隨著 Web 在現代人生活中愈來愈重要，它的安全性也就愈應該受到重視。然而Web的改版頻率較之傳統的應用程式、或系統軟體，更為頻繁，要兼顧更新頻繁與資訊安全，就需要一個具有效率以及使用彈性的資安測試系統。雲端運算的一個重要概念，就是可以將任何東西轉為以服務的方式來提供 (as a service)，而且隨選隨用、用完即還，用多少算多少。
本論文提出一個資安測試即服務的系統 (Security Testing as a Service, STaaS) ，係利用Docker的容器技術，藉由OWASP ZAP的靜態掃描與動態分析等功能，提供資安測試服務。這個STaaS系統享有容易建立與部署、部署迅速、易於維護、與資源利用更有效率等好處。未來還可以加入自動化測試系統、與CI/CD整合，讓資訊安全也同時是軟體開發/部署流程的一個部份。

As people are more and more relying on web to get information and acquire services, the importance of web security can no longer be overstated. In the meantime, the web system is usually getting updated more often than traditional application systems. Therefore, it is more critical for web security testing to consider building a more flexible and efficient testing system in order to ensure the web security while being able to handle frequent updating cycles. One big advantage of cloud computing is to provide "anything as a service"; meaning for the extensive variety of services and applications for people to access on demand and to “pay as you go”.
This thesis aims to utilize the OS level virtualization technology provided by Docker and the powerful passive/active security scanning features provided by OSWAP ZAP, the web security testing application, to implement the Security Testing as a Service (STaaS). This STaaS system is not only quick to deploy, but also easy to maintain, and it’s even more efficient on resources utilization. In the future, STaaS can also be integrated with test automation, or CI/CD system to further embed security testing as a part of continuous development and deployment.

中文部份
1. 王宏仁 (2014)，「10個Q&A快速認識Docker」，(accessed 2018/3/25, available at: https://www.ithome.com.tw/news/91847)。
2. 李泳泉 (2010)，「Hyper-V伺服器虛擬化簡介」，(accessed 2018/5/13, available at: http://www.cc.ntu.edu.tw/chinese/epaper/0014/20100920_1408.htm)。
3. Goasguen, S. 著，Docker錦囊妙計，Philipz (鄭淳尹) 譯 (2016)。台北市：美商歐萊禮股份有限公司台灣分公司。
4. Hu, A. (2016) ，「Docker入門與實踐」，(accessed 2018/3/25, available at: https://www.gitbook.com/book/hujb2000/docker-flow-evolution/details)。
5. Wikipedia (2017)，「chroot」，(accessed 2018/5/13, available at: https://zh.wikipedia.org/wiki/Chroot)。
6. Wikipedia (2018)，「Docker (軟體)」，(accessed 2018/3/29, available at: https://zh.wikipedia.org/wiki/Docker_(%E8%BB%9F%E9%AB%94))。

英文部份
1. Asay, M. (2014), “Why Docker... and why now?” (accessed 2018/5/12, available at: https://www.techrepublic.com/article/why-docker-and-why-now/).
2. Bennetts, S. (2017), “Security Testing with OWASP ZAP in CI/CD - Simon Bennetts - Codemotion Amsterdam 2017,” (accessed 2018/3/29, available at: https://www.slideshare.net/Codemotion/security-testing-with-owasp-zap-in-cicd-simon-bennetts-codemotion-amsterdam-2017).
3. Hykes, S. (2014), “DOCKER 0.9: Introducing Execution Drivers and libcontainer,” (accessed 2018/3/29, available at: https://blog.docker.com/2014/03/docker-0-9-introducing-execution-drivers-and-libcontainer/).
4. Maklaan (2015), “Based on a Docker blog post, Public Domain,” (accessed 2018/3/29, available at: https://commons.wikimedia.org/w/index.php?curid=37965701).
5. Mishra, P., and N. Tripathi (2017), “Testing as a Service.” In: Mohanty, H., Mohanty, J., Balakrishnan, A. (eds) Trends in Software Testing. Springer, Singapore
6. O'Grady, S. (2014), “What is the Atomic Unit of Computing?” (accessed 2018/5/12, available at: http://redmonk.com/sogrady/2014/08/06/atomic-unit-computing/#ixzz3BdFBu12G).
7. Osnat, R. (2018), “A Brief History of Containers: From the 1970s to 2017,” (accessed 2018/5/11, available at: https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chroot-to-docker-2016).
8. OWASP (2018), “Docker · zaproxy/zaproxy Wiki · GitHub,” (accessed 2018/5/21, available at: https://github.com/zaproxy/zaproxy/wiki/Docker).
9. OWASP (2017), “OWASP ZAP User Guide,” (accessed 2018/3/29, available at: https://github.com/zaproxy/zap-core-help/wiki/HelpIntro).
10. Pardeshi, S. N., and V. Choure (2014), “Testing as a Service on Cloud: A Review”, International Journal on Recent and Innovation Trends in Computing and Communication, Volume: 2 Issue: 2, pp. 188~ 193, February 2014.
11. Psiinon (2017) (Bennetts, S.), “bodgeit/README.md,” (accessed 2018/5/6, available at: https://github.com/psiinon/bodgeit/blob/master/README.md).
12. Roke (2017), “File: Countries initially affected in WannaCry ransomware attack.png,” (accessed 2018/5/15, available at: https://zh.wikipedia.org/wiki/WannaCry#/media/File:Countries_initially_affected_in_WannaCry_ransomware_attack.png).
13. Rouse, M. (2012), “Testing as a Service (TaaS),” (accessed 2018/3/29, available at: http://searchcloudapplications.techtarget.com/definition/Testing-as-a-Service-TaaS).
14. Strotmann, J. (2016), “Infographic: A Brief History of Containerization,” (accessed 2018/5/11, available at: https://www.plesk.com/blog/business-industry/infographic-brief-history-linux-containerization/).
15. Wikipedia (2018), “Docker (software),” (accessed 2018/3/29, available at: https://en.wikipedia.org/wiki/Docker_(software)).
16. Wikipedia (2018), “Virtual Machine,” (accessed 2018/5/12, available at: https://en.wikipedia.org/wiki/Virtual_machine).