In this chapter, we discussed the infrastructure security, which includes security scanning for known vulnerable components, secure configuration, and secure communication. For the secure configuration, the CIS benchmarks, STIGs, and the OpenSCAP security guide are the guidelines we can follow. For the vulnerable components scanning, we demonstrated two technical approaches. One is CVE scanning with NMAP network scanning and the other is file scanning with OWASP dependency check. For the secure communication, we introduced SSLyze for the HTTPS commutation settings. Finally, we also demonstrated one BDD automation framework Gauntlt to do the NMAP scanning.
In the next chapter, we will introduce more BDD automation frameworks to apply to security testing.