site, and merge requests trigger validation pipelines before Conduit pushes new scanner pods.
Related talks
ZAPCon·8 min
Evaluates kick-Off | Joni Klippert | ZAPCon 2022 and evaluates key implications for security practitioners.
ZAPCon·39 min
Reviews the OWASP Top Ten 2021 and ZAP | Jim Manico | ZAPCon 2022 and evaluates key implications for security practitioners.
ZAPCon·38 min
Details ZAP Project Updates | Simon Bennetts | ZAPCon 2022 and evaluates key implications for security practitioners.